Side Hustle Garden ← Back to Side Hustle Garden

Privacy Policy

Last updated: October 2, 2026

Operator: Jen Built It LLC, a US limited liability company.
Mailing address: 10800 S Lloyd Drive, Worth, IL 60482, USA.
Privacy contact: privacy@jenbuiltit.com
General support: hello@jenbuiltit.com

This policy explains what data we collect when you use Side Hustle Garden (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC.

1. What we collect

Account data. Your email address and a salted PBKDF2 hash of your password (100,000 iterations, per-user random salt, SHA-256). We never store your password in plain text and never see it again after you set it. We also store when your account was created, when you last signed in, and whether your email has been verified.
Bills. The bills you plant in your garden (name, amount, type, whether it repeats, whether it is archived, the month it starts), plus any month-specific amount you override for a given bill.
Payments. The side income you record (source name, amount, the month it belongs to, the pay date, and which bills you watered with it).
Settings. Your monthly income goal.
Session data. The identifier of any session you have signed out of, so a revoked session cannot be replayed.
Security data. A bounded record of failed login attempts and rate-limit counters, keyed by IP address or email address, used solely to throttle abuse. Password-reset and email-verification tokens are stored as SHA-256 hashes so a database snapshot leak cannot directly compromise a pending reset.
Cross-app Pro status. If you upgrade to Pro on Jen's App Hub, this Service receives a signed token from App Hub that confirms your Pro status and your email. We do not receive your Stripe payment details. Card numbers, CVV, and other payment data stay with Stripe and App Hub.
Newsletter consent. Side Hustle Garden does not offer a newsletter sign-up and we do not send marketing email. Your account record can carry a newsletter-consent flag, but it stays off unless you explicitly opt in somewhere that we add one in the future.

We do not run analytics on your income and bill data, and we do not read it for any purpose other than showing it back to you.

2. Why we collect it

To create and secure your account (legal basis: contract).
To store the bills, payments, and goals you ask us to store (legal basis: contract).
To recognize you across the Jen Built It app family when you have a Pro subscription (legal basis: contract).
To prevent brute-force login, credential stuffing, and abuse (legal basis: legitimate interest).
To send you transactional emails (email verification, password reset) (legal basis: contract).

3. Who we share it with (processors)

We use a small set of vendors to operate the Service. Each vendor only receives the minimum data they need.

Cloudflare hosts the Service and our database (Cloudflare Workers + D1).
Resend sends transactional email: email verification and password reset.
Jen's App Hub issues a signed Pro entitlement token that this Service checks with App Hub to grant Pro features. App Hub itself uses Stripe for payment processing, and Stripe never communicates directly with Side Hustle Garden. When you log in, this Service sends your email address to App Hub to ask whether you have Pro, so Pro follows your account to a new device. If you have Pro and get App Hub's monthly recap email, App Hub asks this Service for that month's totals for your account: amount earned, how many payments you logged, how many bills were fully covered, your coverage percentage, your goal and how close you got, and your month streak. Nothing else about your bills or payments is sent.
Our own n8n automation server (self-hosted, operated by Jen Built It LLC) receives two things. First, a signup notification carrying your email address, which Jen uses to keep track of signups. It doesn't add you to any mailing list, and the endpoint is authenticated with a shared secret. Second, server-error reports, which contain only the request path, HTTP method, status code, and error message, never any account data.
Feedback button: if you use the in-app Feedback button, your message, the page you were on, your browser's user-agent string and, if you choose to enter it, your email address are sent to that same n8n server and emailed to Jen. Nothing is sent unless you press Send.
Google Fonts: the Service loads its fonts from Google (fonts.googleapis.com and fonts.gstatic.com). When your browser fetches them, Google receives your IP address and basic browser details, the same as for any website that uses Google Fonts.
Cloudflare Web Analytics counts page views so Jen can see how many people visit. It's privacy-friendly page-view counting: Cloudflare says it doesn't use cookies or local storage and doesn't fingerprint visitors (cloudflare.com/web-analytics).

We do not sell your personal data. We do not share your data with advertisers. We do not transfer your data to third parties for their own marketing.

4. How long we keep your data

Account, bills, payments, and settings: as long as your account exists. When you delete your account, we delete every row tied to your user ID (user, bills, monthly amounts, payments, settings, revoked sessions, reset tokens, email-verification tokens, and your failed-login record) immediately and irrevocably.
Security data (failed-login counters, rate-limit rows): purged automatically once the window they belong to has passed, and a daily cleanup job deletes anything older than a day.
Password-reset and email-verification token hashes: they stop working when they expire or once they're used, and the daily cleanup job deletes them 7 days after they expire.
Signed-out session identifiers: deleted by the daily cleanup job once the 30-day session they belong to has expired.
Security log entries: when you log in, fail a login, reset your password, or delete your account, the server writes a short log line with your account ID (or, for a failed login, a one-way hash of the email typed) and a one-way hash of your IP address. No passwords, tokens, raw email addresses or raw IP addresses are logged. Cloudflare keeps these logs for up to 7 days.

5. Cookies and local storage

To keep you logged in, we set one cookie named garden_session. It holds a signed login token, it's marked HttpOnly so scripts on the page can't read it, it's only sent to Side Hustle Garden over HTTPS, and it lasts 30 days or until you log out, whichever comes first. We don't keep your login in browser local storage anymore. If you have Pro, we keep a Pro entitlement token and a short-lived cached copy of your Pro status in your browser's local storage. We also store small interface flags in your browser, such as whether you have seen the welcome screen. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics. The only analytics is Cloudflare Web Analytics (see section 3), which sets no cookies and stores nothing in your browser.

Do Not Track. Some browsers can send a "Do Not Track" signal. Side Hustle Garden doesn't use advertising or tracking tools that follow you across other websites, so it works the same whether or not your browser sends that signal. We don't let any third party collect information about your activity on Side Hustle Garden to track you across other sites over time.

6. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

Access the personal data we hold about you. Sign in, open the Privacy Policy panel in the app, and use Download my data to get a JSON file with every bill, payment, monthly amount, and setting on your account. A CSV export is also available from the app.
Correct inaccurate data (edit your bills, payments, goal, or email).
Delete your account and all your data (Account settings → Delete my account). You will be asked for your current password, or for App Hub re-verification if your account signs in through the hub. Deletion is immediate and we cannot undo it.
Lodge a complaint with your local data protection authority.

For anything that requires our help (CCPA right-to-know, GDPR Article 15 statement, dispute over a deletion), email privacy@jenbuiltit.com from the address tied to your account. We respond within 30 days (45 days for California requests).

7. Security

We protect your data using TLS in transit (HSTS), salted PBKDF2 password hashing, parameterized SQL with per-user row filtering, signed JWT sessions with server-side revocation, throttling after repeated failed logins, request body size caps, per-IP and per-account rate limiting, and a strict Content Security Policy. No system is perfectly secure, but if we detect a breach affecting your data we will notify you and the appropriate authorities as required by law.

8. Affiliate links

The Service shows occasional tips and resources, and some of those links are affiliate links, labeled as such where they appear. If you follow one and sign up, Jen Built It LLC may earn a commission at no extra cost to you. Following an affiliate link takes you to a third party's site, where that party's own privacy policy and cookies apply. We do not send your account data to those sites, and we do not receive personal data back from them.

9. Children

The Service isn't meant for anyone under 18, and we don't knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we will delete it.

10. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses or equivalent safeguards with our sub-processors where required.

11. California residents

If you are a California resident, you have the rights described in Section 6 above (right to know, delete, correct) under the CCPA/CPRA. You also have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising; see our Do Not Sell or Share My Personal Information page for the formal statement.

12. Cross-app Pro verification

If you have a Pro subscription on Jen's App Hub, this Service receives a signed JWT containing only your email and your Pro expiration date. We check that token with App Hub's verification endpoint; the signing secret never lives on this Service. No payment details, no profile data beyond email, and no usage data from other Jen Built It apps is shared with this Service.

13. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we will notify you by email and post a notice on the Service. The "Last updated" date at the top will always reflect the current version.

14. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com