Privacy Policy

1. What Personal Information We Collect

Location (visitors)

Browsing the map does not require your location. If you use the optional visitor check-in on a farm card, we ask your browser for a one-time (or short-lived) position only after you choose to continue on that screen — so we can confirm you are within about 150 metres of the stand. That keeps reports useful and reduces drive-by or remote guesses.

The map also has a separate "find my location" control (a standard map button). If you tap it, your browser may ask for permission for that feature only — we do not use it for anything except centering the map where you allow.

You can refuse location or turn it off later in your browser: use the site settings for this page (often a lock or "site information" icon beside the address bar), then clear or change location permissions for our site. We do not sell location data.

Phone number (farm owners only)

Farm owners who register their stand provide a phone number shown on the public map for customers. Optionally, you may add a second number (for example a personal cell) used only for admin and tech-support texts from our team — approvals, reminders, and transactional messages — not displayed on the map. Numbers are used solely to send optional SMS prompts asking what's currently available at their stand (governed by Canada's Anti-Spam Legislation / CASL). Farm owners may opt out of SMS at any time by replying STOP. If you opt in when joining, we may also send one text message when your stand is approved, with a link to manage your listing on your own device.

Email address (farm owners only)

If you provide an email address with your listing, we use it only for directory-related communication. If you opt in when joining, we may send one email when your stand is approved, including your private link to update the listing. We do not sell your email or use it for unrelated marketing.

Photos (farm owners only)

Farm owners may upload photos of their stand. With your permission, we access your device camera or photo library to capture or select an image. Uploaded photos are stored publicly and displayed on the farm listing.

Push notification tokens

If you opt in to push notifications, we store a device token (a random identifier issued by Apple or Google) in our database. This token is used only to deliver notifications you have requested. Tokens do not identify you personally. You may withdraw consent at any time in your device settings.

Visitor text alerts (optional)

If you choose to receive SMS updates about a stand or about new listings for a crop, we store your phone number until you opt out. We send a confirmation link by text before any alerts. Alert texts may include a link to stop only that stand or only the crop alerts named in that message. Replying STOP cancels all visitor text alerts for your phone number at once. This feature is only active when enabled on our service.

Weekly digest email (optional)

If you sign up on the digest page, we store your email address until you unsubscribe. We send a confirmation link by email (double opt-in) before any digest messages. You may receive occasional updates about the map and local food news — not daily mail. We do not sell mailing-list data. To withdraw consent or ask questions, use the contact information in Contact & complaints.

Anonymous usage analytics

We collect anonymous, aggregated usage events (e.g. map viewed, farm card opened) using a self-hosted analytics system. To understand traffic quality (e.g. mobile vs desktop), we may record coarse labels such as device type, browser family, and operating system derived in the browser — we do not store your full browser user-agent string. No personally identifiable information is attached. No third-party advertising or behavioural tracking SDKs are used. The analytics session identifier is created in memory for each page load and is not stored as a cookie (see Cookies and similar technologies).

Visitor check-ins

When you submit a check-in, we store which stand you reported on, the approximate coordinates your device sent at submit time (to verify you were near the farm), whether you said the stand looked open, any crop tags you pick, a timestamp, and a random session id for this visit (in memory for the page, not a cookie) — not your name, account, or advertising id. That data is used only to update community signals (e.g. freshness hints) and is not displayed as a public profile of you.

2. Cookies and similar technologies

For typical visitors, GRIT uses first-party cookies only as described below. We do not use third-party advertising cookies or cross-site behavioural tracking. You can delete or block cookies in your browser settings; blocking the join-form cookie may change how consistently we can show the same form layout when you return.

Other storage: Besides cookies, we may use your browser's session storagefor short-lived flags (for example whether we already recorded a one-time "installed app" analytics event in this tab). Session storage is cleared when you close the tab.

Optional Auth0 sign-in: If Auth0 login is enabled on a route, Auth0 sets its own session cookies to complete sign-in and sign-out. Those cookies are described in Auth0's privacy and compliance documentation. Typical visitors browsing the public map do not use Auth0.

3. Use of Artificial Intelligence

GRIT uses AI systems in the following limited ways:

• SMS photo crop hints:If a farm owner sends a photo by SMS, we may send the image to a third-party AI vision service (OpenRouter / Google Gemini) only to suggest crop or product names for tagging. We do not use AI to reject or remove photos based on how "farm-related" they look — owners control what is published. The image is processed for this purpose only and is not used to train AI models.
• Crop icon generation: When a farm owner adds a crop not already in our library, we use an AI image generation service (OpenAI) to create a representative icon. No personal information is submitted to this service — only the crop name.

AI is not used to make any consequential automated decisions about individuals. No profiling, scoring, or targeting of users takes place.

4. Where Your Data Is Stored

GRIT relies on the following third-party services. By using the app, you acknowledge that your information may be transferred to and processed in the United States and other jurisdictions outside Canada. We ensure each provider maintains appropriate data protection safeguards.

5. Purpose and Legal Basis

Under PIPEDA, we collect only the minimum information necessary for the following identified purposes:

• Displaying farm stands on the map and providing directions
• Allowing farm owners to update their listings and communicate availability
• Delivering push notifications you have explicitly opted into
• Optional AI-assisted crop suggestions for photos sent by SMS
• Improving the app through anonymous, aggregated analytics

We do not use your information for any other purpose without your explicit consent.

6. Consent

By using the app, you consent to the collection and use of your information as described in this policy. Consent for device locationis optional: we only request it when you start the visitor check-in flow, and you can refuse or revoke it in your browser's site settings anytime. Push notification consent is requested when you opt in to those alerts. Farm owners who register their stand provide express consent to receiving SMS messages.

7. Disclosure

We do not sell, rent, or trade your personal information. We may disclose information only:

• To the third-party service providers listed above, for the stated purposes
• If required by law, court order, or government authority
• To protect the safety of users or the integrity of the platform

8. Retention

Farm listing data is retained while the farm is active. Push notification tokens are automatically removed when they expire or are cancelled. Anonymous analytics are retained in aggregated form indefinitely. Farm owner phone numbers (public listing and optional admin contact line for SMS) are retained while the listing is active and deleted upon request. You may request deletion of any personal information we hold about you (see Section 10).

9. Security

We use industry-standard security measures including encrypted connections (TLS), access-controlled databases, and role-based permissions. However, no transmission over the internet is completely secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

10. Your Rights Under PIPEDA

You have the right to:

• Access — request a copy of personal information we hold about you
• Correct — request correction of inaccurate information
• Withdraw consent — for any use of your personal information
• Delete — request deletion of your personal information
• Challenge compliance — file a complaint with the Office of the Privacy Commissioner of Canada

We will respond to all access and correction requests within 30 days as required by PIPEDA. Contact us at support@growninthecounty.ca. If you connect a Facebook Page or Instagram professional account to your listing and want Meta-related data removed, see Facebook & Instagram data deletion.

11. Children's Privacy

GRIT is not directed at children under 13 and does not knowingly collect personal information from them.

12. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. Material changes will be noted with a revised effective date. Continued use of the app constitutes acceptance of the updated policy.

13. Contact & Complaints

For privacy inquiries or to exercise your rights, contact our Privacy Officer:

Grown in the County / GRIT
Prince Edward County, Ontario, Canada
support@growninthecounty.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.