Privacy policy

Who we are

Blue Whale Trees is a small native tree and shrub nursery in the United States, reachable at captain@bluewhaletrees.com.

What we collect, and why

• Account. Your email address, your name if you give it, and any shipping address you choose to save. We use passwordless sign-in: a one-time link is emailed to you, so we never store a password. Needed to show you your orders. An account is optional: you can check out as a guest with just your email address, and a guest order joins your account if you later sign in with the same address. Sign-in links expire in 20 minutes and sessions expire automatically. We keep accounts until you ask us to delete them.
• Orders. What you bought, the price paid, your shipping address, a phone number for the carrier if you give one, and any note you add. Kept as our sales and tax record.
• Payment. Card payments are processed by Stripe. Your card number goes directly to Stripe and never touches our systems; we receive a confirmation, the last four digits and the payment reference. Stripe's handling of your data is described in its own privacy policy.
• Cart. A random cookie ties your cart to you while you shop. It contains no personal data. If you open a sign-in link on another device, we note which cart it came from, so that paying on one empties both.
• Messages. When you use the support form we store your name, email, topic and message so we can reply. A request list you send is stored the same way: your email, your name if you give it, the plants and quantities, and the state or ZIP code and timing you enter.
• Email we send. We keep a record of each email the site sends you (order confirmations, sign-in emails, waitlist notices and receipts), so we can see what you were told. A sign-in email is recorded without its link.
• Newsletter. Your email address, only if you sign up for the seasonal notes (four to six emails a year), and which form you signed up on. We keep newsletter addresses until you unsubscribe. Take yourself off the list at any time, or email us.
• Waitlist. If you ask to be told when a plant is priced or back in stock, we keep your email address against that plant, and which page's form you signed up on, send you one email when it is ready, and nothing else.
• Preferences. Your light or dark theme and, if you set one in the shop or a tool, your hardiness zone are stored in your browser so we can remember them. The seed sowing planner, the planting-window tool and the big-tree measurer keep your state there too. A request list you are putting together is kept in your browser as well, and so is the last list you sent, with its notes, until you send another or clear it. Where your browser blocks that storage, the theme is kept in a cookie instead, which the page reads. Your browser sends that cookie with each page request, but we do not use it. The zone reaches us only when a page needs it to answer you: the shop's zone filter, the planting-site check and the companion species tool carry it in the page address, like any other choice in a form. The native trees by state tool, opened with no state in its address, asks for the page of the state your browser remembers, so that state travels in the page address the same way. Nothing else of these leaves your device. The tree identification tool keeps the text of your last answer in your browser, never the photo, until you clear it.
• Tool use. When one of the planting tools shows you a result, or you copy or share its link, download its calendar file, remember a zone or join a waitlist from it, your browser tells us the tool's name and which of those happened, and we add one to that day's count. Where the tool was set to a plant, a state or a hardiness zone, your browser tells us which, and we add one to that day's count for it. What you type is not sent: not a ZIP code, a date or a measurement. The ZIP code tool tells us only the zone it found. A tool page opened from a link that already carries the choices (a plant page's button, a shared link) is counted as opened that way, apart from a use, until you change something, and the plant, state or zone such a link names is not counted. When a result sends you on, to a plant page, the shop, the request list, an article or another tool, your browser tells us which kind of link it was, once each per page view, and we add one to that day's count for the tool. On a tool's page your browser also tells us, once each, whether its result stayed on your screen for two seconds and whether you reached the list of how it was worked out. Your browser also tells us, once per page view, that a tool's page was opened, and on the tree identification tool whether you were signed in. It tells us whether the answer bar at the foot of the screen showed its answer for two seconds and whether you pressed it. It tells us when a name you typed into a tool's list of plants matched nothing, and which of the growth estimator's fields you changed, but never what you typed or chose. Nothing else is sent or kept: no address, no cookie, no identifier. The counts tell us which tools are worth the work and which plants people look up.
• Tree identification. When you ask the tree identification tool for a name, your browser shrinks each photo to at most 1,600 pixels across and writes it anew. That drops the details your camera stored with it, the place it was taken included. The photos, up to three, and any words you add, are sent once to Anthropic's AI model, which reads them to answer, and this site keeps none of them. Anthropic deletes what the tool sends it within 30 days under its policy, and keeps it longer only where its usage policy or the law requires. You alone are responsible for what you upload, as the terms say. Before the model sees them, the photos and any words you add are read by two of Meta's models run on Cloudflare's servers, which keep nothing. Llama Guard says whether the words are safe. Llama 4 Scout says whether each photo shows a plant, or something the tool does not take: a person as its subject, nudity, violence, a weapon, a screen or a document. A request they stop goes no further, and nothing is sent to the model. The tool uses the same Cloudflare spam check as our forms, and the address your request comes from is used only to limit how many times one address asks in a minute. What we count, by day: each answer the model gave, each request its checks stopped, and each request that failed and why. We also count the plant its first name was when we grow it, and a press of its "Sign in" button. A press of "This looks right" or "This looks wrong" counts with the first name's status and confidence, and every call counts the tokens the model read and wrote. Each call also counts whether it carried one photo, several, or a follow-up. None of it carries the photo, your words or a name you typed.
• Sign-up forms. When a plant's sign-up card, a bundle's form, or the form under a tool's results that takes one address for several plants comes into view on your screen, your browser tells us which form it was: the plant, or the tool or bundle the form stands on. We add one to that day's count for it. Nothing else is sent or kept: no address, no cookie, no identifier, and not whether you signed up. When a form refuses a sign-up, we add one to that day's count for the reason (an address that is not valid, a plant we could not find, too many tries in a minute, a spam check that did not finish or did not pass) and keep nothing else; the newsletter form, the support form and the request list count a refusal the same way (an empty message or an empty list among the reasons), and so does the cart when it cannot add a plant (an item that cannot be ordered, more than the stock left, too many cart changes in a minute). The counts tell us how many people see each form and whether a form has started failing, so we can judge what it earns.
• Buttons and blocks. When you press "Ask about this plant" or "Email instead" on a plant's page, add a plant or a set to your request list, open a request list with plants on it, follow a link or press a button in one of the home page's blocks, press the button at the end of an article, open its "Read next" or one of its related articles, follow a link in an article's text to a plant page, a tool, another article, the glossary, the shop, a bundle, the support page or the request list, open the bundle or the shop link in the panel at the end of an article, or leave a plant's page through one of its lists (a planning tool, the reading list, the line of its relatives, one of the two rows of related plants), your browser tells us which button, block or kind of link it was, and we add one to that day's count. The same goes for "Ask about this bundle" and the other bundles on a bundle's page, and for the two buttons of each bundle on the bundles page. It also goes for a plant page's links to the bundles it is in, the shop's "Shop by need" line, and the header's links on the home page. On a plant's page your browser also tells us, once each, which parts of the page came onto your screen (the facts, the end of the growing guide, the related plants, the end of the page), so we can judge the order of the page. It does the same on an article for the first section, the Common questions, the next-step panel and the related articles, and on the home page for each of its blocks. When you follow an article's link to a plant page, your browser keeps a mark until the tab closes, nothing but that you came from an article, so a sign-up on that plant's page counts as one that followed an article. Each of these counts also keeps the class of browser that sent it, as our record of each request names it (Server logs, below): a person's browser, one that looks automated, or another program. So do the tool counts and the visits from AI answers. Nothing else is sent or kept: not the plant, not the article, no address, no cookie, no identifier. The counts tell us which doors visitors use and which they never see.
• Visits from AI answers. When you reach the site from a link in an AI assistant's answer, your browser tells us which assistant sent you and what kind of page you landed on: the home page, a plant page, an article, a tool or the shop. It reads this from the tag ChatGPT adds to its links or from the assistant's site named as the referrer; a search engine's referrer counts nothing. The page itself, its address and anything about you are not sent. We add one to that day's count for the assistant and one for the kind of page. The counts tell us which assistants send readers and what they send them to.
• Searches. When you search the shop, your browser tells us the words you searched for, and we add one to that day's count for those words. Only searches made of letters are counted, up to 40 characters; one that holds a number, an "@" or any other mark is not kept at all, so an email address or a phone number never is. Nothing else is sent or kept: no address, no cookie, no identifier. The counts tell us which plants people look for and do not find.
• Script errors. When a page's script fails in your browser, your browser tells us the kind of page it failed on (the home page, a plant page, an article, the shop or another page) or, on a tool's page, the tool's name, once per page view, and we add one to that day's count. Nothing else is sent or kept: not the error's text, not the line it stopped at, not the page's address, no cookie, no identifier. The counts tell us when a page or a tool has started failing, so we can find the fault and fix it.
• Server logs. Our hosting provider (Cloudflare) records requests, including IP address and browser type, for security and to keep the site running. We use the IP address to limit abusive sign-in and form submissions, and how often one address can add to the tool, search and sign-up form counts. We also keep our own record of each request the site answers: the page address asked for, the time, how the request ended and how long it took. A page address includes the words of a search and the choices in a tool link. The record shows us where the site is slow or fails. It also notes the browser's or crawler's name, the kind of device and the country a request came from, whether the browser fetched the page ahead of a click, and the kind of site that sent the visit, a search engine, an AI assistant, a social site or another site, never the address or that site's page, and we keep a count of those records by day, page, browser, country and kind of site.
• Page counts. Cloudflare Web Analytics, which our host adds to every page, counts how many times each page is read and how fast it loads. It also records the visitor's country, browser and device type, and the page or site that sent the visit. It sets no cookie, stores nothing in your browser and does not fingerprint you. The part of a page address after the question mark is not recorded, so what you entered in a tool link stays out of it. Cloudflare describes the beacon under Web Analytics.
• Bot check on forms. The newsletter, waitlist, support and sign-in forms, and checkout without an account, use Cloudflare Turnstile, which loads only when you use one of them and checks that the submission comes from a person. It may set a Cloudflare cookie for that check and processes your request data under Cloudflare's privacy policy. Without JavaScript these forms cannot be sent; email us instead.

What we do not do

• No advertising networks, no tracking pixels, no social-media plugins, and no analytics beyond the cookie-free page counts above.
• We do not sell, rent or trade personal data.
• We do not email you marketing unless you asked for the newsletter.

Who else handles your data

Only the services needed to run the store: Cloudflare (hosting, database, image storage and page counts), Stripe (payments), our transactional email provider for order confirmations and sign-in links, and the carriers who deliver your order, who receive your name, address and phone number for that purpose. The tree identification tool also sends the photos and words you give it, after two of Meta's models on Cloudflare's servers check them, to Anthropic, whose AI model reads them to answer. We may disclose data where the law requires it.

Cookies

Seven, all first-party: a session cookie when you sign in, a cookie that tells the page you are signed in so it can show your account link, a cookie that recognizes the browser a guest order was placed from, so it can pay for and view that order, a cart cookie, a cookie holding the number of items in your cart so the basket badge can be shown without a lookup, a theme cookie, and a short-lived cookie after you change something (a cart, an order, your account) so that the next page you load shows the change. Stripe sets its own cookies on its hosted payment page. None are used for advertising. Blocking cookies will stop the cart and sign-in from working.

Leaving the newsletter

Enter the address you signed up with and it comes off the list at once. Account holders can also untick “Email me the seasonal notes (four to six a year)” on their account page.

Unsubscribe

Your choices

Email captain@bluewhaletrees.com to see what we hold about you, correct it, or have your account and messages deleted. We will keep the parts of order records the law requires us to keep and delete the rest. Residents of states with privacy laws (such as California) have the rights those laws provide; we honor them for everyone.

Children

The store is for adults. We do not knowingly collect data from anyone under 16.

Changes

If this policy changes in a way that matters, the date at the top will change and the change will be described here.

• October 29, 2026: a tool page counts more, once each per page view (Tool use, above). It tells us that its page was opened, and on the tree identification tool whether you were signed in. It tells us whether the answer bar at the foot of the screen showed its answer for two seconds and whether you pressed it. It tells us that a name typed into a tool's list of plants matched nothing, never the name itself, and which of the growth estimator's fields you changed. The tree identification tool also keeps the text of your last answer in your browser, never the photo, until you clear it (Preferences, above).
• October 28, 2026: the tree identification tool counts more, by day (Tree identification, above). It counts each request that failed and why, the plant its first name was when we grow it, and a press of its "Sign in" button. A press of "This looks right" or "This looks wrong" counts with the first name's status and confidence, and every call counts the tokens the model read and wrote. Each call also counts whether it carried one photo, several, or a follow-up. None of it carries the photo, your words or a name you typed.
• October 28, 2026: the tree identification tool sends the photos and words you give it to Anthropic's AI model to answer, and this site keeps none of them (Tree identification, above). Anthropic deletes what it receives within 30 days under its policy. Your browser shrinks each photo first and drops the details your camera stored with it, the place it was taken included, and two of Meta's models on Cloudflare's servers check the photos and the words before the model sees them, keeping nothing.
• October 26, 2026: on a phone with its own share sheet, a tool's Copy link button opens that sheet, and the share is counted as a copy is. A tool also counts, once each per page view, whether its result stayed on your screen for two seconds and whether you reached how it was worked out (Tool use, above). Nothing you type and nothing about you is sent.
• October 24, 2026: the picture format check of October 22 has ended. Your browser no longer fetches the two copies of a photo, and the counts it made stay with us as counts only.
• October 23, 2026: more of the site's doors are counted (Buttons and blocks, above). They are the header's links on the home page and each of its blocks as it comes onto your screen. They are also the buttons and other bundles on a bundle's page, the bundles page's buttons, a plant page's links to its bundles, and the shop's "Shop by need" line. Each count also keeps the class of browser that sent it. Nothing you type and nothing about you is sent.
• October 22, 2026: once, your browser checks whether it can show a fuller-color form of the picture format our photos use, and tells us the results and how long each took, with your browser's name and the kind of device (the picture format check, which ended on October 24, 2026). Nothing about you is sent.
• October 22, 2026: a page's script that fails in your browser is counted, once per page view, by the kind of page or the tool's name (Script errors, above); the cart counts a plant it cannot add by the reason (Sign-up forms, above); and our record of each request notes whether the browser fetched the page ahead of a click (Server logs, above). Neither the error's text nor anything about you is sent.
• October 20, 2026: the planting-window tool and the big-tree measurer remember the state you choose, as the seed sowing planner does, and Preferences above now names all three. A state any of them remembers opens the native trees by state tool. The last request list you sent stays in your browser, with its notes, until you send another or clear it (Preferences, above).
• October 19, 2026: every kind of link in an article's text and the two links in its closing panel are counted by kind, and so is how far down an article you read (the first section, the Common questions, the panel, the related articles); a sign-up on a plant page reached from an article counts as one that followed an article, by a mark your browser keeps until the tab closes; and when a tool's result sends you to a plant page, the shop, the request list, an article or another tool, the kind of link is counted for the tool (Tool use and Buttons and blocks, above). Nothing you type, no plant and no article is sent.
• October 18, 2026: the lists a plant page is left through, and which parts of a plant page came onto the screen, are counted (Buttons and blocks, above). Nothing you type, no plant and nothing about you is sent. The native trees by state tool, opened with no state in its address, asks for the page of the state your browser remembers (Preferences, above).
• October 16, 2026: a tool page opened from a link that already carries the choices is counted as opened that way, apart from a use, and the choices in such a link are not counted (Tool use, above); a sign-up form is counted when it comes into view rather than when the page loads, and the newsletter form, the support form and the request list count a refusal by its reason (Sign-up forms, above); the button at the end of an article, its related articles and its links to plants, tools and other articles are counted (Buttons and blocks, above). Nothing you type, no plant and no article is sent.
• October 13, 2026: the plant page's "Ask about this plant" and "Email instead", adds to the request list, a request list opened with plants on it, and the home page's blocks are counted (Buttons and blocks, above). Nothing you type and no plant is sent.
• October 12, 2026: a sign-up form is counted when a page shows it, by the plant or the page it stands on, and a refused sign-up is counted by its reason (Sign-up forms, above). Nothing about you is sent or kept with either.
• October 11, 2026: a visit that arrives from an AI assistant's answer is counted, by assistant and by the kind of page it landed on (Visits from AI answers, above). The page's address and anything about you are not sent.
• October 6, 2026: the seed sowing planner also remembers the state you choose, in your browser, beside the zone (Preferences, above). The companion species tool carries your zone in the page address when you set one there, as the shop's zone filter and the planting-site check do.
• October 4, 2026: our server no longer uses the theme cookie, and the page reads it only when your browser's storage is empty (Preferences, above). A new cookie tells the page you are signed in, so it can show your account link (Cookies, below).
• October 3, 2026: the planting tools now also count which plant, state or hardiness zone a tool was set to (Tool use, above). Before, they counted only that a tool was used. A ZIP code, a date or a measurement you type is still never sent.