Privacy Policy

This Privacy Policy explains how Croft & Covey ("we," "us," or "our") collects, uses, stores, and shares information when you use the Homestead Tracker application ("Service") at app.croftandcovey.com. By using the Service, you agree to the practices described in this policy.

We take your privacy seriously. Homestead Tracker stores personal and operational records about your homestead. We collect only what is necessary to provide the Service and do not sell your data.

1. Information We Collect

1.1 Account Information

When you register, we collect:

• Your email address
• A securely hashed password (we never store your password in plain text)
• Your subscription tier and billing status

1.2 Farm Profile Information

To provide location-specific features such as frost date lookups and grow zone data, you may provide:

• Farm or homestead name
• City or general location
• Zip code (used to look up frost dates and grow zone from publicly available USDA data)

1.3 Homestead Records

The core function of the Service is to store the operational records you enter, including:

• Garden: bed names, planting records, crop varieties, sow and harvest dates, harvest weights, store price comparisons, and growing notes
• Quail: batch records, milestone dates, hatch and mortality statistics, egg and meat harvest logs, and market price snapshots
• Rabbits: animal profiles, breeding records, litter results, weight logs, pedigree data, and harvest records
• Tasks: to-do items with due dates and completion status

1.4 Billing Information

If you subscribe to a paid plan, payment is processed by Stripe. We do not receive or store your full credit card number. We store only the Stripe customer ID and your subscription status. Stripe's privacy policy governs how your payment data is handled.

1.5 Usage and Technical Data

We may automatically collect limited technical data to operate and improve the Service, including:

• IP address and general geographic region
• Browser type and device type
• Pages visited and features used within the Service
• Error logs and performance data

This data is collected in aggregate and is not linked to individual homestead records.

2. How We Use Your Information

We use the information we collect solely to provide and improve the Service:

• To authenticate your account and maintain your session
• To store and retrieve your homestead records on your behalf
• To calculate suggested sow dates, frost-relative planting timelines, and milestone schedules
• To process subscription payments and manage your billing status
• To send account-related emails such as registration confirmation, password reset, and billing notices
• To provide optional features such as iCal calendar feed subscriptions
• To troubleshoot errors and improve Service reliability

We do not use your homestead records for advertising, profiling, or any purpose other than providing the Service to you.

3. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Railway's infrastructure in the United States. We implement reasonable technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Authentication via Supabase, which uses industry-standard JWT tokens
• Database access restricted to the application server — no public database exposure
• Automated nightly database backups retained for 14 days

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions and will notify you in the event of a data breach as required by applicable law.

4. Third-Party Service Providers

We share data with the following third-party providers strictly to operate the Service. We do not sell data to any third party.

Supabase

Supabase provides authentication services. Your email address and hashed password are processed through Supabase. Supabase is SOC 2 Type II compliant. See their privacy policy at supabase.com/privacy.

Stripe

Stripe processes subscription payments. Your payment card information is transmitted directly to Stripe and is never stored on our servers. See their privacy policy at stripe.com/privacy.

Resend

Resend delivers transactional emails (registration confirmation, password reset). Your email address is shared with Resend solely to deliver these messages. See their privacy policy at resend.com/legal/privacy-policy.

Railway

Railway hosts the application server and database. Your data at rest resides on Railway's infrastructure. See their privacy policy at railway.app/legal/privacy.

Cloudflare

Cloudflare provides DNS and CDN services for croftandcovey.com. Cloudflare may process your IP address and request metadata as part of normal DNS and routing operations. See their privacy policy at cloudflare.com/privacypolicy.

5. Data Retention

We retain your account and homestead data for as long as your account is active. If you delete your account:

• We will delete your personal information and homestead records within 30 days
• Anonymized or aggregated usage statistics may be retained
• Billing records may be retained as required by law or for tax purposes

You may request an export of your data at any time by contacting us at info@croftandcovey.com before deleting your account.

6. Your Rights and Choices

Access and Portability

You may request a copy of the personal data we hold about you. Much of your homestead data is directly accessible and exportable via the Service itself (CSV export for paid subscribers).

Correction

You may update your account information at any time within the Service or by contacting us.

Deletion

You may request deletion of your account and all associated data by contacting us at info@croftandcovey.com. We will process deletion requests within 30 days.

Opt-Out of Non-Essential Communications

We only send transactional emails necessary to operate your account (confirmations, password resets, billing notices). We do not send marketing emails without your explicit consent. You may unsubscribe from any marketing communications via the unsubscribe link in those emails.

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. For CCPA inquiries, contact us at info@croftandcovey.com.

7. Cookies and Local Storage

The Service uses browser storage (localStorage and sessionStorage) to maintain your authenticated session between page loads. We do not use third-party tracking cookies or advertising cookies. If we add analytics in the future, we will update this policy and provide appropriate notice.

8. Children's Privacy

The Service is intended for users 18 years of age or older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at info@croftandcovey.com and we will promptly delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by a prominent notice within the Service, and we will update the "Last Updated" date at the top of this document. Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Croft & Covey
Email: info@croftandcovey.com
Website: croftandcovey.com
Mailing Address: 6701 Corporate Dr Ste N, Johnston, Polk County, IA 50131 US