What we hold, and what we do not
The short version: we hold what you tell us, we do not sell it, nothing is public until you approve it, and you can delete all of it yourself.
Last updated 31 July 2026.
What we hold
What you tell us. Your name, your practice, your neighbourhood, your Instagram handle, your reason for creating, and anything you write in your profile or messages.
Your email address. Used to sign you in and to reach you about the collective. It is never shown to other members and never appears on a public profile.
Photographs you upload. Your profile picture and any image you attach to an event or a piece of work.
Approximate location, only if you open the map. Used to show what is near you while you are looking. We do not keep a history of where you have been, and the map works without it.
Ordinary technical records. The kind every server keeps: request times, errors, and a device identifier, held so the thing can be debugged and kept secure.
What we do not do
We do not sell your information, and we do not share it with advertisers or data brokers. There is no advertising here, so there is no business reason to and no mechanism for it.
We do not track you across other apps or websites, and we do not build a profile of you from anything outside this platform.
Who can see what
Other members see your profile and anything you post to the collective.
Anybody at all sees your public profile page, but only after you have approved it. Before then it does not resolve for anyone.
Nobody but you and an administrator sees your email address, your account settings, or the record of an invitation issued to you.
Acknowledgements are visible to the person who sent one and the person who received it, and to nobody else.
Where it lives
On Supabase, which hosts the database and the file storage on our behalf, in the United States. Every table is protected by row-level security, so the database itself enforces who may read and write each row rather than trusting the app to ask nicely.
Invitation codes are stored hashed, never in the clear, so a copy of the database is not a copy of the invitations.
How long
Your profile and content are kept while your account exists. Delete your account and they are removed, along with your public page.
Backups and ordinary technical logs roll off within 30 days. Where we are required to keep a financial record of a payment, we keep that record and nothing else.
What you can ask for
A copy of what we hold about you. A correction to anything wrong. Deletion of your account and content, which you can do yourself in the app without asking.
Depending on where you live you may also have the right to object to some processing or to receive your data in a portable form. Write to us and we will do it; we will not ask you why.
Children
Coltivare is for people 18 and over. We do not knowingly collect anything from a child. If you believe we have, write to us and it will be deleted.
Questions, or something on your profile you want removed: hello@coltivare.app. We answer within one working day, and within 24 hours for anything reported as abusive.