Last updated: July 31, 2026
This Privacy Policy explains how Bonsai ("Bonsai," "we," "us," or "our") collects, uses, and protects information when you use the Bonsai application and related services (the "Service"). By using the Service, you agree to the practices described here.
The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at [email protected] and we will delete it. If you operate Bonsai in an educational setting with students under 13, additional requirements (such as COPPA in the U.S.) may apply, and verifiable parental or school consent may be required.
When you create an account we collect your name, email address, and a password. Passwords are never stored by us in readable form — they are hashed and managed by our authentication provider, Supabase. If you sign in with Google, we receive basic profile information from Google (such as your name, email, and avatar) as permitted by your Google account.
Bonsai lets you interact with AI study tools. We process the content you provide to these features so they can respond, including:
The home screen shows weather that reflects your local sky. To do this we ask your browser for your location, only with your permission. Your coordinates are rounded to roughly city-level (about 1 km) on your device before they're used to look up a place name (via BigDataCloud) and local weather (via Open-Meteo). We do not store precise GPS location, and if you decline, the garden simply skips the weather. You can change or re-prompt this permission anytime from Profile → Location or your browser's site settings.
We store certain preferences locally in your browser (for example, your chosen theme/dark mode and selected AI model) using local storage. We and our providers may also process limited technical data such as browser type and basic logs needed to operate and secure the Service.
If you subscribe to a paid plan, payments are processed by our payment provider, Stripe. Your card number and full payment details are entered on Stripe and handled by Stripe — we never receive or store your full card number. We retain only limited billing records needed to provide and account for your subscription (for example, your Stripe customer and subscription identifiers, plan status, and renewal date). Stripe's handling of your payment data is governed by Stripe's own privacy policy.
To protect sign-up, sign-in, and password reset from automated abuse, we use Cloudflare Turnstile, which may process your IP address and limited device/behavioral signals to tell humans from bots. This is done in our legitimate interest in securing the Service.
When you use an AI feature, the content you submit is processed to generate a response. Depending on your configuration, this processing may occur locally on your device and/or through AI service providers we use to operate the Service. We do not sell your content, and we do not use it to identify you for advertising.
We share information only with providers that help us run the Service, under their respective terms and privacy policies:
We do not sell or share your personal information for cross-context behavioral advertising.
We use browser local storage and similar technologies to keep you signed in and remember your preferences. These are essential to the Service's basic functionality. We do not use third-party advertising trackers.
We keep your account information for as long as your account is active. You may delete your account at any time from within the app (Profile → Delete account), or by contacting us at [email protected]. When you delete your account we cancel any active subscription so you are not charged again, and we delete or anonymize your personal information, except where we must retain limited records to comply with the law (for example, tax and payment records relating to a paid subscription).
Depending on where you live (for example, under the GDPR or CCPA), you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected]. You can also sign out, reset your password, or request account deletion at any time.
We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS) and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
Our providers may process and store data in countries other than yours (for example, the United States). Where required, we rely on appropriate safeguards for such transfers.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and significant changes may be communicated through the Service.
Questions about this policy or your data? Contact us at [email protected].