Privacy Policy

Account

Your email address and, depending on how you sign up, the name Apple or Google provides and, for Google, your profile picture. If you sign up with an email and password, Supabase Auth stores the password hashed; we never see it. We keep a log of each sign-in (the method and the time).

Profile

Your display name, handle, bio, the photos you upload, and the optional location text you provide. See “Who can see what” above.

Plants and farms

The plants, seed packets, trays and garden beds you record, and their care, harvest and problem logs. If you run a farm, its details, including its ZIP code, pickup windows and addresses, prices, and payment instructions.

Orders

When you reserve plants: what you reserved, the prices shown, your pickup time, and whether the grower has marked the order paid. We never handle the payment itself.

Community and safety

Posts, comments, reactions, and the gardeners and farms you follow. Reports you file, users you block, any moderation action taken on your account, and plant misidentification reports (which can include a photo).

Photos

Our web and iOS apps re-encode photos on upload, which strips EXIF metadata such as GPS coordinates, camera model and timestamps. Animated GIFs uploaded on the website are stored as-is. Some small photos uploaded from the website before October 28, 2026 may still carry their original metadata; email us and we’ll remove any you point us to. Photos are stored at unguessable web addresses, but anyone who has a photo’s link can open it.

AI Diagnose photos

If you use AI Diagnose, the photo you submit is sent to OpenRouter, which passes it to an AI model provider to generate the suggestion. Photos are stored privately (only you and site administrators can view them) and are never published to your farm’s public page or the community feed. They are deleted along with the rest of your data if you delete your account. The suggestion is a guess from a single photo, not professional advice.

Notifications

If you allow push notifications in the iOS app, we store your device’s push token and model name, plus delivery records so we can tell whether notifications arrive. We also keep your notification settings, your in-app notifications, and the badges you earn.

Email

We send account, order and farm emails through Resend. When you follow a farm, you’ll get its announcements, and the weekly community digest is on by default. You can turn either off in your email settings, or with one click from any of those emails. Resend tells us whether each email was delivered, bounced or marked as spam, and we keep those records for troubleshooting. If a farm invites someone who doesn’t have an account yet, we store the invited email address to send the invitation. Messages sent through the support form are emailed to us and not stored in our database.

Abuse prevention

To limit abuse of the support form, we store your IP address in hashed form rather than as plain text, and we usually delete it within a couple of days.

Analytics

Vercel Analytics counts page views anonymously and without cookies. We don’t use advertising or tracking cookies.

On your device

The website uses a few cookies and browser-storage entries, listed on our Cookie Policy. The iOS app uses no cookies. It keeps your sign-in session in encrypted on-device storage and caches recently viewed data so it works offline.

Details are on our Cookie Policy.

Veggie Exchange relies on a small number of providers to run the service:

• Supabase: database, authentication, file storage
• Vercel: web hosting, anonymous analytics
• Resend: email delivery
• Expo: push notifications (each notification’s title and text passes through Expo to Apple’s push service) and iOS app updates
• OpenRouter: AI plant-health suggestions (only for photos you submit to AI Diagnose)
• Open-Meteo: local weather for farms. It receives the farm’s ZIP code, not who you are.
• Apple & Google: sign-in (only when you choose them). A Google profile picture loads directly from Google’s servers; Apple doesn’t provide one.

Your use of these providers is also subject to their own privacy policies.

Veggie Exchange is not for children under 13. We don’t knowingly collect data from anyone under 13. If you believe a child has created an account, please email us and we’ll remove it.

You can, at any time:

• View and edit your profile from your profile page.
• Turn off farm announcements and the weekly digest in your settings, or with the one-click link in any of those emails.
• Delete your account from Account Settings on the website, or in the iOS app under Profile → Settings → Edit profile → Delete account. You may be asked to sign in again first.

If you own a farm, delete it before deleting your account. Deleting your account removes your profile, photos, posts, comments, plant records and orders. Some records are kept afterwards: moderation records and AI Diagnose usage logs, with your identity removed; a farm’s activity history of orders and community posts, which is no longer linked to your account but can still show your name, a post’s title and the start of its text; and the email delivery records described above, which include your email address. Copies may also persist briefly in backups before being purged.

We use industry-standard practices (TLS in transit, encryption at rest via our hosting providers). No system is perfectly secure; if you discover a vulnerability, please email us before disclosing it publicly.

We may update this policy from time to time. Material changes will be highlighted; the “Last updated” date at the top tells you when.

Questions about privacy? Email support@veggie-exchange.com.