Privacy Policy

What this policy covers

This policy covers the public UCFarms website, including the Nutrient Atlas, My Farm (where you can tell us which crops you are interested in) and the contact form. It does not yet cover accounts, orders, payments or personal nutrition profiles, because the site does not offer them. If we add any of those, we will update this policy first and say what changed.

The short version

Most of this site asks nothing of you. The two places that collect personal details are My Farm and the contact form. We use what you give us to follow up about your interest, to plan what to grow and where, and to reply to your questions. We do not sell it, use it for advertising, or sign you up for marketing messages.

What we collect

My Farm

When you build a My Farm request and choose Submit interest, we receive:

• who the request is for: a household, restaurant, retailer or organization, and for a business its name;
• the crops you chose, with sizes, package counts or custom amounts, how often, and anything you wrote under “Discuss quantities”;
• your name, your email address and/or phone number (at least one), and your ZIP code;
• identifiers that keep your request straight: a random submission key and a random request context with a secret token created in your browser, a per attempt identifier, a numbering of your updates, and a fingerprint (a one way hash) of the request contents. These let an interrupted or repeated submission be recognized instead of recorded twice, and let you update your own request from the same browser tab.

Submitting My Farm expresses interest. It does not place an order, require payment, reserve produce, guarantee availability or create an account. My Farm does not ask for payment details or health information, and we ask you not to include them in a free text note.

Contact form and email

The contact form asks for your name, your email address and your message. We use them to reply to you. Please do not include sensitive personal information, such as health, financial or government identification details, in a message. If you email us directly, we hold what you send us as ordinary correspondence.

Technical information

Like any website, ours receives technical information from your browser when it loads a page or submits a form: your network address, the page requested, the browser type and the time. Our hosting provider records this in standard server logs for a limited time to run and protect the service. To slow down abuse, our form endpoints count recent submissions per network address for ten minutes in server memory; those counts are not written to a database. Our own application logs record whether a submission succeeded, its reference and how many crops or characters it contained, never your name, contact details or message.

Why we use it

• to respond to your interest or your question;
• to plan which crops to grow, in what amounts, and which areas to serve first, using ZIP codes and crop choices;
• to keep submissions accurate, for example so that an update replaces your earlier request instead of adding to it;
• to troubleshoot problems and to protect the site from spam and abuse;
• to meet legal obligations and to handle a dispute if one arises.

We also look at crop interest in total, without names or contact details attached, on a password protected internal dashboard for UCFarms staff. Any demand summary we publish will show totals only and will never expose a name, contact detail or an individual’s selections.

What we do not do

• We do not sell or rent your contact details.
• We do not let advertisers use them for their own marketing, and we do not use your submissions for targeted advertising.
• We do not automatically enroll you in promotional email or text messages. Follow up about your My Farm interest is about that interest.
• We do not use your My Farm or contact details for a new, unrelated purpose without telling you first.

Where it is kept and who helps us keep it

Airtable stores submitted My Farm requests in a private database that UCFarms controls. Upstash Redis, provided through our hosting platform, keeps a small coordination record for each submission for up to 90 days: the submission key, the request context identifier, a hash of its secret token, the customer type, the time the submission was first seen, its update number, the stored record identifier, and a fingerprint derived from your contact details and crop choices. That fingerprint is a one way hash; it is not your name, email, phone number or ZIP code, and none of those raw details are kept in the coordination record. Vercel hosts the website and keeps the standard server logs described above.

The contact form is not open yet; email reaches us directly. Our business email is hosted by Google.

These providers process the information on our behalf, under their service terms with us, so that the site can work. We may also disclose information when the law requires it, to protect the site or our rights, or to handle a dispute. Beyond that we do not share your details with other organizations.

Your draft stays in this browser tab

While you complete My Farm, your draft, including contact details you enter, is saved in this browser tab’s session storage, on your device only, so a refresh does not lose it. Nothing is sent to us until you press Submit interest. If a submission fails, your entries stay so you can try again. After a confirmed submission, the saved draft keeps only your selections and your reference, so you can still update the request. Your contact details are no longer saved; they stay on the open page only until you leave or refresh it.

The Clear my form control in My Farm removes the whole draft, including contact details and any earlier versions saved by this site, from this browser tab. It does not delete a submission that has already been sent; for that, use the privacy request process below. Closing the tab usually discards the draft too, but some browsers can restore a closed tab, so on a shared device use Clear my form or clear this site’s data in your browser settings.

The contact form keeps nothing in your browser between visits.

Cookies, analytics and tracking

The site itself sets no cookies and runs no advertising, analytics or social media tracking scripts. Fonts and images are served from our own site, so viewing a page does not send your activity to a fonts or image provider. There are no embedded third party players or widgets. A password protected internal area used by UCFarms staff is not part of the public site. If we ever add measurement or embedded content, we will say so here first.

How long we keep it

We keep identifiable My Farm records (the customer record, the request, its crop lines, its update history and any export we make of them) for up to 12 months after your last submission or your last conversation with us about your interest. After that we delete the record or remove the details that identify you, keeping only totals. Simply visiting the site does not restart that period. Contact form messages and emails are kept as ordinary business correspondence for as long as we need them to deal with your question and any follow up.

We may keep a record longer only where we must: to meet a legal obligation, to investigate a security incident, or while a dispute is unresolved. Our providers keep their own logs and backups for a limited time under their own schedules; a deleted record may remain in a backup until that backup expires, and we cannot promise immediate removal from backups.

How we protect it

Access is limited to the UCFarms staff and providers who need it to do the work described here. Credentials for our storage and email services are kept on the server and never sent to your browser. We keep contact details out of application logs, page addresses, public dashboards, screenshots and test data, and we use made up details when we test the site. No system is perfectly secure, so we cannot promise absolute security, but we take reasonable care, and if a problem affects your information we will tell you as the law requires.

Your choices and requests

You can ask us at any time to show you the details we hold about you, to send you a copy, to correct them, to delete them, or to stop following up about your interest. Email urbancontainerfarmers@gmail.com with the subject line “Privacy request”. You do not need an account to ask. Quote the reference from your confirmation if you still have it; it helps us find the record.

We will ask only for enough information to find your record and to be reasonably sure the request comes from you, such as the email address or phone number used on the submission. We do not ask for identity documents unless a request cannot be verified any other way.

We aim to respond within 45 days, or sooner where the law where you live sets a shorter deadline. If a request is complex or we receive many at once, we may take up to a further 45 days and will tell you why before the first period ends. If we decline a request, for example because we cannot verify it or because the law requires us to keep the record, we will explain the reason. You may appeal a decision by replying to our response; we aim to answer an appeal within 45 days. Where the law where you live provides a right to complain to a regulator, we will tell you how in our response.

Children

My Farm and the contact form are intended for adults acting for a household or a business. We do not knowingly collect details from anyone under 18, and the site does not collect youth program or health records. If you believe a child has submitted a request, or a submission was made by mistake, email urbancontainerfarmers@gmail.com with the subject line “Privacy request” and we will delete it.

Future features

UCFarms is building more than this site offers today, including personal nutrition tools. Before any feature collects new kinds of information, we will assess it, update this policy and tell you what is new. We will not reuse My Farm interest records for a sensitive new purpose without that review and notice.

Changes to this policy

When this policy changes, we update the revision date above and, for a material change, we post a notice on this site before the change takes effect. Questions about this policy can be sent to urbancontainerfarmers@gmail.com, or through the Contact page.