Privacy Policy

When you create an account, we collect your email address, name, and password hash. During onboarding, we collect your property address, grass type, USDA hardiness zone, and estimated lawn area to personalize your lawn care experience.

When you use the scan feature, we process lawn photographs you upload. These images are sent to our AI analysis provider (Anthropic) for diagnosis and are not stored permanently on third-party servers after processing. Scan results, health scores, and diagnostic data are stored in your account.

We collect standard usage data including pages visited, features used, device type, and browser information through Google Analytics (measurement ID: G-7H9LVWMH84). This data is aggregated and does not personally identify you.

We use your property information to generate personalized lawn care plans, product recommendations, and seasonal task schedules tailored to your specific soil, climate, and grass type.

Lawn scan images are analyzed by artificial intelligence to diagnose conditions, score lawn health, and recommend treatments. Your scan history is retained to track progress over time and provide comparative analysis.

We use your email address to send account notifications, seasonal reminders, and service updates. You may manage notification preferences at any time through your account settings.

Usage analytics help us understand how people use Grasslytics so we can improve the product. We do not use this data to build individual user profiles for advertising purposes.

Your data is stored on Supabase, a SOC 2 Type II compliant database platform hosted on Amazon Web Services (AWS) infrastructure located in the United States. All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption.

We implement row-level security (RLS) policies at the database level, ensuring each user may only access their own data. Authentication is handled through industry-standard protocols including bcrypt password hashing and OAuth 2.0 for third-party sign-in providers.

Our application enforces security headers including X-Frame-Options, X-Content-Type-Options, referrer policy controls, and content security policies. API endpoints are rate-limited to prevent abuse.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use the following third-party services to operate Grasslytics. Each service provider maintains their own privacy policy and data handling practices. We share only the minimum data necessary for each service to function.

Supabase — database hosting and user authentication. Anthropic — AI analysis engine for lawn scans, soil test interpretation, and expert chat. Google Analytics — aggregated usage analytics. Vercel — application hosting and content delivery. Open-Meteo — weather data (no personal data is shared with this service). Stripe — payment processing for Pro subscribers (Stripe handles all payment information directly; we do not store credit card details).

You may access, update, or delete your personal information at any time through your account settings page. You may request a complete export of your data by submitting a request through our contact page.

You may delete your account at any time, which will permanently remove all associated data — including scan history, journal entries, soil test results, task completions, and profile information — within thirty (30) calendar days of the request.

You may opt out of non-essential email communications through your notification settings. You may disable Google Analytics tracking by using a browser extension such as the Google Analytics Opt-out Add-on, or by enabling the Do Not Track setting in your browser.

If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what data we collect and the right to request deletion. If you are a resident of the European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, and data portability.

We use a single first-party cookie (grasslytics_consent) to record your acceptance of this privacy policy. This cookie expires after one (1) year.

Google Analytics sets its own cookies to collect aggregated usage data. You may manage or block these cookies through your browser settings without affecting your ability to use Grasslytics.

We do not use cookies for advertising, retargeting, or cross-site tracking.

Grasslytics is not intended for use by anyone under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us immediately.

We retain your account data for as long as your account is active. Scan images are processed in memory and are not permanently stored on our servers after analysis is complete; only the resulting diagnostic data is retained.

If you delete your account, all associated data will be permanently removed within thirty (30) calendar days. Aggregated, anonymized analytics data that cannot be traced back to an individual may be retained indefinitely.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date at the top.

Your continued use of Grasslytics after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this privacy policy or your personal data, please reach out through our contact page. We aim to respond to all privacy-related inquiries within five (5) business days.