Privacy.
Entry private, emoji public. That is the whole policy; the rest is how.
Your journal never leaves your device.
Entry text is stored on the device you wrote it on and is never transmitted, not to us and not to anyone. Export it any time as JSON or as a Season book. Deleting the app deletes it.
What the server holds, when you have a handle.
Your handle, the day you joined, your time zone, your garden's visibility setting, a public projection of your garden (emoji, form, family, days, position, never text), your $GRATUS ledger, your friends and requests, your groups, the days you tended (for the Pool), your presence minutes and bells (for presence gifts), and the gifts you sent or received (emoji, days, path, money, and the note, which is returned only to its recipient). Nothing else.
Who can see your garden.
Private by default. You can open it to friends, to a link, or to public. In every case only emoji, form, family, and days are visible, never text.
No ads, no data sales, no tracking.
There is no advertising, no sale of data, and no third-party analytics. The app loads type from Google Fonts and, only when you use QR codes, two small libraries from cdnjs; those hosts see the request like any web page.
Safety.
A local keyword check runs on every entry on your device. If it matches, the app shows a resource card once that day. The text is not sent anywhere. The app makes no mental-health claims.
Recovery.
Your handle comes with a recovery code. It is the only way back into your handle from another device. We cannot reset it.