Disciplant — Privacy Policy
Effective date: 15 August 2026
Last updated: 15 August 2026
1. Controller and contact
Disciplant is a free habit tracker operated at https://disciplant.com. Completing a habit grows a plant in your garden.
The controller of the personal data described in this policy is Warinchai Suwannoppadol, an individual established in Thailand. All correspondence concerning this policy, including requests to exercise the rights set out in section 8, should be sent to disciplant@gmail.com. A postal address will be supplied on request to any data subject or supervisory authority.
We aim to respond substantively within 30 days of receipt.
Disciplant is operated from Thailand and this policy is written primarily against the Personal Data Protection Act B.E. 2562 (PDPA), with equivalent provision under the General Data Protection Regulation (GDPR) where the two overlap. Users outside Thailand are expected. Where the GDPR, the UK GDPR or another applicable law affords you greater rights than the PDPA, that law governs our processing of your data.
2. Summary
Habit text is private to you. It is never shown to another user and is never used for advertising. Friends can see the category of each habit, your streaks and your growth totals, but not what any habit is called. You may download everything we hold at any time and delete your account permanently from within the application. We do not sell personal data and we do not display advertising. Google and Vercel process data on our behalf; section 6 identifies them.
This summary does not replace the sections that follow.
3. Information we collect
3.1 Account information
If you use Disciplant as a guest, we create an anonymous account and hold only a randomly generated account identifier. We do not know who you are and we cannot recover a guest account that is lost.
If you sign in with Google, Google provides us with your account identifier, email address, display name and profile picture URL. We store these so that your garden is available across devices and so that friends can identify you.
If you claim a username, we store the username together with a lowercase copy used to enforce uniqueness. Usernames are searchable by any signed-in user.
3.2 Habits and garden data
For each habit we store the text you enter, the category you select, the plant skin applied, its completion state for the current day, your current and longest streak, total and best-ever days grown, every date on which the habit was marked complete, and the plant's position in your garden. We also store the landscape skin applied to your garden and the date of your last daily reset.
3.3 Sensitive information
Habit text is a free-text field and users enter real matters into it. Entries such as physiotherapy, medication, recovery meetings or religious observance constitute sensitive personal data under section 26 of the PDPA and Article 9 of the GDPR, being data concerning health or religious belief.
We neither require nor want that level of detail. Neutral wording — "appointment", "meds", "meeting", "practice" — produces identical streaks and identical plants. Where you do enter sensitive information, you provide your explicit consent to our storing it for the purpose of operating the service for you, and you may withdraw that consent at any time by editing the habit or deleting your account.
3.4 Friends
If you use the friends feature we store your friends list as account identifiers, the friend requests you have sent or received together with their status, and a garden summary — the version of your garden that friends are permitted to load.
The garden summary contains each plant's identifier, category, skin, streak, total growth days, completion state as at your last save, and position. It contains neither your habit text nor your day-by-day history. It is written only once you have at least one friend, because until that point no account is permitted to read it.
3.5 Technical and usage information
Vercel Web Analytics counts visits and pages viewed. It sets no cookies and stores nothing on your device; returning visitors are identified by a hash computed on Vercel's servers and discarded after 24 hours. It operates for every visitor.
Google Analytics records visits, pages viewed, approximate location derived from IP address, and device and browser type. It operates only where you have consented, as described in section 3.6.
Vercel, as our host, records standard server logs including IP address, user agent and requested URL.
Firebase App Check and reCAPTCHA collect device and behavioural signals in order to confirm that requests originate from the application rather than an automated client.
Rate-limit counters held against your account record when your current write window opened, in order to prevent a single account from overwhelming the database.
3.6 Cookies and on-device storage
The following are stored on your device without your consent because they are strictly necessary to deliver the service you have requested: your Firebase sign-in token, which maintains your session; a cached copy of your own garden, which allows the application to function offline; your claimed username, cached to avoid a database read; a display preference; and your answer to the cookie question, which must be retained in order that a refusal is not put to you again on every visit.
None of these are shared with any third party and none are used to track you across other websites.
Google Analytics cookies, which set an identifier by which Google recognises a returning visitor, are stored only if you accept when asked. If you decline, or have not yet answered, Google Analytics is not loaded at all: no request is made and no connection to it is opened.
Vercel Web Analytics is not covered by that question and operates whether or not you accept. It writes nothing to your device and identifies a returning visitor only by a server-side hash discarded after a day. The consent requirement exists to govern the storing of information on, or access to information already stored on, your device; a system that stores nothing there does not engage it, and it accordingly operates on the basis of legitimate interests. Declining therefore withholds you from Google Analytics but not from a visitor count. The only complete remedy is not to use the site.
You may change your answer at any time through Cookie settings. Withdrawal is as straightforward as giving, which is both the legal standard and the proper one.
4. Purposes and legal bases
Performance of our contract with you (GDPR Article 6(1)(b); PDPA section 24(3)) is the basis on which we store your habits, streaks and garden, sign you in and maintain your session, and publish your garden summary to friends whose requests you have accepted.
Our legitimate interests (GDPR Article 6(1)(f); PDPA section 24(5)) are the basis for App Check, reCAPTCHA and rate limiting, which exist to prevent abuse and uncontrolled database cost; for Vercel Web Analytics, which stores nothing on your device; and for the retention of backups against failure.
Consent (GDPR Articles 6(1)(a) and 9(2)(a); PDPA sections 19 and 26) is the basis for Google Analytics and for any sensitive information you elect to enter as habit text. Both may be withdrawn at any time, by the cookie settings and by editing the habit respectively.
Analytics is the only processing that awaits your agreement. Everything else described above constitutes either the service itself or the security surrounding it, and cannot be disabled while an account subsists; the remedy, if you object to it, is to delete the account.
5. Disclosure
Your habit text, your day-by-day completion history and your email address are disclosed to no one.
Friends whose requests you have accepted may see your username, display name, profile picture and garden summary. The summary discloses the category of every habit you keep, together with streaks and growth totals. Where the category of a habit is itself something you would prefer not to disclose, select a different category or do not add that person.
Any signed-in user may locate you by searching your exact username and will see your username and display name in the result.
If you never claim a username and never add a friend, no other user can see anything.
The aggregate counters shown on the home page are plain integers. They identify no one and cannot be traced to any account.
6. Processors and international transfers
Google LLC and its affiliates provide Firebase Authentication, Cloud Firestore and App Check, and accordingly process the data described in sections 3.1 to 3.4. Firestore data is held in the asia-southeast3 region (Bangkok, Thailand). Google Analytics and reCAPTCHA operate on Google's global infrastructure. Vercel Inc. provides hosting, server logging and Web Analytics, with our project served primarily from the sin1 region (Singapore).
Each acts as a processor on our instructions and not as an independent recipient. We do not sell personal data and we have not disclosed personal data to any third party for that party's own purposes.
Because the database is located in Thailand, the core of your account data is not transferred abroad. Hosting, server logs, analytics and bot detection do involve processing outside Thailand, and we rely for those transfers on the Standard Contractual Clauses incorporated into Google's and Vercel's respective data processing terms, and on section 28 of the PDPA on the basis that the transfer is necessary for the performance of our contract with you.
If you are in the EEA or the United Kingdom, your data is transferred to Thailand, in respect of which the European Commission has issued no adequacy decision. We rely for that transfer on Article 49(1)(b) of the GDPR, the transfer being necessary for the performance of the contract between us.
7. Retention
Your account, habits, completion history and garden are retained until you delete your account. Your garden summary, friends list and friend requests are deleted with it, immediately and in the same operation. Your username reservation is released on deletion and becomes available to others.
Data removed from our live systems persists for a period in our providers' backup systems. Google commits to deleting customer data within a maximum of approximately 180 days. Vercel retains runtime logs for one hour on the plan we use.
Google Analytics retains event data for 2 months and user-associated data for 14 months, in accordance with the retention settings we have configured.
The Vercel Web Analytics visitor hash is discarded after 24 hours. The aggregate counters are retained indefinitely and contain no personal data.
Accounts are retained indefinitely, including guest accounts that are never opened again. We do not delete a garden for inactivity. Deleting your account is the only thing that removes it.
8. Your rights
You may obtain a copy of your data at any time through Account → Your data → Download my data, which produces a JSON file of everything we hold without any request to us.
You may correct your data by editing your habits and display name within the application, and by writing to us in respect of anything not reachable there.
You may delete your data through Account → Delete this account, which removes your habits, history, garden, username, profile, friend connections, friend requests and sign-in. There is no undo and no recovery period.
You may withdraw consent where consent is the basis of processing. For analytics, use Cookie settings; the change takes effect immediately. For sensitive habit text, edit the habit or delete your account.
You may object to processing carried out on the basis of our legitimate interests.
You may complain to a supervisory authority: in Thailand, the Personal Data Protection Committee; in the EEA or the United Kingdom, your national authority. You are not required to approach us first, although we would prefer that you did.
Your export deliberately excludes the account identifiers of other users. Your friends list is as much a fact about them as about you, and the right to portability does not extend to disclosing identifiers for other accounts. The number of friends is given instead.
9. Children
Disciplant is not intended for anyone under 13 and we do not knowingly collect data from children below that age. If you believe that a child has created an account, write to disciplant@gmail.com and we will delete it.
Thirteen satisfies the requirements of the United States Children's Online Privacy Protection Act. It sits below the age of valid digital consent in several EEA member states, which may set it as high as 16. Because our processing rests almost entirely on contract rather than consent, the practical effect is confined to the analytics consent described in section 3.6.
10. Security
Access to your data is enforced by server-side database rules rather than by the application running on your device. A friend may load your garden summary only for so long as the server accepts that you are friends, and no account other than yours may read your habit text. Account deletion executes as a single atomic operation, so a partially deleted account is not a state that can arise.
No system is without fault. If we discover a breach affecting your personal data we will notify the relevant authority within 72 hours where required to do so, and will notify you directly where the risk to you is high.
11. Changes
Any change to this policy will be published here and the date at the head of the document updated. Where a change materially affects our use of your data, we will give notice within the application before it takes effect.
12. Contact
Warinchai Suwannoppadol
Thailand
disciplant@gmail.com