Privacy policy

Last updated 8 October 2026.

This policy explains what personal information Midstorey collects, why, who it's shared with, and your choices. The site is run by the operator of this site ("we"). We handle personal information in line with the Australian Privacy Principles.

The short version

• You can browse and search without an account, and we don't track you across other sites.
• We don't use advertising trackers or analytics services.
• If you make an account, we keep your email address, display name and what you choose to save or share.
• We never sell your personal information.
• You can change or delete your account at any time from your account page.

What we collect, and why

When you browse

• Searches and choices you make, such as a postcode, a distance or the state you want plants delivered to, are kept in your session so the site remembers them while you browse. Results for a postcode are cached by postcode, not linked to you. To find plants recorded near a postcode we send the Atlas of Living Australia the approximate centre of that postcode, never anything about you.
• Clicks on nursery links: when you follow a link to a nursery, we record which listing it was, the time, and the delivery state you'd chosen (if any). We don't record who you are. Nurseries see these as counts and as a list of dates, times, plants and states, so they can see how useful their listings are.
• Technical information: our hosting keeps standard request logs (IP address, browser type, pages requested and errors) for security and to fix problems. To limit repeated sign-up and login attempts we also keep a scrambled form of your IP address for up to a day, from which the address itself can't be read.

If you make an account

• Account details: your email address, an optional display name, and your password (stored only in a scrambled form we can't read). We use your email to confirm it's yours, to reset your password, and to tell you about things you've asked for, such as decisions on your suggestions. We don't send marketing email.
• Your lists: titles, descriptions, plants, quantities and notes. Private lists are visible only to you. Lists you share by link can be seen by anyone with the link; public lists are listed on the site and can appear in search engines. Shared lists show your display name (or "A gardener" if you haven't set one).
• Your contributions: suggested changes, notes about your sources, and photos. Approved changes appear in a public change history with your display name. Photos show the credit name you give. When you upload a photo we remove all the hidden information stored in the file, including any GPS location, before anyone else sees it.

If you represent a nursery

• Application and nursery details: business name, website, state, ABN, phone number, a contact email and anything you tell us, so we can check the application and contact you. Your nursery's name, website, description, states you deliver to and listings are shown publicly.
• Payments for featured placement are handled by Stripe. We never see or store card details; we keep the reference numbers Stripe gives us so we know your nursery is featured.

Cookies and browser storage

We use two cookies that the site needs to work: one keeps you logged in and remembers your choices (such as your postcode) while you browse, and one protects forms against misuse. We don't use advertising or analytics cookies. Staff tools store layout preferences in your browser. Fonts and scripts are served from our own site, so loading a page doesn't contact other companies.

Who we share information with

We share personal information only with services that help us run the site, and only what they need:

• Google Cloud hosts the site, its database, photos and backups, in Australia.
• Our email delivery provider sends account and notification emails on our behalf.
• Stripe processes payments for nurseries that choose featured placement.

Some of these providers may store or process information outside Australia (for example in the United States). We use well-established providers with strong security and privacy commitments. We may also disclose information if the law requires it, or to protect people's safety or the site's security.

How long we keep it

• Account information and lists: until you delete your account.
• Contributions: approved changes and photos stay part of the database after you leave. Deleting your account removes your name from your suggested changes ("a former member"). Photos keep the credit you typed; ask us if you'd like it changed or a photo removed.
• Rejected photos are deleted when they're rejected.
• Backups are kept for up to 90 days, after which deleted information is gone for good.
• Request logs are kept for about 30 days.

Security

The site is only available over an encrypted connection, passwords are stored scrambled, photos awaiting review are kept in private storage, and backups are private. No system is perfectly secure; if a data breach is likely to cause you serious harm, we'll tell you and the regulator as the law requires.

Your choices and rights

• See and correct your details on your account page, or ask us for a copy of the personal information we hold about you.
• Delete your account and lists at any time from your account page.
• Stay anonymous: browsing and searching need no account, and a display name is optional.

You need to be 16 or older to make an account.

Questions and complaints

Email hello@example.com.au. We'll reply within 30 days. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner.

Changes to this policy

If we change this policy, we'll update the date above, and for significant changes we'll let account holders know by email before the change takes effect.

Questions? Email hello@example.com.au. See also our privacy policy, terms of use and nursery terms.