Privacy Policy

Hanahaki is run by a single individual as a hobby (“the keeper”), who decides how your data is used.

Write to alexmas9n@gmail.com.

• Account: your email address and a password, which is stored only as a salted hash. If you use Google sign-in, we receive your name, email address and profile picture from Google.
• Profile: the handle you choose and, if you add them, a display name, bio, pronouns and avatar. These show on your public garden unless you change its visibility.
• What you plant: blooms, whispers, waterings and any images, with the times they were made. This can include the optional name of whom a message was meant for, which may be about someone else. Blooms planted without an account are stored without an author.
• Technical records: sign-in sessions (with the IP address and browser details seen at sign-in), when you were last seen, and counters that limit abuse, whose keys may be derived from your IP address.
• Donations: if you send one, the keeper records the blockchain transaction (hash, coin, amount, date) by hand. Only the total, and the coin and rough date of the latest few, are public. We never ask for your wallet address.

To run the garden: to sign you in, show what you and others have planted, make blooms wilt and bloom, keep the service secure and stop abuse, handle reports, and keep the books on running costs. We do not use it for profiling or advertising.

Public blooms are published to the open web. Search engines such as Google may index and cache them, and others may copy them. If you delete a bloom we remove it from Hanahaki, but we cannot force other sites or search engines to forget their copy; you can ask a search engine to refresh or remove it. Private blooms and your private garden are not published.

An anonymous bloom hides your handle from other visitors, in the page and in the data we send them. It is still linked to your account in our database, shows in your own garden, and is visible to the keeper when handling reports.

We set one essential cookie to keep you signed in, and remember your light or dark preference in your browser's local storage. Neither is used for tracking, so there is nothing to opt out of.

• Account and profile. Until you close the account, then erased at once.
• A bloom that faded. Kept, privately, in the garden of the member who planted it.
• A bloom you deleted. Hidden at once, permanently erased within 30 days.
• Sign-in sessions and abuse counters. Short-lived, and removed when they expire.
• Donation records. Kept as long as the keeper's accounts need them (hash, coin, amount, date).

We may keep something longer where we must, to prevent abuse or meet a legal duty. Content others have copied elsewhere is outside our control.

• Vercel: hosting of the website and the API.
• Neon: the database.
• Backblaze: storage for uploaded images.
• Google: sign-in, only if you choose “Continue with Google”.

These providers may process data in countries other than your own. We share data with no one else, unless the law requires it or it is needed to protect someone from harm.

Transactions on a public blockchain are visible to everyone and cannot be erased, whatever we do. Your wallet address is part of the transaction, though we never ask for it.

You can download everything we hold about you, and delete your account and what you planted, yourself, from Your data and Sign-in in your settings. You can also edit your profile there. To correct something you can't change yourself, write to us. If the law gives you more rights (for example in the EU, the UK or California), you can use those too, and you may complain to your local data protection authority. If a bloom names or exposes you, report it or write to us, and we will remove it.

Write to alexmas9n@gmail.com.

Hanahaki is for people aged 16 and over. If you think a younger person has joined, tell us and we will remove the account.

If we change this policy, we will update the date above, and for significant changes say so on the site. See also the Terms of Service.