Privacy

What is collected when you order, why, and who else ever sees it.

I wrote this page myself, for a one-person nursery, in plain English — a lawyer did not write it, and where a term here is one California law does not let a seller change, the law wins. Ask me anything about it before you order rather than after.

Last updated: October 12, 2026.

1. What this is, and who it is from.

This notice covers the personal information Mysterious Yard LLC collects through this website.

California requires any commercial website that collects personal information from people in California to post a notice, and to answer five things in it. This is that notice, and the five are: what it collects (section 2), who else sees it (section 5), how you look at your information and get it corrected (section 10), how a change here is announced (section 14), and what this site does about a browser's Do Not Track signal (section 7).

This business is far below the size thresholds in the California Consumer Privacy Act. It is not a "business" as that law defines one, and it does not sell or share personal information at all. The rights in section 10 are offered anyway, as a matter of policy, to everyone who orders here rather than to Californians only. I honor them the same way whether or not a law makes me.

2. What is collected.

Your order — the name, delivery address and email address on it, and the phone number the payment page asks for, which goes to the carrier with the label; what you bought, what it cost, and the order history attached to your email address. The ZIP code you type into the cart, and the state it is in, so the shop can warn you about a destination it cannot ship to before it takes your money rather than after.
Messages — the name, email address, subject and message you send through the contact page.
Reviews — the display name you choose and the review itself, both published; the email address you may leave with it, which is used only to match the review against a paid order for the "Verified buyer" badge and is never published; and a photograph, if you send one and tick the boxes.
The waiting list — the email address you give to be told when something is available, and anything you write with it.
Offers — the email address on your order, if you tick the box asking for offers and codes in the cart, on the library's photo form or on the page a giveaway entry's link opens, with the words beside that box and the day you ticked it. The box is never ticked for you, and a tick on the photo form joins nobody until its owner opens an emailed link and presses the button.
Following the yard — the email address you give in the Follow the yard box, to be sent a short note when a new plant is listed and a message from the yard now and then, which can carry an offer or a code. The box is in the footer of every page and also on the home page, the collection page, the cart, the shop page when nothing is listed, a plant's page once it has sold and the page for an address that is not found. It is a different list from the waiting list.
Damage claims and contributed corrections — what you write and any photographs you attach. A damage-claim photograph is evidence and is never published. A photograph sent with a correction is evidence too, unless it is sent with the one tick that says it is yours and that Mysterious Yard may show it on the library page for the plant it shows, with the name you leave: a photograph cannot be sent to that form without the tick, so sending it is the permission, and that one entry is the only place it can go. A photograph sent before there was one tick, without the permission, stays private unless its sender says yes on the private page their send has. On the library's photo form you can also say how the plant is grown (in the ground or a pot, indoors or out, which state, how old, what it grows beside, never a town or an address) and give a name to credit; those details are kept with the photograph and shown under it only if it is published.
Giveaway entries and points — to enter the monthly giveaway, the email address you type, used to send you a link to confirm the entry; and, if you send a photo or a fact and give an email address for points, that address. Neither is kept as an address: each is turned into a scrambled code at once, and what is kept under the code is a month, a number of points, what earned them and the day. A code made from an address is treated as personal information here, and everything this page says about your rights covers it. If you also tick the offers box on the confirmation page, the address goes on the offers list, which is in section 4.
Member accounts — if you sign up to take part: the name you choose, or the one I made up for you if you keep it, which is shown under what you send and anywhere else you take part; the email address you give, which is used to send you a sign-in link and is never shown anywhere on the site; the boxes you tick when you finish signing up (that you are 16 or older and, if you tick them, that pictures you send may go on the library's pages, that your name shows on the giveaway wheel and that your name shows on your cactus in the Yard), each with the day; the day the sign-up was last asked for, the day it was finished and the day you last signed in; and a mark on each picture or note you send while signed in, which ties it to your account until you delete the account. There is no password. Until you finish signing up, the name and the address typed for it are kept for about a day and then deleted. A sign-in link is kept only as a scrambled copy of itself, with the day it was made and the minute it runs out, so a copy of my records cannot be used to sign in.
Takedown requests — the name, email address, organisation and typed signature on a request to take something off this site, and what the request asks for.
Network detail, and the honest version of it — no IP address is ever stored against an order. A review, a contact message, a contributed correction, a content report, a waiting-list sign-up and a damage claim each store a one-way hash of the address they came from: a fingerprint that stops the same source flooding the form, and that cannot be turned back into an address. The counters that stop somebody hammering a sign-in page, a form or a price check (the contact, review, photo, takedown, damage-claim and damage-claim photo forms, the waiting-list and follow sign-ups, the checkout, the coupon check, the cart's shipping price, the order look-up) do hold a plain address, but only as the name of a counter, attached to nothing you sent, and every one of those rows is deleted inside a day. Ordinary web-server request logs exist wherever this site is hosted, the way they do for every site on the internet.
Card numbers — never. They are typed on Stripe's own page and do not reach this site or me.
Other people's public sale posts — the title, date, link and Reddit username of a public sale post, and the text of one on r/sanpedrocactusforsale, which the shop reads about once a week. Section 3 says where from.
Not collected at all — precise location, biometrics, and anything about your employment, education, health, race, religion, politics, union membership or sex life. Nothing here guesses anything about anybody or builds a profile of them.

3. Where it comes from.

From you: placing an order, writing through the contact page, posting a review, joining a waiting list, signing up to take part, sending a correction or a photograph, asking for something to be taken down. There is one other source: other people's public posts, which are nothing you sent. About once a week the shop reads the public sale posts on two Reddit forums about these cacti, r/sanpedrocactusforsale and r/sanpedrocactus, through Arctic Shift, a public archive of Reddit, and keeps each post's title, date and link, the poster's Reddit username and, from the first forum, the text of the post, to work out what these plants sell for. It also reads the public price lists of a few other plant shops, which hold nothing about a person. Nothing is bought from a data broker, and nothing arrives here from an advertising network.

4. What it is used for.

Taking and filling your order. Paying for shipping and printing a label. Sending an order confirmation, a shipping notice with tracking, and a note if your order is put on hold. Answering your message. Publishing a review you chose to post. Telling you a plant is available if you asked to be told. Sending one note after your box goes out to ask how it arrived, with a link that stops those notes. Sending the people who follow the yard a note when a new plant is listed, and a message from the yard now and then, which can carry an offer or a code. Sending offers and codes to people who ticked the box asking for them, and to the people on the yard's email list (below) — never to anyone else, and never again once they unsubscribe. Working out what these plants sell for, from public sale posts and price lists. Keeping the records tax law requires me to keep.

One more use, only if you enter the monthly giveaway or give an email address with a photo or a fact: the address is used to confirm an entry, to find your points and to tell a winner, and for nothing else.

The name on a member's account goes under what you send. The account's email address is used to send you the sign-in link you ask for and to find your giveaway points under the same scrambled code the giveaway already uses. Once the giveaway's rules say entries are made through an account, it is also used to make your entries, to send the link that confirms the offers box if you tick it and, if you ticked it, to tell you if you win. Apart from putting it on the yard's email list, as explained below, it is not used for anything else.

Giveaway entries are also shown in public as the giveaway wheel (section 7): a slice for each person, sized by their entries, with no name unless that person ticks the box to show their name.

Giveaway points also grow each member's cactus in the Yard (section 7), with no name unless that member ticks the box to show their name or has not hidden the name made up for them.

Giving the shop your email address in a box on the site (to follow the yard, to wait for a plant, to get a place in the Yard or to sign in) sends one link to that address, and nothing else is sent to it and no list is written for it until the link is pressed; until then I keep only the address, as an unfinished sign-up (section 2). Pressing the link, ticking that you are 16 or older and pressing the button makes you a member, with a name I made up for you (such as Spiny Moonflower 42) that you can change. A member who joins this way is on the yard's email list (a short note when a new plant is listed, a message from the yard now and then, and offers and codes; every email has a link that unsubscribes you); an account made before this was added is not put on it, and its owner can turn the emails on from the account page. A member has a cactus in the Yard (section 7), giveaway points, and a sign-in by emailed link. Unsubscribing stops the emails and keeps the account; deleting the account on its page takes the rest away. An address that already followed the yard when this was added to this page was sent one email that says it is now a member, with a name I made up for it and links to change the name, hide it, take the cactus out, or unsubscribe; the account is made the moment that email is accepted for delivery, with a cactus sized by any giveaway points the address has already earned (none: it starts as a seedling) that grows as they take part, and taking the cactus out deletes the account and leaves the address on the list as it was. An address waiting for one plant is sent an invitation inside that plant's notice, and becomes a member only if its owner presses the link.

That is the whole list. Apart from those notes and offers, which go only to people who asked for them or are on the yard's email list, none of it is used for advertising, and nobody here is scored, ranked or profiled. Nobody who bought before that box existed has been put on the offers list.

5. Who else sees it.

Only the services it takes to run this shop and get a box to you, and each one gets only the part it needs.

Stripe, for payment. They take the card details directly; what comes back to me is that it was paid, and the address you gave them.
Affirm, only if you choose to pay over time at checkout. Affirm is the lender: it decides whether to lend to you, under its own terms and privacy policy, and it receives what it needs to do so. I am paid in full through Stripe and I do not see Affirm's decision.
Klarna, only if you choose it at checkout. Klarna is the lender: it decides whether to lend to you, under its own terms and privacy policy, and it receives what it needs to do so. I am paid in full through Stripe and I do not see Klarna's decision.
Cash App Pay, only if you choose it at checkout. Cash App takes the payment from your Cash App account, under its own terms and privacy policy, and it receives what it needs to do so. I am paid through Stripe.
Resend, the email service this store is set up with, for order confirmations, shipping notices, hold notices, the one note asking how a box arrived, and the notes and offers people asked for. It gets the address the message goes to and the message. For the monthly giveaway it also carries the link that confirms an entry, a link to a person's own points page and a winner's notice. A sign-in link goes through the same email service named above, which gets the address it is sent to and the message.
Shippo and the postal carrier, for shipping and delivery. They get the name and delivery address, which is unavoidable — it is the thing printed on the box — and the phone number on the order, which the carrier can use about the delivery. Nothing goes to Shippo before you pay.
Railway, the company hosting this site, which runs the machine everything sits on.
A service I use for the shop's assistant and the button that drafts a reply to a review, when I use them. The assistant is sent what an answer needs from my own records: orders and plants, with a buyer shown only by initials, a partly hidden email address and a state, and the subject line of a contact message, never what you wrote in it. It is sent reviews too, whether or not I have approved them yet: when I ask the assistant about my reviews, each review's text, star rating, the name it was posted under, the plant it is about, whether the writer is a verified buyer and my reply to it; and the button sends the one review it drafts a reply to, with its star rating, the name it was posted under and the plant it is about. It works to my instructions and gets nothing else.
A checking service I use for the library's donation box, when it is on. It gets the pictures and words sent to the box (the pictures made smaller, with no location or camera data), to say whether they break the rules and whether a photo is plainly fine. It works to my instructions and gets nothing else.
A seller who sells through this shop, when your order includes one of their plants. They post that box themselves, so they get your name, the delivery address for it and which of their plants you bought, and the postage service they buy the label from sees the address printed on it. They never see your email address, your phone number, your card or anything else in your order.
Printful, or the supplier named on a piece of merch, when your order includes a piece whose page says it is printed to order by Printful or posted straight from the supplier I order it from. They post that piece to you themselves, so they get your name, the delivery address and the phone number on the order, and which piece you bought. They never see your email address, your card or anything else in your order. Who sends each piece is on its page before you buy, and the suppliers of the pieces on the shelf are named at the foot of this page.
Cloudflare R2, which stores the shop's backup copies (section 9). It keeps them for me and does nothing else with them.

Each of those, except Affirm, Klarna or Cash App Pay if you choose one, works to my instructions, on my behalf. None of them, except Affirm, Klarna or Cash App Pay if you choose one, is an audience for your information or is paid in it, and there is nobody else. Merch I pack myself is kept here, and a piece that is not says so on its page. If I ever add a service that would see your information, this section changes before it does.

6. Cookies, and what is kept in your browser.

This site sets seven cookies. All seven are first-party, all seven do a job somebody asked for, and none of them follows anyone anywhere. Only two of the seven ever reach a shopper who has not looked up an order: my_ground, and, once they sign up to take part, __Host-my_grower.

my_ground — which of the two grounds you picked, dark or daylight, set when you press the switch at the top of the page and kept for a year so the page does not flash the wrong one at you next time. It holds one word and is attached to nothing else about you. An ordinary visitor who has not signed up gets only this one.
my_order — set when you look up your own order, so you do not have to type your email address again for the next thirty days. There is a "Forget this order" button on that page which clears it.
__Host-my_admin — my own sign-in to the back office. A shopper never gets it.
my_client — a random signed number handed out on the two sign-in pages, mine and the sellers', so a stranger's wrong passwords cannot lock anybody out. It exists only on those two pages. A shopper never gets it either.
my_oauth_flow — a short-lived note to myself while I connect this shop to a social account I own, so the account that comes back is the one that went out. It lasts minutes, it is cleared the moment the connection finishes, and it only ever exists in my own browser.
my_vendor — a grower who sells through this shop, signed in to their own screen to post a plant and see what of theirs has sold. A shopper never gets it either.
__Host-my_vendor — a seller who sells through this shop, signed in to their own screen to post a plant and see what of theirs has sold. A shopper never gets it either.
__Host-my_grower — set when you press the button on the page a sign-in link opens, so the pages know you are signed in and what you send, such as a picture, can be tied to your account. A thumb is never tied to it. It holds a signed note with your account's number and a number that ends every sign-in when you sign out, it lasts 30 days, and your browser sends it back only to this site. Signing out deletes it and ends the sign-in on every device. Somebody who never signs up never gets it.

Your cart lives in your own browser's storage rather than on my server or in a cookie. It stays on your device, with two exceptions: to show the shipping price, the cart sends this shop what is in it, and the ZIP once you type one, so the shop can check a live plant can go there; and pressing Add to cart adds one to that day's count for that plant or item (section 7), which records which plant, never whose cart. Nothing else about you goes with them, and none of it goes to anyone else until you check out.

The same storage also holds the coupon code you typed, the ZIP code and delivery service you picked, and the number of the last checkout you opened: the code goes to the shop only when you apply it or press Checkout, and the number only with the next Checkout press, so coming back picks up the same one. On the library's photo form it holds the numbers of the photographs you sent from this browser, which stay on your device so that thumbs are not drawn on your own photographs.

Where the giveaway wheel is shown, your browser also keeps a small entry of its own for each winner it has spun to, which is not a cookie: that month and the number of the winning slice, so the spin plays once and not on every visit. It holds nothing about you, it is never sent to this shop or to anyone else, and clearing your browser's data for this site deletes it.

Where thumbs show on a library photo or paragraph, your browser also keeps one small entry of its own, which is not a cookie: a random number made fresh each day, and which thumb you pressed on which item that day. It is written only when you press a thumb, and it is kept so the page can show you what you pressed and so a second tap on the same thumb is not counted again. It stays on your device and nothing else reads it. The random number is sent to this shop only inside a thumbs vote, and the shop keeps nothing of it but a scrambled copy until the day ends. The entry is replaced each day: one from an earlier day is deleted the next time a page with thumbs opens in that browser, and clearing your browser's site data deletes it at once. Because it is there only for the thumbs you chose to press, I do not ask for a separate yes.

On the home page, when you press the close button on the small "New here?" card, your browser keeps one small entry of its own, called my_how_it_works_closed, which is not a cookie: the single character 1, so the card stays closed the next time you visit. It holds nothing about you, it is never sent to this shop or to anyone else, and clearing your browser's site data deletes it.

On a care guide in Learn, when you pick an answer under "Your setup", your browser keeps one small entry of its own, called my_learn_setup, which is not a cookie: your picks for where it grows (in the ground or in a pot), where it lives (outdoors or indoors) and the season (winter or not), and the month you picked it in, so the guide shows the same lines when you come back and a season you picked counts only in that month. It is never sent to this shop or to anyone else, nothing else reads it, and clearing your browser's site data deletes it.

There is no cookie banner on this site because there is nothing to consent to: no advertising cookie, no analytics cookie, and no third-party cookie of any kind.

7. Tracking, analytics, and Do Not Track.

There is no third-party analytics on this site. No Google Analytics, no advertising pixel, no heatmap, no session recorder, no third-party script of any kind. Nothing on this page loads from anybody else's server.

So: no third party collects any information about what you do here, and nothing here follows you to any other website — because there is nothing installed that could.

Which means there is nothing for a browser's Do Not Track signal, or a Global Privacy Control signal, to switch off. This site does not track you across other websites whether you send one of those signals or not, and the answer is the same either way.

The shop keeps three plain counts of its own, on its own machine, so I can see which plants people look at and which ones they want:

Visits — for each day, which page was opened, and one word for where the visit came from: Instagram, TikTok, Reddit, YouTube, Facebook, a search engine, another page here, typed in, or somewhere else.
Adding to the cart — for each day, which plant or item was added to a cart, and how many times.
Post links — for each day, how many times the short link under one of my posts (mysteriousyard.com/p/…) was tapped.

A count is a day, a page or an item, and a number, and nothing else. No cookie is set for it, no IP address is read or kept for it, and no account, device detail or anything else that could lead back to you is stored with it. The name your browser gives itself is looked at only to leave out robots and scripts, and is not kept. My own visits are not counted while I am signed in. The counts cannot tell whether two visits were the same person, whether anybody came back, or what path somebody took through the site, and they are never joined to an order. They are kept for 13 months and then deleted automatically, and nothing from them is sold or given to anyone.

Searches are counted too: the words typed into this site's own search box and how many times a day, so I can see what people come looking for. Nothing about who searched is kept with them, and a search that looks like an email address or a phone number is not written down at all.

A few more counts are kept the same way, in the same place, so I can see where people come from, what they read and whether the library sends them on to the shop:

Where the visits to a page came from — for each day and page, how many visits came from each of these places (the Visits count above names the place in fewer words; this is the same thing told page by page): Reddit, Google (its search), Instagram, Facebook, TikTok, YouTube, typed in or bookmarked or from an app, a link in an email from this shop, another site (a webmail page is one), or another page of this shop. Your browser works out which one it was from the name of the site you came from, or from a short tag on the link, and sends that one word, never the address of the site or anything after its name. A visit from inside an app's own browser, such as Instagram's or Facebook's, often sends nothing about where it came from, so your browser also looks at its own name to choose the word. The shop puts one short tag, the same for everyone, on the links in its own emails that lead to its public pages, so a visit from one is told apart; it is not about you. If a link carries two tags its sender wrote (a source and a campaign, such as spring-sale), those are sent too and kept as a total for the day, but only as plain lower-case words, hyphens and short numbers; anything that looks like a long number, an address or an id is thrown away whole. The same one word is kept as a total beside the Add to cart and Checkout presses of the day, so I can see which places bring carts.
Taps from the library to the shop — for each day and library or Learn page, how many times a link to a plant or merch page was tapped. It is the library page the tap was on, never the plant it led to, and nothing about who tapped.
Follows from the photo form's thank-you — for each day, how many new follows came from the optional step after a photo or note is sent. It is one total for the day and is not joined to the follow list: the list itself, with the address you give, is described where this page already describes it, in sections 2, 4 and 9.
Phone, tablet or computer — for each day, how many visits came on a phone, a tablet, a computer or something else.
Country, and state in the United States — for each day, how many visits came from each country and, in the United States, each state, when the shop's host passes along where the connection reached it from. The shop reads that label and never the address behind it, and keeps only the country or state and a number. Where the host does not say, nothing is kept.
Pages not found — for each day, how many times a plant, guide or library address was opened that the shop did not have, so I can mend a broken link or write the page. It is kept as that address only if it is plain lower-case words, numbers and hyphens, with nothing after a question mark; any other address is counted without it.
How far a page was read — for each day and page, how many times the page was left after a quarter, half, three quarters or all of it had been on screen. Your browser works out which of those four it was and sends only that, never where on the screen you were.

Each of these holds a day, a page of this shop, a word from a fixed list or a short plain tag, and a number, and nothing else. What is said above about the first counts holds for these counts too: no cookie, no IP address read or kept for them, no account, never joined to an order, kept for 13 months and then deleted automatically. None of these counts holds anything that could lead back to you: a place, a page, a kind of device or a country, alone or together, is not personal information, because nothing joins any of them to a person, and the counts cannot tell whether two visits were the same person. The name your browser gives itself is looked at for one more thing than the two said above (leaving out robots, and telling a visit from inside an app's own browser), and is never kept: the shop reads it to choose one of four words for phone, tablet, computer or something else.

Thumbs on the library's photos and paragraphs are counted too: for each item, how many thumbs up, how many thumbs down, how many of the thumbs up have already been counted toward the giveaway, and the last day anyone gave one (never a time of day), and nothing else. A vote needs a token the page hands out for that one item and that one day, good for two hours and for one vote. Nothing about who pressed is kept: no IP address, no device detail and no time of day, and once a vote needs a sign-in, nothing from that sign-in goes with the vote. To stop a second vote on the same item on the same day, the shop keeps a scrambled copy of the day's random number and of the vote's token, for that day only. A scrambled copy is a short code made with a secret key the shop holds: it cannot be turned back into the number, and the number is random, so it cannot name you, your device or your address. The list of codes is thrown away when the day ends and is left out of backups. The page shows how many thumbs up an item has, next to its thumbs. It never shows how many thumbs down: that number is only for me. The number shown is the one written at the top of the hour, so it can be up to an hour behind. Thumbs down never take anything off a page by themselves. When many people give a paragraph or one of my own photos a thumbs down, it is looked at again by the shop's own check, and it stays unless that check finds it wrong. When many people give a photo a visitor sent in a thumbs down, it is put in front of me and I decide whether it stays; a photo I take down keeps its file for thirty days in case I change my mind, and is then deleted. Thumbs up never put anything on a page by themselves. While the monthly giveaway runs, a thumbs up on a photo I have accepted earns the person who sent it one entry in that month's draw, up to five a month for each photo, if they gave an email address for it, as the official rules say. An item's counts are deleted two years after the last day anyone gave it a thumb, and each decided row of the short list of items put up for another look is deleted thirteen months after the day it was last looked at. Nothing from the counts is sold or given to anyone.

Once thumbs need a sign-in, a vote still keeps nothing about who gave it. The page checks that you are signed in when you press, and the vote that is counted carries no name, no address and no account number.

The monthly giveaway keeps a few records of its own, on its own machine. An entry is kept as a scrambled code made from your address (the same person's address spelled with a + tag, or, at gmail, with dots, gives the same code), never as the address. The link that confirms an entry carries your address in a form only this shop can read, and this shop writes nothing down about the entry until you open the link, except that it remembers in its working memory, until it restarts, that it has sent an address a confirmation link and how many this month, so that nobody can have one inbox mailed again and again. The points are a number under that code, with what earned them and the day. Each month's draw is written down with the number it used (made from the shop's private key and the month) and every entry that went into it, so it can be run again and give the same winner, and it holds no address. The key that makes the codes is held outside the data and its backups, so the records and their backups cannot be turned back into addresses; a code can be matched to an address only by somebody who holds both the key and that address. A winner is found again among the people who ticked the offers box themselves, and told by email. Nothing from this is sold or given to anyone. The Yard is a page of cacti in the fog: each member has a place of their own in it and a cactus drawn from a code made from the account, which cannot be turned back into it. The page shows a few members at a time, the largest cactus in the Yard always among them, the others picked at random and changing as a visitor watches, and a signed-in member always sees their own cactus. Places are given in the order members join, and a deleted member's place is left empty. The cactus grows with the points the account has earned in the giveaway, all months together. A member who joined before this paragraph was first added grows only from the points earned after the day it was first added, for as long as they have neither ticked the box to show their name nor picked a piece or a face on their account page. The cactus can wear a small paper piece and show a face (a smile, a frown or, as their points grow, others), each of which the member picks on their account page, and, if the member's name is shown, a flower for each time they won the bloom of the month. A cactus never shows an email address or postal address, and shows no name unless its member ticked the box to show their name on it or has not hidden the name made up for them, and a visitor can search for a member by name only if that member's name is shown. I keep that tick, or the note that the name was made up for them, with its exact words and the day, and the piece and the face they picked, with the day, until they change it or delete the account, which removes the member and their place at once. Every member has a place in the Yard and a cactus there, drawn from a code made from the account, which cannot be turned back into it, and made bigger by the giveaway points that address has earned. The cactus of a member who joined this way, or was made one as a follower, shows its member's name, which is a name I made up for them (cactus words and a number, such as Spiny Moonflower 42) unless they typed their own, until they hide it or change it on their account page; an account made before shows its name only if its member ticked the box. An address typed into a box has no cactus until its owner has pressed the link and finished joining. Unsubscribing from the emails keeps the account and its cactus; deleting the account, or taking the cactus out, takes the cactus away at once, and the place it held is left empty. The giveaway wheel is public. It shows one slice for each person with entries that month, sized by how many entries they have, and it shows each slice's entry count, updating live as entries come in. A slice shows your name only if you ticked the box to show it; every other slice has no name. I keep that tick, with its exact words and the day you gave it, until you untick it or delete your account. Your email address and real name never appear on the wheel. When the winner is drawn, the wheel stops on and marks the winning slice, with the name only if that person chose to show it. You can untick the box at any time and your name comes off every wheel, past months included.

8. Selling and sharing.

Mysterious Yard LLC does not sell personal information, and does not share it for cross-context behavioural advertising. Those are the two things California means by "sell" and "share", and neither has ever happened here — about anybody, of any age, ever. There is no "Do Not Sell or Share My Personal Information" link on this site because there is nothing to opt out of. If that ever changes, this section changes with it and the link appears right here.

9. How long it is kept.

Almost nothing here deletes itself on a timer. The anti-flooding counters, the search counts, the visit counts, the sign-in links and the name and address typed for a sign-up nobody finished are the things that do, and all of them are below; everything else is a list of what is kept and why.

Paid orders — kept. They are the sales records a California seller has to be able to produce, and they are what the books are built from.
The email address and phone number on an order — deleted on request, even though the order itself stays. Section 10.
Contact messages — kept until I delete them, which is usually once they are dealt with. Ask and they go sooner.
Other people's public sale posts — kept for the price history and not deleted on a timer. If one is yours and you want it gone, ask as section 10 says.
Reviews — published until you or I take one down.
Waiting-list, follow and offers sign-ups — deleted when you ask, and one tap on the link in any of those emails takes you off every list here. The one thing kept is the record that you asked to stop being emailed: each sign-up row of yours, with the address, what you were waiting for and anything written with it, the words you agreed to and the day, when and how often I emailed you about it and whether the last one went through, the day you stopped, and a one-way hash of the network address it came from, because that record is the only thing stopping a form emailing you again. Deleting your account on its page also stops the yard's emails to that address; the record that you asked to stop is the one thing kept, as above. A follower who took the cactus out keeps a note that says so on their row of the yard's list, for as long as the row is kept, so that I do not make an account for them again. An invitation to join is kept for as long as its link works, up to thirty days, and is then deleted. A plant a member saves with the button on its page while signed in is kept against the email address on their account, with the day it was saved. It is listed on their account page until I email them about it, and taking it off there deletes it at once; after that email, or once the yard's emails are stopped, it is kept like any other waiting-list sign-up. An address typed into a box that asks only to be told about a plant or new plants, not to join, is kept as an unconfirmed sign-up until its owner presses the link emailed to it: the address, what it asked for and anything written with it, and a one-way hash of the network address it came from. If the link is not pressed within seven days, all of it is deleted.
The anti-flooding counters in section 2 — deleted inside a day, automatically.
Search counts — the words typed into the search box and how many times a day, dropped automatically after 60 days.
Visit, add-to-cart and post-link counts — a day, a page or an item, and a number, dropped automatically after 13 months.
Photographs sent with a correction — ask and they are deleted for good.
Photographs sent with a damage claim — kept with the order they are evidence for, as section 10 explains.
Member accounts — kept until you delete the account. Your account page has a button that deletes it at once, and I can delete it for you if you write on the contact page. Deleting removes your name and your address and unlinks what you sent: pictures already on the library's pages stay, with no name on them, because you gave permission when you sent them, and come down if you ask. A sign-in link is deleted about a day after it runs out, and the name and address typed for a sign-up nobody finished are deleted about a day after the last link was asked for. The giveaway's scrambled codes and points are kept as the giveaway's own lines say.
Traffic counts, part of the visit counts — where the visits to a page came from, taps from the library to the shop, follows from the photo form's thank-you, the kind of device, the country and state, pages not found and how far pages were read: a day, a page or one word, and a number, dropped automatically after 13 months.
Thumbs counts — for each item, a number of thumbs up, a number of thumbs down, how many of the thumbs up were counted toward the giveaway, and the last day one was given, with nothing about who gave them. The number of thumbs up is shown on the page; the number of thumbs down is not. They are deleted two years after that last day. The scrambled list behind them is thrown away when the day ends.
Items put up for another look — the item, the day it was put up, its thumbs up and thumbs down then, and a short note of what was found. Each decided row is deleted thirteen months after the day it was last looked at.
Giveaway records — entries, points and each month's draw: scrambled codes, numbers and days, kept for at least four years, after a giveaway ends too, so that a draw can be checked later. They hold no address. To have yours removed, write on the contact page from the address you used, except a past draw's record, which keeps the code, never the address.
Takedown requests — kept exactly as they arrived, as the record of what was asked and what was done about it.
Backups — once a day the shop saves a copy of its data, and keeps no more than the newest seven; each older one is deleted. Each of those copies is also sent to Cloudflare R2, a storage service, which also keeps no more than the newest seven and deletes older ones the same way. A copy I keep apart from those, such as one before I change how the shop stores things or the words of this page, or one I download to keep, stays until I delete it. Wherever this page says something is deleted, that is when it goes from the shop; a copy of it in a backup goes when that backup is deleted.

10. Your rights, and what I will actually do.

Ask me and I will tell you what I hold about you and where it came from, send you a copy of it, correct anything that is wrong, and delete what I am able to delete. Asking costs nothing and changes nothing: same prices, same service, same everything, whether you ask or not.

Deletion has one honest limit, and I would rather you knew it now than at the time. A paid order is a tax record. The name, delivery address, items and amounts on it stay, because a California seller has to be able to produce them, and so do the photographs sent with a claim on it, which are the record of what was decided. Everything else about you goes — the email address and phone number on every order, the email held against a review, the email on a contact message, the email on a review invitation and on a live-arrival claim, your address wherever it appears in my own working notes in the back office, the waiting-list rows apart from the one in section 9, and the name and email address on the customer record itself. That record holds no address of its own — the only delivery address here is the one on the order, and that is the part I have just said stays. The words and photographs on a live-arrival claim, and what I decided about it, stay with the order they belong to: a refund is part of that same tax record. A takedown request stays exactly as it arrived too, as section 9 says: it is the record of what was asked and what was done.

You are told in writing exactly what was removed and exactly what was kept and why. Nothing is quietly held back.

11. How to ask.

Use the contact page, linked in the footer of every page. Pick "Other" as the subject, start the message with "Privacy request", and say which of the four things in section 10 you want.

I reply to the address the request came from. If that address is not on an order here, I will ask for enough detail to match a record before handing anything over — otherwise a right to know would be a way for a stranger to read your order history. Somebody may act for you if you tell me in writing that they can.

12. Children.

This store is not aimed at children, and nothing here is knowingly collected from anybody under 16. If you think a child has sent me something, say so on the contact page and I will delete it. Signing up as a member asks for a tick that you are 16 or older. I do not check it. If you think a child has signed up, say so on the contact page and I will delete the account. Joining asks for a tick that you are 16 or older. I do not check it. A box that asks for an email address sends one link and keeps nothing else for it. An account I made for a follower already on the list has no tick, because they made no choice; if you think a child has an account, say so on the contact page and I will delete it.

13. Photographs.

Three kinds, three different rules, because they are not the same thing.

Review photographs are published, if you ticked the two boxes and once I have looked at the picture myself. Every image sent here is re-encoded on arrival, which removes the GPS coordinates and camera data your phone writes into the file. That happens before anything is written to disk, so the original never lands on the machine at all.
Photographs sent with a damage claim are evidence on that claim. They are never published.
Photographs sent with a correction, or to help identify a plant — for my eyes, so I can get a page right. A photograph sent before there was one tick, without the permission, stays private unless its sender says yes on the private page their send has. A photograph sent now carries the one tick on the form, which says it is yours and that Mysterious Yard may show it on the library page for that plant, and it cannot be sent without it. With it, that one entry is the only place it can appear, your name goes under it if you left one, and asking takes it down again. If you have an account, each picture you send asks the same tick, and your name in the Yard is the name under it. If you enter a picture in the bloom of the month and it wins, it is shown on the home page the next month and kept on the past winners' page, with your name. Entering is its own tick, kept with the picture along with the day you ticked it, and you can ask for it to come down at any time.

Ask, and a review or correction photograph is deleted; a damage-claim photograph stays with its order, as section 10 explains.

14. Changes to this notice.

If something material here changes, the "Last updated" date at the top changes with it and the new version is posted on this page. If a change would mean using information already collected for something new, I will not apply it backwards without telling you first.

15. Contact.

Privacy questions go through the contact page in the footer. I am the person who reads it.