Privacy statement

What happens to your address

When you enter an address, your own browser looks it up at PDOK, the Dutch government's public data service, and the matching parcel at the Kadaster. Your browser then puts the parcel number and the address into the link of your design and opens that link. Our server looks nothing up and does not keep your address: there is no database and no account.

Because your browser contacts these services itself, PDOK and the Kadaster see your IP address and the address you search for. For the shade, your browser also fetches building heights from 3DBAG, a dataset by TU Delft and 3DGI. That request carries your IP address and a square 200 to 400 metres wide around the middle of your parcel. Whatever these parties record themselves falls under their own terms.

From then on that link is the only thing that opens your design, and it carries your address in readable form. Anyone who has the link can read your address out of it and view your parcel. Your drawing itself lives only in your browser and is not in the link.

Every time you open the design, your browser requests that link from our server. Our hosting provider Cloudflare keeps a log line for 1 percent of all requests. It holds the page address, so sometimes the link with your address, your IP address, your browser and the approximate location Cloudflare derives from your IP address. Cloudflare keeps those log lines for 7 days, the period of the paid Workers plan we use.

The legal basis for this lookup is that it is necessary to deliver the service you asked for, Article 6(1)(b) GDPR. Whether that is the right basis for a free service without accounts is a question we are putting to a lawyer.

What we measure, and under which consent

If you allow analytics, we measure two kinds of thing. First, thirteen events we built in ourselves: that you open the home page, that you enter an address, that your parcel loaded, that loading failed, that you change something in your design, that you export, that you share your design as an image, that making your plan PDF failed, that you use a part of the tool you only look with (such as the sun at another hour, the aerial photo or the measurements), that you save your gardens as a file, that you open such a file, that loading the building heights failed or took too long, and that you sent feedback. Each of those carries a few technical attributes, such as how many buildings are in view, why loading failed, which export format you chose, whether you sent a shared image through the share menu or downloaded it, at which step your plan PDF failed, how long loading the building heights took before it went wrong or how many gardens a file holds. For a change to your design, that is the kind of thing you changed (a tree, a shrub, a lamp, a paved surface), whether you added, changed or removed it, and whether you did that yourself or your own AI did. Which plant it is, what you named something, how large it is and where it stands do not travel with it. Of your feedback, only the fact that you sent it travels, not what it says.

Second, PostHog itself records which pages you view and when you leave a page. It does not record clicks or form submissions: that is switched off. So the text of the button you click, and the structure of the page, do not travel with it.

Your address, your postcode and the link to your design never travel with it. That link contains your address, so it is made unrecognisable before an event leaves your browser. The same happens to the page title, because in the design tool the title is your address.

Processing happens at PostHog in the EU. PostHog does not store your IP address with the event. It does derive an approximate location from it before discarding it, and stores that with every event: your city, the digits of your postal code and a coordinate with an uncertainty radius. That is a setting in our PostHog project. For crash reports we receive without your consent, this is not done with your IP address.

If you have given no consent and we are sending only a crash report, PostHog derives a code from your IP address, your browser characteristics, the site name and a secret daily value, so that separate reports from the same day belong together. The daily value changes every day and is deleted afterwards, so today's code is a different one tomorrow. That code is not stored on your device and we cannot attach a name or email address to it ourselves. Whether this approach requires consent under Dutch cookie rules is a question we are putting to a lawyer before launch.

What a session recording shows

If you allow session recordings, we record your screen as video: your mouse movements, your clicks, the design drawing itself, and whatever the app writes to the browser console. That includes your parcel outline, and the shape of your house and garden.

In the drawing and in the bar at the top, your address is masked. Your parcel outline is not, because that is the drawing. This is why it is a separate choice: a recording shows far more than a count.

We watch recordings back to find where the tool goes wrong. Session recordings only work together with analytics: switch analytics off and recordings stop too.

The legal basis for each purpose

For analytics and session recordings the basis is your consent, Article 6(1)(a) GDPR. Withhold it and neither happens, and you can withdraw it at any time.

For the crash reports we receive even without consent, the basis is our legitimate interest, Article 6(1)(f): without those reports we cannot find and repair a fault. The balancing test that goes with it is written down and will be put to a lawyer before launch.

Your drawing sits on your own device and we receive no copy of it, unless you send your design along with feedback yourself. If you allowed analytics, we do receive what kind of thing you changed, a tree or a lamp for example, and not which plant it is or where it stands (see ‘What we measure’ above). Your address reaches us only as part of your design's link, each time your browser requests it; the lookup itself is done by your browser. Your drawing may be written to your device without asking because it is the service you asked for: it is the drawing you are working on at that moment.

For the login screen, for the log lines of the AI connection and for the counts per IP address we rely on our legitimate interest, Article 6(1)(f): keeping the test version closed to people we have not invited, finding faults in the connection and stopping link codes being guessed. We are putting that choice to a lawyer as well.

What happens if you refuse

If you choose “Necessary only”, we do not measure your visit. No PostHog cookie is set, you get no number we could recognise you by, and no recording is made. Your browser does talk to PostHog in one place on every visit, before you choose anything: groei.tuinontwerp.app, an address of ours that PostHog runs. It fetches two script files there: the settings of our PostHog project, and the component that can report a crash. No event, click or page view goes to PostHog with them and nothing is put on your device, but PostHog does see your IP address and your browser characteristics (the User-Agent line), as any server does of a browser fetching from it. Without the crash file we cannot receive a crash report, not even from someone who refuses analytics; the settings file decides what may and may not be measured. That is why we count them as necessary to make the site work.

One thing does continue: if the app crashes, we receive that crash report. It contains the error itself, the place in the code where it went wrong, the page you were on, and technical characteristics of your browser: the type and version of your browser and operating system, your screen size, your language and your time zone. The link to your design and the page title both contain your address; both are made unrecognisable before the report is sent. No cookie travels with it, but PostHog does derive the daily code described under ‘What we measure’. If something goes wrong on our server, we send a crash report from there too; it contains the page (made unrecognisable) and nothing about your browser or your IP address. We do this because otherwise we cannot find and repair a fault, and we rely on our legitimate interest in keeping the app working.

If you would rather send no crash reports either, email privacy@tuinontwerp.app. There is no separate switch for this in the app at the moment. You can stop the reports from your browser yourself by blocking traffic to groei.tuinontwerp.app; that does not stop the reports sent from our server.

How long it is kept

PostHog keeps session recordings for 30 days. Events and crash reports are kept for 1 year, with the approximate location attached to them. Cloudflare’s log lines are described above under ‘What happens to your address’ and ‘Your own AI and the relay’, the login record under ‘Logging in to the design tool’.

These are the retention periods of the free plan we use today. If we move to a different plan, we update this text.

What sits on your own device

Your designs sit in your own browser, not with us. They hold your address and your parcel outline. There is no copy on our servers and we cannot reach it. The one exception is a design you send along with feedback yourself: that one is then in our mailbox.

What exactly is stored, how long it stays, and how to clear it is in the cookie policy.

Logging in to the design tool

The design tool is open only to people we have invited. That is why a login screen from Cloudflare Access sits in front of it: you enter your email address, Cloudflare emails you a one-time code, and that code lets you in. This is not an account: we keep no design and no profile under your email address.

Cloudflare Access records every login attempt, with your email address, your IP address, your country, the time and whether you got in. That record is kept for 24 hours on the free plan we use. Access also keeps a list of who has logged in, with the email address and the time of the last login, until we remove that person.

Your own AI and the relay

You can let your own AI app, for example Claude, work on the design open in your browser. To do so you get a link code in the design tool and give it to your AI. Your AI app does not log in anywhere and gives us no name or email address. With the code it gets a key from our server for that one design. The key stops working as soon as you unlink, close or reload your tab, your AI asks nothing for 30 minutes, after 8 hours, or when we end the link. If you allowed analytics, a change to your design is measured as made by your AI and not by you (see ‘What we measure’).

Only when you press ‘Get a code’ does your tab connect to a relay on our server, so that your AI can reach the design. That relay is a Cloudflare Durable Object for that one link, and it is not tied to an account or an email address. While the design tool sits behind the login screen, our server checks your login on that connection (see ‘Logging in to the design tool’), but it does not keep your email address.

The relay passes requests and answers on and stores no design. While the link runs, it remembers the link code, a random number for your tab, the design’s identifier, the address, the version number and the times of linking and of the last request. It holds your tab’s IP address only until your tab has announced itself, a few seconds after it connects. It counts how many requests your AI has made this hour, because it lets at most 300 an hour through. When the link stops, it keeps for 8 more hours only that it stopped and why, so that your AI is told; after that everything is gone. To stop codes being guessed, our server counts per IP address (for IPv6, per block of your connection) how many codes were requested this hour and how many wrong codes were tried. Those counts are deleted when the hour is over. We have not pinned the relay to the EU, so Cloudflare can run it in a data centre outside the EU.

Our server writes one log line for every request from your AI and every connection from your tab. A line holds the time, the kind of request, the name of the tool your AI used, the result, how long it took and a short code that belongs to the link. Your IP address, your location, your browser, your email address, the link code and your design are not in it. Cloudflare keeps these lines for 7 days, the period of the paid Workers plan we use. Cloudflare’s own record of each request, with your IP address and an approximate location, is switched off for the AI connection.

Your AI provider, for example Anthropic for Claude, receives what your AI reads from the design you open: the address, the parcel, the buildings and what you have placed. That happens at your instruction, through your own account with that provider, and falls under its terms. Who is responsible for that step under the GDPR is a question we are putting to a lawyer.

The waiting list

To join the waiting list, you open a sign-up form. You can do that with the ‘Waitlist’ button in the menu bar, with the button at the bottom of the home page, or by entering an address on the home page while the design tool is not open yet. The form is an embedded page from Tally, a Belgian company. Your browser fetches it only when you open it; an ordinary visit makes no connection to Tally. If you do open it, Tally sees your IP address. Inside that frame Tally also loads its own scripts: in our measurement on 22 September 2026 the form page connected to Sentry in the United States. That sits outside our cookie notice; it is an open point before launch.

If you fill in the form, we receive through Tally your email address, whether you are signing up for your own garden or for your work, and the name you would like us to use, if you enter one. We use that to email you when the app is available, and afterwards to send you a short questionnaire about your garden plans.

The legal basis is your consent: you submit the form yourself. You can leave the list at any time by emailing privacy@tuinontwerp.app; we then remove your details from it. How long we keep the list if you do not opt out has not been set yet; it will be added before launch.

Feedback you send us

In the design tool you can send us a message from Settings. We then receive your message and its kind (idea, problem or question), your email address if you give one, your language, the size of your screen, the type and version of your browser, the page link and a few states of the tool, such as the open layer and whether the sun is on.

If you leave ‘Send my design and a picture of the plan along’ ticked, your design goes along too, with your address and your parcel outline, and a picture of the drawing as it is on your screen. This is the only moment your design leaves your device. Untick it, and the design, the picture and the part of the link that holds your address are not sent.

Your browser sends the message to our server at Cloudflare. It does not keep it: it turns it into an email to our own mailbox at Zoho, in the EU. To stop abuse, Cloudflare counts per IP address how many messages arrive per minute; that count lapses after a minute. If Cloudflare keeps a log line for the request, see ‘What happens to your address’, it holds only the kind of your message and whether sending worked, not the text and not your email address.

We read your message to improve the tool, and we reply by ordinary email if you gave an address. The legal basis is your consent, Article 6(1)(a) GDPR: you send the message yourself. Whether that is the right basis, and whether the tick for the design may then be set in advance, is a question we are putting to a lawyer.

The message stays in our mailbox. A retention period has not been set yet; it will be added before launch. If you want us to delete your message, email privacy@tuinontwerp.app.

If sending does not work, the form offers to send your text with your own mail program, to hello@tuinontwerp.app. Then only your text travels, through your own email provider.

Your rights and complaints

You have the right of access, rectification, erasure, restriction, portability and objection. Something particular applies here: we hold no account for you and no copy of your design, so there is nothing at our end tied to your name or email address, except feedback you sent us yourself. The events we measure hang off a random number in your own browser, not off your name or your email address. Clear the PostHog cookie and we can no longer connect them to you.

If you would still like to make a request, or withdraw your consent, email privacy@tuinontwerp.app. The quickest way to withdraw consent is the Cookie settings control at the bottom of every page.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in a new tab).

What this statement does not cover yet

This statement is not complete yet. Before public launch it will gain the registered company details of the data controller, and the sections on accounts and paid features once those exist.

The app has no accounts and no payments today. The login screen of the design tool is described above.

The parties that process data on our behalf are listed on the subprocessors page.