Privacy Policy
What Xeriscaping.com collects, why, who processes it, and how to access or delete your data. We don't sell or share your personal information.
Last updated: September 24, 2026
This policy explains what personal information Xeriscaping.com collects, why we collect it, who helps us process it, and how you can access or delete it. It covers xeriscaping.com, including the guides and articles, the newsletter, the Plant Finder and other tools, member accounts, the pro directory, and the certification program.
Xeriscaping.com is operated by Xeriscaping.com LLC, a Colorado limited liability company based in Denver ("we," "us," "our"). If you have a question at any point, email hello@xeriscaping.com.
The short version
- We collect the minimum we need to send the newsletter, run your account, and process certification payments.
- We don't sell your personal information or share it for targeted advertising. We don't run ad networks or advertising cookies.
- Our analytics count visits without advertising cookies.
- Payments go through Stripe. We never see or store your full card number.
- You can unsubscribe, download your data, or have it deleted by emailing us.
Information we collect
Newsletter and members
When you subscribe to our newsletter, The Dry Garden, download the free guide, or tick "email me tips" in one of our tools, we collect your email address and any name you choose to give. Our publishing platform, Ghost, stores this as a member record along with:
- the date you signed up and how you signed up (for example, the page you subscribed from, or a label such as "Guide download")
- your newsletter preferences and subscription status
- email engagement: whether you opened a newsletter and which links you clicked (standard email analytics that Ghost provides)
- the date you last visited the site while signed in
Member accounts (Plant Finder, My Garden, vendor profiles)
Tool accounts use passwordless "magic link" sign-in through Supabase. When you create an account we store:
- your email address, account ID, and sign-in timestamps
- technical security logs kept by Supabase, which may include your IP address and browser type
- anything you save, such as the plants on your My Garden list
We never ask you to create a password, so we don't store one.
Directory listings and vendor claims
Listed businesses in our pro directory were compiled from information the businesses publish on their own websites: business name, city, metro area, website, and a short description. We don't collect personal information about individuals for these listings. If you own a listed business and want it corrected or removed, email us.
When a business owner claims or creates a profile, we collect what they enter, which may include business name, city and state, service areas and radius, website, phone, a contact email, a bio, services and specialties, years in business, license number, an insurance attestation, a logo, portfolio photos, and social media links. Profiles are public by default. Please don't enter anything you don't want shown on your public profile page.
Certification program
If you enroll in the Certified Xeriscaping Provider (CXP) program, we also store:
- your course progress (which lessons you've completed)
- your exam attempts, answers, and scores
- your certification status, certificate serial number, and issue and expiry dates
The public certificate verification page shows the business or provider name, serial number, certification status, and dates. It does not show your email address or your exam results.
Payments
Certification subscriptions are processed by Stripe. You enter your card details on Stripe's secure checkout page, not on our site, and we never see or store your full card number or security code. Stripe shares limited information with us so we can manage your subscription: your name, email, billing country and postal code, card brand, the last four digits of your card, the amount and date of each payment, and your subscription status. Stripe's own use of your information is covered by the Stripe Privacy Policy.
When you contact us
If you email us, we keep your message, your email address, and anything you include (such as photos of your yard) so we can reply and fix anything you've reported.
Information collected automatically
Like every website, our servers and security providers receive technical information with each request: your IP address, browser and device type, the page requested, the referring page, and the time. We use this to deliver pages, keep the site secure, and fix errors. See the next section for analytics.
Cookies, local storage, and analytics
We don't use advertising cookies, cross-site tracking pixels, or third-party ad networks. The site uses the following:
| What | Who | Purpose | Type |
|---|---|---|---|
| Web analytics on articles and pages | Ghost (built-in analytics) | Counts page views, referring sites, approximate location (country or region), and device/browser type. No cookies; the script keeps a short-lived session identifier in your browser's local storage. If you're signed in as a member, your page views are linked to your member record. | Local storage |
| Web analytics on the tools, directory, and certification pages | Vercel Web Analytics | Counts page views, referring sites, country, and device/browser/OS type. Cookieless: Vercel identifies a visit using a hash of the request that is discarded within 24 hours, so it can't follow you across days or sites. | None |
| Member sign-in (newsletter members) | Ghost | Keeps you signed in and remembers your email preferences. Ghost may also keep a list of pages viewed before signup in local storage so we can see which article led to a signup. | Essential cookie and local storage |
| Account sign-in (tool accounts) | Supabase | Keeps you signed in to My Garden, your vendor dashboard, and the course. | Essential cookie |
| Security and bot protection | Cloudflare | Protects the site from attacks and abusive traffic. It may set a strictly necessary security cookie. | Essential cookie |
| Checkout | Stripe (on stripe.com) | Fraud prevention and payment processing, only when you go to Stripe Checkout. | Set by Stripe on its own site |
We host our fonts ourselves, so loading a page doesn't send your IP address to a font service. Some Ghost features, including the sign-up pop-up and site search, load code from the public jsDelivr content delivery network. As with any web request, jsDelivr receives your IP address and browser information to deliver the file.
You can block or delete cookies and local storage in your browser settings. Essential cookies are needed for sign-in; the rest of the site works without them.
Affiliate links
Some links on our plant pages and in some articles are affiliate links. We participate in, or are applying to, affiliate programs run by plant retailers and networks, including High Country Gardens (through AvantLink), Nature Hills Nursery, American Meadows, and Etsy (through Awin). If you click one of these links and buy something, we may earn a commission at no extra cost to you.
We don't pass your name or email to these retailers. When you click an affiliate link, the retailer or affiliate network may set its own cookies on its website to record that the sale came from us. Their privacy policies govern that. See our affiliate disclosure for how affiliate relationships affect (and don't affect) what we recommend.
How we use your information
- to send the newsletter, the free guide, and emails you asked for
- to run your account, save your plants, and show your vendor profile
- to deliver the certification course and exam, issue certificates, and process subscriptions
- to answer your questions and act on corrections you send us
- to understand which pages and tools are useful, in aggregate, so we can improve them
- to keep the site secure, prevent fraud and abuse, and fix problems
- to meet legal, tax, and accounting obligations
We don't use your information for automated decisions that have legal or similarly significant effects on you, and we don't build advertising profiles.
Service providers we use
We share personal information only with the service providers that run the site for us, and only as much as each one needs to do its job:
| Provider | What they do for us |
|---|---|
| Ghost(Pro) (Ghost Foundation) | Hosts our articles and pages; stores newsletter members; sends newsletters (email delivery through its sending provider, Mailgun); provides page analytics |
| Vercel | Hosts the Plant Finder, tools, directory, and certification app; Vercel Web Analytics |
| Supabase | Account sign-in (magic-link emails), saved plants, vendor profiles, course progress, and exam records |
| Stripe | Certification subscription payments, invoices, and the billing portal |
| Cloudflare | Content delivery network, DNS, and security for xeriscaping.com |
| jsDelivr | Delivers Ghost's sign-up and search scripts |
| Our email hosting provider | Receives and stores messages sent to hello@xeriscaping.com |
These providers may process data in the United States and other countries where they operate. We may also disclose information if required by law, to protect the rights or safety of our users or the public, or as part of a sale or reorganization of our business (in which case this policy would continue to apply to your information).
We don't sell or share your personal information
Xeriscaping.com LLC does not sell your personal information and does not "share" it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We have not done so in the past 12 months. Because we don't sell or share, there's nothing to opt out of. We still honor Global Privacy Control (GPC) browser signals as a request to opt out.
We don't knowingly collect sensitive personal information (such as precise geolocation, government ID numbers, or health data), apart from account sign-in credentials. A contractor license number that a business owner chooses to add to a public profile is business information.
How long we keep information
| Information | How long |
|---|---|
| Newsletter member record | Until you unsubscribe and ask us to delete it, or until we remove inactive members |
| Account data and saved plants | Until you delete your account or ask us to |
| Vendor profile | Until the owner deletes it or asks us to. Listed business entries stay while the directory runs, unless the business asks for removal |
| Course progress and exam records | While your account is open, and for the life of any certificate issued, so it can be verified |
| Payment and billing records | As long as tax and accounting law requires, generally up to seven years |
| Emails to us | As long as needed to handle your request, then deleted within about three years |
| Analytics | Kept by our analytics providers in aggregate form under their own retention schedules |
| Server and security logs | Kept for short periods by our hosting and security providers |
Deleted data may stay in encrypted backups for a limited period until those backups are overwritten.
Your rights and choices
Wherever you live, you can ask us to:
- access the personal information we hold about you, or get a copy you can take elsewhere
- correct anything that's wrong
- delete your information
- unsubscribe from email at any time, using the link at the bottom of every newsletter or in your member account settings
To make a request, email hello@xeriscaping.com from the address linked to your account or subscription, with the subject "Privacy request." We may need to confirm your identity before acting, usually by replying to that address. We'll respond within 45 days. If we need more time, we'll tell you why. You can use an authorized agent; we'll ask for proof of their authority. We won't treat you differently or charge you more for using your rights.
California residents. Under the CCPA/CPRA you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and to opt out of its sale or sharing (which we don't do). The categories we collect are described above: identifiers (email, name, account ID, IP address), commercial information (subscription and payment records), internet activity (page views and email engagement), and professional information that business owners add to vendor profiles. We collect them from you directly, from your browser, and from our service providers. We use them for the purposes listed above and disclose them only to the service providers listed above.
Colorado residents. The Colorado Privacy Act applies to businesses that handle the personal data of at least 100,000 Colorado consumers a year, or that earn revenue from selling personal data. We don't expect to meet those thresholds. We're a Colorado company, though, so we'll honor Colorado residents' requests to access, correct, delete, or get a copy of their data, and to opt out of targeted advertising, sale, or profiling, as if the Act applied. If we deny a request, you can appeal by replying to our decision with "Appeal" in the subject line.
Visitors from outside the United States. We're based in the United States, and your information is processed here. If you're in the European Economic Area or the UK, we rely on your consent (newsletter), the performance of a contract (accounts and certification), and our legitimate interests (security and basic analytics) to process your information. You may also complain to your local data protection authority.
Children
Xeriscaping.com is written for adults. It isn't directed to children under 13, and we don't knowingly collect personal information from them. Accounts, directory profiles, and certification purchases are for people 18 and older. If you believe a child has given us personal information, email us and we'll delete it.
Security
We use HTTPS across the site. Sign-in uses one-time magic links instead of passwords. Database access is protected by row-level security, so each account can read and edit only its own records. Payment data stays with Stripe, and administrative access is limited to the people who run the site. No system is perfectly secure, but if we learn of a breach affecting your personal information, we'll notify you as the law requires.
Links to other sites
Our articles link to water utilities, extension services, retailers, and other outside sites. Their privacy practices are their own, so read their policies before you give them information.
Changes to this policy
We'll update this page when our practices change, and change the "Last updated" date at the top. If a change is significant, such as a new use of your email address, we'll also post a notice on the site or email members before it takes effect.
Contact
Questions, requests, or complaints about privacy:
Xeriscaping.com LLC Denver, Colorado, USA Email: hello@xeriscaping.com
You can also reach us through our contact page.