Privacy Policy

Jakub Chmielewski operates the app and is the controller of the personal information described in this policy, except where we process records on behalf of a business customer as explained below.

Use this email or postal address for privacy questions, requests and complaints, wherever you live.

• Account and preferences: your email address, account identifier, authentication information and settings such as language, region and units. Google or Apple sign-in may provide a name and email address, including an Apple private relay address. We do not receive your Google or Apple password.
• Farm records: fields, crops, treatments and other farm activities, products, quantities, dates, equipment, workers or contractors, notes and photographs you enter or upload. Fields may include addresses, coordinates, boundaries and parcel identifiers.
• Purchases and sales you record: dates, quantities, prices, revenue, payment method and status, customer, supplier or shop names, invoice numbers and notes.
• Subscriptions: your plan, subscription status, purchase and renewal dates, store or payment provider, customer and transaction identifiers, and payment confirmations. Apple, Google or Stripe collects payment details; we do not receive full payment card numbers from their checkout services.
• Support messages: your contact details, report category, product name, message and other information you send us.
• Location: locations you enter or select on a map, and your device location when you allow access for features such as locating a field or displaying weather. Coordinates can be precise, depending on permissions and how you select the location.
• Technical information: IP addresses and request information needed to deliver and secure the service, app and operating-system versions, device model, crash reports and diagnostic details. For push notifications, we process a push token and reminder information.
• Usage information: interactions with features, onboarding, the dosage calculator and subscription screens, as well as product and crop searches and result counts. Search text is normalised, for example to lowercase without Polish diacritics. App usage events are linked to your account identifier; they are not anonymous. Website statistics include page views, referring pages, clicks and browser/device information.

We receive information directly from you, automatically from your use of the service, and from sign-in, payment and other providers when you use the relevant feature. Another user may supply information about you in farm records, for example as a worker or contractor.

An email address and authentication information are needed for an account; transaction information is needed for a paid subscription. Other information is generally optional, but a feature may not work without its required inputs. Please do not include passwords, health information or unnecessary sensitive information in notes, searches or uploads.

A farm or business that determines why and how it records personal information about workers, customers or suppliers is responsible for that use and for informing those people. Where we handle such records only on its instructions, we act as its processor. Contact that business about its records; we can help route a request. This policy does not replace any required data-processing agreement with a business customer.

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies, our legal bases are:

• Providing the service: managing your account, storing and synchronising records, providing requested maps, weather and exports, and managing subscriptions. This is necessary to perform our contract with you or take steps you request before a contract (Article 6(1)(b)).
• Optional device features: accessing device location, camera or photos and sending requested push reminders with your permission (consent, Article 6(1)(a)). Storing a photo or field location you choose to save is part of providing the service. You can withdraw device permissions in your device settings.
• Support and service communications: answering enquiries and sending account, security, subscription and deletion messages. We rely on our contract where needed to provide your service, or our legitimate interest in responding to enquiries and resolving problems (Article 6(1)(f)).
• Reliability and security: investigating errors, preventing abuse and protecting accounts. Our legitimate interest is to operate a reliable, secure service (Article 6(1)(f)).
• Product improvement: understanding feature use, improving usability and identifying gaps in product and crop catalogues. We rely on our legitimate interest in improving the service (Article 6(1)(f)), subject to your right to object and separate consent requirements for device storage or access.
• Legal obligations and claims: keeping required accounting records and responding to binding legal requests (Article 6(1)(c)); establishing, exercising or defending legal claims based on our legitimate interest in protecting our rights (Article 6(1)(f)).

You can withdraw consent at any time without affecting earlier lawful processing. Device permission is not consent to unrelated uses. Reading or accepting this policy does not itself provide consent to optional processing.

We do not use personal information for solely automated decisions, including profiling, that produce legal or similarly significant effects on you.

Providers receive information needed for their role, depending on the features and platform you use:

• Infrastructure: Supabase for authentication and databases; Cloudflare for file storage and delivery; and providers hosting and securing our websites and API. They process account, record, file and technical information needed to operate the service.
• Payments: Stripe, Apple App Store and Google Play process purchases. RevenueCat manages subscription access using account identifiers and purchase information.
• Notifications: Expo and Apple or Google push delivery services process push tokens and notification content.
• Email: ZeptoMail (Zoho) processes recipient addresses, subjects, content and delivery information for transactional and support-related messages.
• Error monitoring: Sentry processes crash and diagnostic information. Our mobile configuration disables its default personal-information collection; we do not deliberately attach your account ID, email or name to events. Error messages may still contain contextual information needed to investigate a problem.
• Website analytics: Umami Cloud processes visit and interaction information. Account-linked app analytics are stored separately in our own database.
• Maps and weather: Apple Maps on iOS, Google Maps on Android, OpenStreetMap tiles on the web, public mapping services such as GUGiK for Polish parcel searches where available, and Apple WeatherKit. They receive relevant map areas, coordinates or search terms and technical request information. Our server’s weather requests contain coordinates, not your account identifier.
• Sign-in: Google or Apple if you choose their sign-in service. Their handling of your account with them is covered by their own privacy notices.

Providers acting on our behalf process information under our instructions. Some, particularly payment, app-store and sign-in providers, also act independently for their own legal, security and account-management purposes.

We may disclose information to authorities where legally required, or to professional advisers where necessary for a legal obligation or claim. You control who receives records you export and share.

We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising.

We are based in Poland. Our Supabase database and Sentry project use EU regions, but this does not mean all processing stays in the EU. Providers and their subprocessors may process information in other countries, including the United States, for delivery, support and other operations.

For transfers outside the European Economic Area (EEA), we rely on an applicable adequacy decision covering the destination and recipient, or the European Commission’s Standard Contractual Clauses with any necessary supplementary measures. For transfers subject to UK transfer rules, the corresponding safeguards are UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU clauses. Where Swiss transfer rules apply, safeguards must also meet Swiss requirements.

A Data Privacy Framework can support a transfer to the US only where the recipient has an active certification covering that transfer under the relevant EU, UK or Swiss framework. A provider’s US address alone is not a safeguard. Contact [email protected] for information about the destinations and safeguards applicable to your information and a copy of the relevant contractual safeguards, with confidential details redacted where necessary.

• Account, farm records and account-linked analytics: kept while you have an account, unless you delete records earlier where the app allows this. Account deletion starts the removal process in section 12.
• Support correspondence: kept to handle your enquiry, follow up on unresolved issues and retain evidence needed for a related complaint or legal claim. The relevant limitation period and any ongoing dispute determine whether correspondence needs to be kept after the enquiry closes.
• Technical and diagnostic records: kept to investigate errors or security incidents and check fixes. Retention depends on the record type, provider configuration and whether an incident is still under investigation. Website statistics that no longer identify a person may be retained for longer-term comparisons.
• Email delivery records: ZeptoMail retains delivery logs, and content where content retention is enabled, for up to 60 days under its standard arrangements. Copies in support correspondence follow the criteria above.
• Billing and legal records: kept for the period required by applicable accounting, tax or other law, and longer where necessary for an unresolved dispute or binding preservation obligation. These periods may run from a tax-year end or another statutory starting point, rather than account deletion. Payment providers may retain their own legally required records.

Deletion from active systems does not necessarily remove existing backup copies at the same time. Backups expire through the backup retention cycle. They are used for recovery rather than ordinary access to deleted accounts. Contact us for retention information about a particular record or deletion request.

As we are established in Poland, the EU GDPR applies to processing in the context of our operations, including when users live outside the EEA. Additional local rights may also apply.

Under the EU or UK GDPR, subject to its conditions and exceptions, you can request access, correction, deletion, restriction of processing and a portable copy of information you provided where processing is automated and based on consent or contract. You can withdraw consent where we rely on it.

Your right to object: you can object at any time to processing based on legitimate interests, including account-linked product analytics, for reasons relating to your particular situation. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need the information for legal claims. Contact [email protected] to object. The right to object to direct marketing, if undertaken, is absolute.

GDPR provides a common framework across the EEA, alongside applicable national rules. The UK has its own GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. In Switzerland, the Federal Act on Data Protection provides rights including access, correction and, where its conditions are met, deletion and data portability. Other European countries may provide additional or different rights under their local laws.

This policy does not restrict rights provided by applicable local law. You can contact us using the same process below regardless of your location or the language you use in the app.

State privacy rights depend on where you live, whether the relevant law applies to our business, and the context in which information is used. Some laws exclude business or employment information. We do not assume that every state privacy law applies simply because the app is available in that state.

Where applicable, you may request confirmation of processing, access, a portable copy, correction, deletion and information about disclosures. You may also have rights to opt out of sales, targeted advertising or certain profiling, rights concerning sensitive information, and rights to use an authorised agent or appeal a decision. We will not discriminate against you for exercising an applicable privacy right.

California: where the California Consumer Privacy Act, as amended (CCPA), applies, rights include knowing the categories and specific pieces of information collected, sources, purposes and recipients, correction, deletion, and opting out of sale or sharing. Section 2 lists our categories: identifiers, commercial information, internet or app activity, geolocation, photographs and other information you supply. Sections 3, 4 and 6 describe purposes, recipients and retention. These also describe the categories collected and disclosed for service-related purposes in the preceding 12 months, depending on the features used.

Precise geolocation and account-access credentials may be sensitive personal information under US law. We use them to provide requested features and protect accounts, rather than infer sensitive characteristics about you. Applicable rights to limit or withdraw consent to sensitive-data processing remain available. Where the law requires separate informed consent, this policy alone does not supply it.

We have not sold personal information or shared it for cross-context behavioural advertising in the preceding 12 months. We do not carry out targeted advertising or profiling for decisions with legal or similarly significant effects. This applies to everyone, including people using Global Privacy Control (GPC): there is no such processing to opt out of. GPC does not itself request account deletion or disable essential service processing.

Email [email protected] or write to the address in section 1. Describe your request and include your account email or other details that help us find your information. You can also correct records or request account deletion in the app. You do not need to create an account to make a privacy request.

We may ask for proportionate information to verify your identity or an authorised agent’s authority. Do not send your password. We use verification information to handle and secure your request. If we cannot fulfil a request, we explain why and any available complaint or appeal route.

We respond without undue delay and within the applicable legal deadline. Under the EU and UK GDPR this is normally one month, with up to two additional months for a permitted extension. Many US state laws use 45 days with a possible further 45 days. We explain an extension within the initial response period. Where the CCPA applies, requests to know, correct or delete are acknowledged within 10 business days. Requests are normally free, subject to limited exceptions allowed by law.

Where your state provides an appeal, email us with “Privacy appeal” and identify the decision. We review it and give a written explanation within the applicable deadline, including how to contact your state attorney general or competent regulator if the appeal is denied.

Send privacy complaints to [email protected] or our postal address, describing the issue and the outcome you seek. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and communicate the outcome without undue delay. This acknowledgement period is separate from the rights-request deadlines in section 9.

• EEA: you can complain to a supervisory authority, particularly where you live or work, or where an alleged infringement occurred. Our Polish authority is the President of the Personal Data Protection Office (UODO). The EDPB directory lists EEA supervisory authorities.
• UK: the Information Commissioner’s Office (ICO), which generally asks you to raise the issue with the organisation first.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
• US and elsewhere: your competent privacy regulator or state attorney general. California residents can contact the California Privacy Protection Agency where appropriate.

Contacting us does not remove your right to complain to a competent regulator or seek a judicial remedy.

The web app uses cookies or similar storage to keep you signed in and protect your session. The apps also store preferences and cached information on your device. Removing or blocking essential storage may sign you out or prevent features from working.

Our websites load Umami Cloud for visit and interaction statistics. Umami does not use tracking cookies. Requests transmit your IP address and browser information; Umami uses them to derive visit identifiers and approximate location and, according to its documentation, does not store the raw IP address. We do not send your app account identifier to Umami or use advertising pixels.

Cookieless technology can still fall under local rules on accessing or storing information on a device. Where those rules require consent, a GDPR legitimate interest does not replace it. Exemptions for essential functionality or limited statistical uses depend on the applicable law and their specific conditions. Merely visiting the website or reading this policy is not consent to optional tracking.

Contact us to object to analytics as explained in section 7. We do not currently change processing in response to the older browser “Do Not Track” signal. We do not authorise third parties to use our services to track you across unrelated websites or apps for advertising. GPC is explained separately in section 8.

Request deletion under Settings → Account → Delete account, or contact [email protected]. Once you confirm deletion in the current flow, we start permanent removal without a cancellation period. Failed provider operations are retried, and we email you when the deletion process is complete. Earlier requests made through a flow promising 30 days to cancel keep their original deadline.

Deletion covers your account and records in our active systems, uploaded files and account-linked analytics, with provider cleanup as applicable. The retention exceptions and backup handling in section 6 still apply. Export records you need before confirming, including records you must keep under agricultural or other laws in your country.

Cancel App Store subscriptions in your Apple subscription settings. Our deletion process cancels supported Google Play and Stripe subscriptions; check your store or payment account to confirm the status. Uninstalling the app alone does not delete your account or cancel a subscription.

Account deletion instructions

Camera, photo, location and notification permissions are optional and can be changed in your device settings. Denying a permission limits the feature that needs it. Withdrawing permission does not itself delete photos or locations already saved; remove those records or request deletion separately.

We use safeguards including encrypted HTTPS connections, password hashing through our authentication provider, access controls, separation of users’ records and backups. No system guarantees absolute security. Keep sign-in details private and contact us if you suspect unauthorised access.

The service is designed for farmers and growers and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has supplied information, contact us so we can investigate and take appropriate steps to remove it. This does not override higher age or parental-consent requirements under applicable local law.

We publish the current policy on this page and show its last updated date at the top. We bring material changes affecting how we process information or your rights to your attention through an appropriate channel, such as an in-app notice or email, with the advance notice required by applicable law.

If we intend to use information for a new purpose, we will tell you before that processing starts. Where your consent is required, we will ask for it separately; a policy update alone does not provide consent. For questions about this policy or an earlier version, contact [email protected].