Privacy Policy

Who we are

PlantHarvester is run by General Applications LLC ("we", "us"). This policy explains what personal information we collect, why, who we share it with, and the choices you have. Questions go to [email protected].

What we collect

• Account: your name, email address, and a secure one-way hash of your password (never the password itself). If you sign in with Google, we receive your name, email and Google account ID.
• Farms: a farm's name and description, its pickup locations (address and map coordinates), the hours it keeps and whether it delivers, listings and harvests, and who its members are.
• Orders: what was bought, quantities and amounts, the pickup location, the pickup or delivery time you chose and your note, and each order's status. For a delivery, the address you give and where it is on the map.
• Messages and reports: messages between a buyer and a farm about an order, and reports sent to our staff.
• Agreements: which version of these policies and terms you accepted, and when.
• Technical: a session cookie that keeps you signed in, and your IP address, which we hold briefly in memory to limit abuse such as repeated sign-in attempts. Our hosting provider may keep standard server logs.

We do not receive your card number: payment details go straight to Stripe. When you use "Use my location" on the Market, your browser shares your position for that search only; we use it to find nearby farms and do not store it.

How we use it

To run your account and the Market; to process orders and payments; to send the emails the service needs (verifying your address, order confirmations, cancellations, messages); to keep PlantHarvester safe, investigate reports and prevent fraud; to meet legal, tax and accounting obligations; and to fix and improve the service. We do not sell personal information, and we do not use advertising trackers or share your information for advertising.

Who can see what

• Public: a farm's name, description, listings and the town and state of its pickup locations.
• On an order: the farm sees your display name, what you ordered, the time you chose and your note, and your messages. For a delivery, the farm sees the address you gave once you have paid, and not before. After you pay, you see the farm's pickup address. Neither side sees the other's email address.
• Our staff: accounts, farms, orders, messages and reports, when needed to run and protect the service.

Service providers

We share information with companies that run parts of PlantHarvester for us, only as needed:

• Stripe: payments, farm identity and payout verification, and tax forms for farms.
• SendGrid, part of Twilio: delivering email.
• DigitalOcean: hosting and our database.
• Google: sign-in, if you choose it, and address suggestions when a farm adds a pickup location or you type a delivery address. When a farm opens directions to a delivery, its device sends that address to Google Maps.
• U.S. Census Bureau: finding an address on the map. We send the address alone, without your name or account.

We may also share information when the law requires it, to protect someone's safety, or as part of a sale or reorganisation of our business, which would keep this policy's protections.

How long we keep it

Account and farm information while the account exists. Orders and payment records for as long as tax and accounting law require, usually seven years. Messages and reports with the order or farm they belong to. When an account is deleted we remove your profile and sign-in details; records we must keep for legal reasons stay, linked to the order rather than your profile where we can.

Your choices

You can see and change your name and password on your Account page. To get a copy of your information, or have it corrected or deleted, email [email protected] from your account's address; we will answer within 30 days. If your state gives you further privacy rights, we will honour them.

Cookies and local storage

One essential cookie keeps you signed in. Your browser also stores your theme and colour choice on your own device. We use no advertising or analytics cookies.

Children

PlantHarvester is not meant for children under 13, and accounts are for people 18 and over. If you think a child has given us information, tell us and we will delete it.

Security

Connections are encrypted, passwords are hashed, and access to personal information is limited to what running the service needs. No system is perfectly secure; tell us at once if you suspect a problem with your account.

Changes

When this policy changes, its date and version change, and for a significant change we will tell you by email or on the site.