Privacy Policy

1. Information We Collect

We collect only the information needed to operate the Service, map your yard zones, and personalize your agronomic recommendations:

• Account & Authentication Data: Email address, display name, and a hashed password (or OAuth identifier when you sign in via Google Sign-In).
• Property & Yard Profile Data: Street address or ZIP code entered during property setup, latitude/longitude coordinates, lot/zone square footage, GeoJSON zone polygons, grass cultivar, sun exposure, soil profile, and configured care scopes.
• Diagnostic Photos & Community Posts: Photographs of turf, plants, weeds, or pests you upload for AI diagnosis, copilot chat messages, and any posts or comments you voluntarily share to Community Turf Watch.
• Wallet & Billing Metadata: Diagnostic credit balance, transaction ledger entries, subscription tier, and payment metadata (such as card brand and last 4 digits) returned by our payment processor. We never see, process, or store your full credit card number.
• Device & Security Telemetry: IP address, browser/OS user-agent, and request logs used strictly for security, fraud prevention, and rate-limiting.

2. How We Use Your Information

• Operate the Service, calculate parcel/zone square footages, and generate localized seasonal checklists, weather/soil advisories, and Vision AI diagnoses.
• Process Pro subscriptions and credit purchases and maintain an accurate credit ledger.
• Send transactional emails such as beta access invitations, account verification, and billing receipts.
• Maintain platform security, prevent abuse, and comply with legal obligations.

We do not sell or rent your personal information to data brokers or advertisers, and we do not use your uploaded yard photographs to train third-party foundation AI models.

3. Infrastructure Subprocessors & External Data Services

Smart Yard Yap relies on vetted infrastructure providers and public geospatial/weather APIs to deliver the Service:

• Supabase, Inc. — Managed PostgreSQL database, user authentication, and encrypted-at-rest object storage for diagnostic photographs, protected by per-user Row-Level Security (RLS) policies.
• Cloudflare, Inc. — Global edge hosting (Cloudflare Pages), TLS encryption in transit, DDoS mitigation, and DNS delivery.
• Stripe, Inc. — PCI-DSS Level 1 compliant payment processing for subscriptions and credit purchases.
• OpenRouter, Inc. — Secure TLS API routing for vision diagnostic and agronomic coaching inference (`meta-llama` models). Prompts and images are processed solely to return your diagnostic response and are not retained to train models.
• Resend, Inc. — Delivery of transactional system emails (beta approvals, account notifications).
• Geospatial, Aerial & Meteorological Lookup APIs: When you scan a property address or load weather telemetry, your property coordinates or ZIP code are queried against public GIS and meteorological endpoints (including Open-Meteo for weather and soil forecasts, Esri / ArcGIS, US Census TIGERweb, County CAD GIS servers, Google Aerial Tiles, and phzmapi.org for USDA Hardiness Zones) without transmitting your name, email, or account identity.

4. Cookies & Local Storage

We use strictly necessary first-party cookies and browser localStorage keys to keep you signed in and remember your interface preferences (such as Simple English vs. Expert Agronomy mode and theme settings). Stripe may set security cookies during checkout for fraud detection. We do not run third-party behavioral advertising trackers.

5. Data Retention & Account Deletion

Your account, yard profiles, and diagnostic history are retained while your account is active so you can track seasonal progress. You may delete individual yards, zones, or diagnostic sessions directly within the app at any time. To request complete account and personal data deletion, email [email protected]. We permanently purge personal data within 30 days of a verified deletion request, except for anonymized billing/tax records required by law.

6. Your Privacy Rights (Including California, Texas & US State Laws)

Depending on your jurisdiction (including under the California Consumer Privacy Act / CPRA, the Texas Data Privacy and Security Act / TDPSA, and similar state or international laws), you have the right to:

• Request access to or a portable copy of the personal data we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your account and personal data.
• Opt out of the sale or sharing of personal data for cross-context behavioral advertising (note: Smart Yard Yap does not sell or share your personal data).

To exercise any of these rights without discrimination, contact us at [email protected] or [email protected].

7. Data Security

We protect your data using TLS encryption in transit, AES encryption at rest via Supabase, strict Row-Level Security (RLS) isolating user records, and private signed URLs for diagnostic image buckets. While no internet transmission is 100% immune to risk, we continuously monitor and harden our infrastructure. Please report any suspected security issue to [email protected].

8. Children's Privacy

The Service is intended for homeowners and adults aged 18 and older and is not directed at children under 13. We do not knowingly collect personal information from children under 13.

9. Changes & Contact

We may update this Privacy Policy periodically to reflect new features or regulatory requirements. Material changes will be posted on this page with an updated effective date. Questions or privacy requests may be directed to [email protected].