Privacy Policy

1. What we collect

We only collect information needed to run the Service and improve your lawn recommendations:

• Account data. Email address, display name, and a hashed password (or an OAuth identifier if you sign in with a supported provider).
• Yard profile data. Information you enter about your yard: ZIP code, grass type, square footage, sun exposure, soil profile, and irrigation controller.
• Diagnostic uploads. Photos you upload for AI diagnosis, plus the AI report generated from them.
• Wallet & billing metadata. Token balance, transaction ledger entries, and the last-4 / brand of a card as returned by our payment processor. We never see or store your full card number.
• Device telemetry. IP address, browser / OS user-agent, and basic request logs used for security, abuse prevention, and rate-limiting.

2. How we use it

• Operate the Service and personalize your lawn recommendations.
• Process Token purchases and keep an accurate wallet ledger.
• Send transactional email such as receipts and security alerts.
• Prevent abuse, fraud, and platform misuse.
• Comply with our legal obligations.

We do not sell your personal data and we do not use your diagnostic photos to train third-party foundation models.

3. Subprocessors we use

Smart Yard Yap relies on the following vetted infrastructure subprocessors to deliver the Service. Each one processes only the data listed below on our instructions:

• Stripe, Inc. — payment method information (card token, brand, last 4, billing country) and device telemetry needed for fraud prevention. Card numbers are entered directly into Stripe's PCI-DSS-compliant vault and never touch our servers.
• Lovable Cloud (Supabase-hosted). — account data, yard profiles, wallet ledger, and encrypted-at-rest storage of diagnostic photos. Row-level security policies restrict access to the owning user.
• AI diagnostic providers. — diagnostic photos and the yard context you have chosen are transmitted over TLS to secure AI endpoints strictly to generate localized turf triage data and are not retained by those providers for model training.
• Weather & irrigation integrations — invoked only when you explicitly connect them. We store the minimum credentials required, encrypted at rest, and never share them with other users.

4. Cookies & analytics

We use a small set of first-party cookies and localStorage keys to keep you signed in and remember UI preferences. Payment processing may set cookies scoped to Stripe's domain for fraud detection. We do not run cross-site advertising trackers on the signed-in application.

5. Retention & deletion

Account, yard, and ledger data is retained for as long as your account exists. Diagnostic photos are retained so you can revisit past reports; you can delete an individual photo or an entire yard from the dashboard at any time. When you delete your account (email us at support@smartyardyap.com), we remove personal data within 30 days, except records we are legally required to keep (tax and payment records).

6. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise any of these rights, email support@smartyardyap.com. We will respond within 30 days.

7. Security

We rely on the Lovable Cloud platform for encryption in transit (TLS) and encryption at rest, plus per-user row-level security to isolate accounts. No online service can guarantee perfect security; report suspected vulnerabilities to support@smartyardyap.com and we will investigate promptly.

8. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from children.

9. Changes

We may update this policy from time to time. Material changes will be highlighted on this page and, when appropriate, notified by email.

10. Contact

Privacy questions and data requests should be sent to support@smartyardyap.com.