Privacy
Privacy notice
Last updated 28 August 2026
The short version. We collect what is needed to give you lawn-care advice, and little else. Your photographs are never stored. We do not sell anything, we run no advertising, and there are no third-party trackers on this site. Measuring how the site is used happens only if you say yes, and you can change that answer at any time.
Who is responsible for your data
LawnCue is the data controller for the personal data described here. For anything in this notice, including a request to see or delete your data, contact hello@lawncue.co.uk.
What we collect, why, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Email address and a hashed password | To create your account, sign you in, and let you reset a forgotten password. | Contract |
| Your lawn profile — outward postcode area, approximate size, soil, sun, drainage, goal and equipment | It is what makes the advice specific to your lawn rather than generic. | Contract |
| Care you record — mowing, watering, feeding, checks you carry out | The weekly plan is calculated from what you have already done. | Contract |
| Photographs you upload | Analysed to assess the lawn. Held in memory only for the length of the request. | Contract |
| The result of an analysis, including a health score | So repeat photographs can show whether things have improved. | Contract |
| Which pages you open and for how long | To find the parts of the product that are not working. | Consent — and only if you agree |
| Counts of analyses started, succeeded and failed, and technical error logs | To keep the service working and to understand what it costs to run. | Legitimate interests |
| Your IP address, used only as a temporary counter | To limit how often the same connection can trigger paid requests or sign-in attempts. | Legitimate interests — preventing abuse |
Where we rely on legitimate interests, the interest is running a small service securely and affordably. We use the least data that achieves it: rate-limit counters are keyed to a value derived from your connection and expire within the hour, and error logs record what failed and at which stage, never your photographs, your password or your full postcode.
Your photographs
A photograph you upload is sent to OpenAI for analysis and is held in memory for the length of that request. It is never written to disk by LawnCue, never added to a gallery, and never used to train any model — the request is made with storage disabled on OpenAI’s side. Location metadata is stripped in your browser before the file is uploaded, because the image is re-encoded during resizing. What we keep afterwards is the assessment, not the picture.
OpenAI does not receive your postcode, your email address or your account identifier. It receives the photograph and the answers you gave about the lawn.
What is stored on your device
LawnCue sets no advertising or tracking cookies. There are no third-party scripts on this site. What we do store is:
- A sign-in cookie, so you stay signed in between pages. Strictly necessary for a service you asked for, so it does not require consent.
- Your lawn details and calculator entries, kept in your browser so the product works and so you do not have to type them again. Also strictly necessary.
- A random usage identifier, which groups one visit’s pages together so we can see where people get stuck. This one is not strictly necessary, so it is only created if you agree. It is deleted when you close the tab, is not a cookie, cannot follow you to any other website, and is not linked to you as a person.
- Your answer to the consent question, so we can honour it and stop asking.
Your choice about usage measurement
You can change your mind at any time, and refusing costs you nothing — every feature works exactly the same either way.
Who else processes your data
- Amazon Web Services — hosting and technical logs. London region (eu-west-2), United Kingdom.
- Neon — the database holding your account, lawn and history. London region (eu-west-2), United Kingdom.
- OpenAI — photograph analysis. United States.
- Postcodes.io — converts a postcode to approximate coordinates. United Kingdom.
- Open-Meteo — the weather forecast, requested using approximate coordinates only, never your address or identity. European Union.
- Resend — sends password-reset email, when that feature is enabled. United States.
Your account, lawn profile and history are stored in the United Kingdom. Data reaching OpenAI and Resend is transferred outside the UK; those transfers rely on the safeguards in those providers’ data-processing terms, including the UK Addendum to the standard contractual clauses. We do not sell personal data or share it for anyone else’s marketing.
How long we keep things
- Your account, lawn and history — until you delete your account.
- Photographs — not kept at all.
- Password-reset links — one hour, and they stop working once used.
- Rate-limit counters — under an hour.
- Usage measurements — kept while the beta runs, and not attached to your account once it is deleted.
Deleting your account removes your profile, your recorded care and your visit record immediately. Aggregate counts — how many analyses succeeded in a week — survive, but they are no longer linked to you or to anyone.
Automated processing
The assessment of your photograph is produced with help from an AI model, and the weekly plan is calculated by fixed rules. Neither makes a decision with a legal or similarly significant effect on you — it is gardening advice, and you are free to ignore it. The health score is a visual estimate from a photograph, not a measurement.
Your rights
You have the right to:
- see the personal data we hold about you — you can download it yourself from your account page, at any time;
- have it corrected, or delete your account outright, also from the account page;
- ask us to restrict or object to processing based on legitimate interests;
- receive your data in a portable format — the export is machine-readable JSON;
- withdraw consent for usage measurement, using the buttons above.
To exercise anything not available in the app, contact hello@lawncue.co.uk. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
Security, and an honest limitation
Passwords are stored only as a hash, reset links are single-use and stored only as a hash, all provider keys stay on the server, and traffic is encrypted in transit. Sign-in, registration and analysis requests are rate limited.
LawnCue is an early private beta run by a very small team. We do not yet verify email addresses at sign-up, which means someone could register using an address that is not theirs. Please do not put anything sensitive into free-text fields, and use a password you do not use anywhere else.
Children
LawnCue is intended for adults and is not directed at children.
Changes
If we change what we collect or why, we will update this page and the date at the top. If the change is significant, we will tell you rather than relying on you noticing.