Privacy Policy

1. Introduction

Butler Technology Concepts, LLC d/b/a Yard Ledger ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, the sources we collect it from, how and why we use it, who we share it with, how long we keep it, and the rights you have over your personal information when you use our websites and mobile apps (the "Service").

The table in Section 4 is a summary "notice at collection": it lists the categories of personal information we collect, their sources, the purposes we use them for, the categories of recipients we disclose them to, and how long we keep each category. The sections that follow add detail.

2. Information We Collect

Categories of sources. We collect personal information from you directly; automatically from your device and browser; from connected services you authorize (such as a personal weather station); from payment platforms; and from analytics and infrastructure providers acting on our behalf.

We collect information you provide directly:

• Account information: email address, name (optional)
• Yard and property data: address, location coordinates, lawn dimensions
• Lawn care event records: dates, products applied, notes, photos
• Documents you upload: receipts, soil-test reports, and product labels, which may include vendor, cost, and product details
• Connected-service credentials: when you link a third-party service such as a personal weather station, the access keys or credentials needed to retrieve that data (stored encrypted)
• Messages, prompts, and photos you submit to the AI assistant
• Ratings you give the app’s recommendations, such as a thumbs up or down on an assistant answer, with any reason or comment you choose to add
• Payment information: subscriptions are processed by our payment providers (Apple App Store, Google Play, RevenueCat, and Stripe). We receive subscription and transaction status — not full payment card numbers
• Usage and preference data: area unit preference, subscription status, and notification preferences
• An email address and ZIP code, if you ask for a seasonal reminder on one of the free tools, or a lawn-care guide or schedule page, without creating an account. This is the one place we hold a contact who has no account with us; Section 11 explains what we store, what we send, and how to stop it

We also collect information automatically:

• Log data: IP address, browser type, pages visited, timestamps
• Device data: device type and operating system
• Mobile push tokens: if you enable notifications in our mobile apps, a device push token used to deliver reminders and alerts
• Cookies, product analytics, and similar tracking technologies (see Section 13)

Sensitive information. Some information we handle — precise geolocation (property coordinates and any GPS coordinates in photo metadata) and your account login credentials — may be treated as "sensitive" under some laws. We use it only to provide and secure the Service (for example, localized guidance, weather, and mapping). We do not sell sensitive information, use it to infer characteristics about you, or use it to profile you in furtherance of decisions that produce legal or similarly significant effects.

3. How We Use Your Information

We use your information to:

• Provide, operate, and improve the Service
• Personalize your experience and deliver relevant features
• Generate lawn care guidance and AI-powered suggestions
• Extract data from documents you upload (receipts, soil tests, and product labels)
• Provide weather context and watering guidance, including from a personal weather station you connect
• Deliver notifications, reminders, and weather-based alerts by email and mobile push
• Process payments and manage your subscription
• Send transactional emails (e.g., account confirmation, password reset)
• Send seasonal yard email, setup and check-in email about your own account, and the seasonal reminders you ask for by email — separate from the transactional and reminder mail above, and each separately controlled (Section 11)
• Maintain security, prevent abuse, and troubleshoot problems
• Comply with legal obligations and enforce our Terms of Service
• Analyze aggregate usage patterns to improve the Service

4. Categories of Information We Collect, Use, and Disclose

This table summarizes, by category, what we collect, where it comes from, why we use it, who we disclose it to, and how long we keep it. "Disclose" here means sharing with service providers that process data on our behalf under contract; it does not mean we sell your information (see Section 12).

5. Data Storage and Security

We host your data with cloud service providers — primarily Supabase (database, auth, storage) — and apply reasonable administrative, technical, and physical safeguards designed to protect personal information. These include Row-Level Security so each user can access only their own data, encryption in transit (TLS), and encryption at rest for sensitive items such as connected-service credentials. Access to personal information is limited to personnel and service providers who need it to operate the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Service Providers and Subprocessors

We do not sell your personal information. We share it only with service providers that process it on our behalf under contract, and where required by law. By category of recipient, and the providers we currently use:

• Cloud hosting, database, auth & storage: Supabase
• Web hosting, content delivery, edge security & bot protection: Cloudflare (including Cloudflare Pages, Web Analytics, and Turnstile)
• AI providers: OpenAI and Anthropic (the assistant and document/photo extraction) and Perplexity (AI-powered web, product, and pesticide-label search)
• Product analytics: PostHog and HeyCatch
• Advertising measurement: Google Ads (conversion tracking for our own ad campaigns)
• Payment processors: Apple App Store, Google Play, RevenueCat, and Stripe (web card payments)
• Email & push delivery: Resend and Supabase (email); Expo, Apple (APNs), and Google (FCM) for mobile push
• Customer support: Zoho Desk
• Maps & geocoding: Mapbox; web fonts via Google Fonts
• Property & environmental data: Regrid (parcel boundaries), USDA/NRCS (soil and hardiness-zone data), Open-Meteo and the U.S. National Weather Service (NOAA), plus any personal weather-station provider you connect (see Section 10)
• Connected sign-in providers: Google and GitHub, if you choose to sign in with them

The providers above are current as of the date of this policy and may change as we add or replace vendors; we will update this policy (or a linked subprocessors list) when that happens.

We may also disclose information:

• To services you connect: when you link a personal weather station or subscribe to your calendar feed, data is exchanged with the provider you chose (see Section 10)
• For legal requirements: when required by law or to protect our rights
• In business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you

7. AI Features and Data Use

Butler Technology Concepts, LLC d/b/a Yard Ledger uses AI models (including third-party AI APIs) to generate lawn care recommendations and to extract data from documents and photos you upload (such as receipts, soil-test reports, product labels, and problem-area photos). Our current AI subprocessors are OpenAI and Anthropic (the assistant and document/photo extraction) and Perplexity (web, product, and pesticide-label lookups). When you use AI features, relevant portions of your lawn data (e.g., grass type, location, recent events) and the documents or photos you submit are sent to these providers to generate a response.

We access these providers through their API/business tiers, under which your inputs and outputs are not used to train their models. Providers may retain content briefly to operate the service and to monitor for abuse or safety, as described in their own terms, and the personal information they receive remains governed by those terms. We do not use your content to train or fine-tune our own models. Before any of your data is sent to an AI provider, we ask you to agree to a disclosure naming the providers and the data shared.

8. Photos and Media

Photos you upload are stored with our cloud storage provider and protected by the safeguards described in Section 5. They are used to help you track your lawn's visual history and, when you request it, for AI-assisted analysis. As with other content, photos may be processed by our storage and AI service providers acting on our behalf (see Sections 6 and 7); we do not otherwise share your photos with third parties.

Photo metadata (EXIF). When you upload a photo on the web app, Yard Ledger may read metadata embedded in the image file by your camera or device. This can include the date and time the photo was taken, camera settings, and — if location services were enabled when the photo was taken — GPS coordinates. We use this to automatically populate event dates and to associate photos with yard locations. EXIF data is stored as part of your event record and is never sold or shared except with service providers acting on our behalf.

Your control. On the web app you can disable photo metadata extraction at any time in Settings → Preferences; when disabled, no EXIF data is read or stored. Our mobile apps do not read location metadata from the photos you capture or attach.

9. Geolocation Data

If you provide location data (address, coordinates) or use geolocation features, we use this information to provide localized lawn care guidance, local weather context, and property mapping features. Precise location is treated as sensitive information (see Section 2); it is protected by the safeguards described in Section 5 and is not sold or shared for advertising.

GPS coordinates embedded in photo EXIF metadata (see Section 8) are treated as geolocation data under this section. On the web app you may opt out of EXIF extraction in Settings → Preferences.

10. Connected Services & Integrations

YardLedger lets you connect optional third-party services. When you do, data is exchanged with the provider you choose:

• Personal weather stations: If you connect a station (Ambient Weather, Ecowitt, WeatherFlow Tempest, Davis WeatherLink, or Netatmo), we store the credentials or authorization tokens needed to access it — encrypted — and retrieve weather readings for your yard. For Netatmo this uses OAuth: you authorize access on Netatmo’s site and we store the resulting tokens (no Netatmo password). Disconnecting a station in Settings removes the stored credentials or tokens.
• Calendar feed: If you enable calendar sync, we generate a private feed link you can subscribe to from Google Calendar, Apple Calendar, Outlook, or another app. Subscribing exports your scheduled care events to that calendar provider. You can refresh or revoke the feed link at any time in Settings.

These third-party services are governed by their own privacy policies. We are not responsible for the privacy practices of services you choose to connect.

11. Emails We Send, and How to Stop Them

We send three different kinds of email, and they are controlled separately. Stopping one does not stop the others, because they are not the same promise: one is the Service working, the other two are us writing to you.

• Service email. Account confirmation, verification codes, password resets, receipts, and the care reminders and yard alerts you switched on in Settings. These follow your account and your notification preferences.
• Seasonal email and reminders. Marketing, in the legal sense: the seasonal yard email that goes to account holders, and the seasonal reminders anyone can ask for by email on our free tools. Every one of them carries an unsubscribe — the one-click button your mail app shows, and a link to a page with a single confirm button — and our postal address.
• Setup and check-in email. Also marketing, in the legal sense, and controlled separately from the seasonal email above — its own toggle, and its own unsubscribe link that stops this and nothing else. It is an occasional message about your own account: help finishing setup after you sign up, a nudge if your log goes quiet during the growing season, and a note if you cancel. Drawn from what you have logged, at most one a month, and carrying an unsubscribe and our postal address just like the seasonal email.

An unsubscribe link in a seasonal or check-in email switches off that email and touches nothing else — it flips a single preference, and it cannot reach your account login, your password resets, or the care reminders you turned on. We built it that way on purpose, and we mention it here because it is the thing most worth knowing before you decide whether to unsubscribe or to mark a message as spam.

If you have an account. The seasonal yard email is a preference on your account, shown to you during setup as a toggle you can decline in one tap, and changeable at any time in Settings → Notifications → Seasonal yard email. Where the law requires an affirmative opt-in rather than a disclosed default — the EU and EEA, the United Kingdom, and Switzerland — the toggle starts off, and we decide which applies from the country on your property or, if you have not given one, your time zone.

The setup and check-in email is a second, independent preference, at Settings → Notifications → Setup and check-in email. It starts off when an account is created.

During setup, we show it beside the seasonal email choice. It starts on only when our supported country or time-zone signals resolve a United States location; it stays off elsewhere and when that location is uncertain. You can change either choice before continuing, and we preserve a choice you already made. We record the setting shown, how its default was decided, and whether you changed it for both email preferences. Switching it off again does not affect the seasonal yard email, and switching that one off does not affect this one — they are separate promises, so they are separate controls.

If you do not have an account. Our free ZIP tools offer a seasonal reminder — a first-freeze warning, a sprinkler blow-out deadline, a pre-emergent window — in exchange for an email address and a ZIP code, with no signup. That is the only place a contact exists here without an account, so it is worth being specific:

• What we store: the email address, the ZIP code, which reminder you asked for, the page you asked from, and the dates we sent things. We look the ZIP code up when you sign up — through keyless public services (phzmapi.org, zippopotam.us) that receive the ZIP code and nothing else — and store the approximate coordinates and the “City, ST” label it returns, so the job that watches the forecast does not have to look it up again every day. If those services are unreachable at that moment we keep the signup anyway, and that job retries the lookup on a later day until it succeeds. A ZIP code is a postal area, not an address: we do not know where in it you live, and we do not ask.
• What we send: a confirmation straight away, and then that one reminder, once per season, each year, until you unsubscribe. Nothing else. These addresses are not a mailing list — there is no way to send a campaign to them, by design.
• How to stop it: the unsubscribe in any of those messages. Your mail app's own unsubscribe button stops it outright, in one click; the link in the message itself opens a page with one confirm button, so that a scanner opening the links in your inbox cannot unsubscribe you by accident. Either way it stops every seasonal reminder for that address, not just the one you clicked from.
• What unsubscribing leaves behind. We do not delete the record; we minimize it. The coordinates, the place label and the page you came from are erased, and what stays is your address, which reminder it was, the ZIP code and the dates — the proof that you asked us to stop and that we did, and the thing that keeps us from mailing you again if the address comes back to us another way. If you would rather it were erased outright, see the deletion note below.
• Changing your mind. The same unsubscribe link will turn the reminders back on. That button is only on that page for a reason: the signup form on our website will not reverse an opt-out, because it cannot tell who is typing, and knowing someone's address should never be enough to restart mail they stopped. Holding the link we sent you is proof enough. If you turn them back on, we keep the date of the opt-out and the date you reversed it.

Deleting a reminder signup. These records are not attached to an account, so there is nothing to delete in the app and no password to prove it is yours. Unsubscribing is what stops the mail and strips the record back to the minimum above. If you want it gone entirely, email us at groundskeeper@yardledger.com from the address in question and we will delete it. If you later create an account with that same address, deleting the account deletes these records with it. One thing we cannot erase on request is a do-not-send entry, below: removing it is what would let the mail start again.

Bounces and complaints. If a message to an address hard-bounces, or someone reports one as spam, we record that address on a suppression list and stop sending to it. That list is how we keep the promise; it is not used for anything else.

12. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights — for example under the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and similar U.S. state privacy laws (such as those in Virginia, Colorado, Connecticut, and Utah):

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where processing is based on consent
• Opt out of the "sale" or "sharing" of personal information (see Section 13)
• Not receive discriminatory treatment for exercising your rights

Some of these rights may not be available in every jurisdiction or may be limited where an exception applies — for example, where we must keep information to comply with a legal obligation, ensure security, or detect and fix errors.

How to exercise your rights. You can delete your account and data at any time in the app (see our deletion instructions), or contact us at groundskeeper@yardledger.com.

Verification. To protect your information, we verify requests using the email address associated with your account and, where needed, by asking you to confirm information we already hold. We will not use information you provide for verification for any other purpose.

If you have no account with us. You may still hold rights over what we can keep without one: a seasonal reminder signup, and — if a message to your address bounced or was reported as spam — that address's entry on our do-not-send list (Section 11). Write to us from that address and we will treat it as your request — the address is the only identifier attached to those records, so it is also what we verify against. The unsubscribe in any of those messages exercises the objection and opt-out rights immediately, without waiting for us. The do-not-send entry is the one record we will ordinarily decline to erase, because erasing it is what would let mail you stopped start again.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written permission and may still ask you to verify your own identity directly.

Timing and appeals. We will respond within the time required by applicable law (generally 30–45 days), and we may extend that period where the law permits, with notice to you. If we decline your request, you may appeal by replying to our decision or emailing groundskeeper@yardledger.com with the subject "Privacy Appeal"; where applicable law provides, you may also contact your local data protection authority or attorney general.

13. Cookies, Analytics & "Do Not Sell or Share"

We use cookies and similar technologies in the following ways:

• Strictly necessary / essential: session and security cookies needed for the Service to function (for example, to keep you signed in). These cannot be turned off through the Service.
• Analytics: we use product-analytics tools (PostHog, HeyCatch, and Cloudflare Web Analytics) to understand how the Service is used — which features are used and where users hit errors — so we can improve it.
• Automatically-captured interactions (HeyCatch): unlike our other analytics, HeyCatch records page views and interactions on the website automatically, rather than only the specific events we choose to send. When you click something, it records the page, the element you clicked, and the visible text on and around it. On signed-in pages that visible text can include content you entered — for example a yard name, a location label, or the beginning of a note — so that content may be sent to HeyCatch as part of the interaction record. It does not capture what you type into form fields before you submit. We do not send your name or email address to HeyCatch as a profile detail, and we take steps to keep parts of the page that display names and email addresses out of this automatic capture — but because the capture is automatic rather than a list of events we choose, we cannot promise that personal information never appears in it. This automatic capture is on the website only; the mobile app records screen names and the events we choose, not your taps or the text on your screen. To turn this off, use Your Privacy Choices below, or send a Global Privacy Control signal from your browser — either one stops HeyCatch from loading. If you opt out part-way through a visit, we immediately stop linking your browsing to your account, and HeyCatch stops loading entirely from your next page load onward. In the mobile app, the same choice is the Share usage analytics switch in Settings: turning it off stops the app sending events to PostHog and HeyCatch, and HeyCatch’s own records of the app opening and closing stop from the next time the app starts. If you make the choice while signed in, on the website or in the app, it is saved to your account and applies on every device once you sign in there, and to the records our servers send (below). If you make it while signed out, it is stored only on that device, and signing in there later applies your account’s saved choice, if it has one, in its place. A Global Privacy Control signal applies only to the browser that sends it and does not change your account setting.
• Records sent from our servers: when your subscription starts, renews, changes or ends, and when our servers act for you — for example sending you a reminder email or finishing your yard setup — they send that fact to our product analytics, linked to your account identifier. These come from our servers rather than from your device, so an ad blocker does not affect them, and they contain no browsing activity, only the fact itself. If you have opted out using the choice above while signed in, they are still counted in PostHog, but only in aggregate: without your account identifier and without building a profile of you. Subscription records are then not sent to HeyCatch at all. A Global Privacy Control signal on its own does not change this, because it is not saved to your account. To have records sent before you opted out removed, email groundskeeper@yardledger.com and we will handle it as an analytics-deletion request (see §14).
• Advertising measurement: we run a small Google Search ad campaign and measure which ads lead to signups. To do this we use Google Ads conversion tracking — the Google tag (gtag.js). When you arrive from one of our ads, Google sets first-party cookies on your device (for example, _gcl_*) to remember the ad click (such as a gclid), and if you later create an account we report that signup to Google Ads as a conversion. We also read the click identifier and any utm_* campaign tags from the URL for the same measurement in our product analytics. We use all of this solely to measure which of our own ads led to signups. For visitors who have not opted out, loading the tag sends Google a measurement signal — the page load and the ad-click cookie — in addition to the later signup conversion; we instruct Google to treat it as non-personalized, and we do not build advertising profiles or audiences, retarget you, or serve personalized ads across other sites. In the iOS app, we ask Apple whether the install came from one of our Apple Search Ads and, if you then create an account on that device, save the answer with your account for the same measurement. Turning off Share usage analytics in the app stops that request, and the answer is not saved.

We do not use cookies or analytics for cross-context behavioral advertising, we do not serve targeted or personalized ads, and we do not sell your personal information, as those terms are defined under California and other U.S. state privacy laws. The limited conversion-measurement reporting described above is used only to gauge the effectiveness of our own ads — not to advertise to you — but depending on your state it may be considered “sharing.” The Your Privacy Choices control below — and the Global Privacy Control browser signal — stop the Google tag from loading on your device, so no measurement or conversion data is sent. You can also email groundskeeper@yardledger.com and we will exclude you from ad-conversion reporting. You can manage personalized Google advertising in Google’s Ad Settings.

You can control cookies through your browser settings; for general information about cookies and how to manage or disable them, visit allaboutcookies.org. You can opt out of non-essential analytics and ad-conversion sharing using the Your Privacy Choices control below (on this device, and on your account when you are signed in) or the Share usage analytics switch in the mobile app’s Settings, or by emailing groundskeeper@yardledger.com. We honor the Global Privacy Control (GPC) browser signal: when your browser sends a GPC signal, we automatically treat you as opted out of non-essential analytics and ad-conversion sharing. Disabling certain cookies may prevent parts of the Service from working.

14. Data Retention

We keep personal information for as long as your account is active or as needed to provide the Service, then delete it as described below. Retention by category is also summarized in the table in Section 4.

• Account and content data (profile, properties, care history, AI chats, uploaded files): kept for the life of your account. We do not automatically purge this data; when you delete your account it is deleted immediately and permanently from our live systems.
• Backups: residual copies in routine, encrypted backups are purged on our normal backup-rotation schedule, no later than 90 days after deletion.
• Operational and security logs (including IP address and rate-limit records): retained for a limited period for security and troubleshooting, then deleted or aggregated.
• Product analytics: analytics events are linked to an identifier for your account while your account is active. When you delete your account, we automatically ask PostHog to delete your analytics profile on a best-effort basis. HeyCatch does not currently offer a deletion API, so we request erasure there manually — email groundskeeper@yardledger.com and we will submit the request on your behalf. Aggregate, de-identified metrics that are not linked to you may remain.
• Billing and subscription records: if you purchased a subscription, our payment processors retain transaction records as required for tax, accounting, and fraud-prevention purposes.
• Support communications: if you contacted support, the related tickets and messages held by our support tool are retained for our records and are not removed by account deletion; you can request their deletion by emailing groundskeeper@yardledger.com.
• Seasonal reminder signups (no account): kept while the reminder is running. Unsubscribing strips the record to your address, which reminder it was, the ZIP code and the dates, and we keep that indefinitely as the record of your opt-out — it is what stops the address being added again. Email us from that address and we will erase it. Details in Section 11.
• Email suppression list: an address that hard-bounced or reported a message as spam is kept on a do-not-send list for as long as we send email, because deleting the entry would let the mail resume.
• Legal holds: we may retain limited information where required to comply with a legal obligation or to resolve a dispute.

For step-by-step deletion instructions, see our account & data deletion page.

15. International Data Transfers

We are based in the United States, and our service providers may process and store your information in the United States and in other countries where they operate. These countries may have data-protection laws that differ from those in your jurisdiction. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of personal information out of your region.

16. Children's Privacy

The Service is intended for adults and you must be at least 18 years old to create an account. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18, including children under 13 as defined by the U.S. Children's Online Privacy Protection Act (COPPA). If you believe a minor has provided us with personal data, please contact us and we will delete it.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the effective date and last-updated date above. If you have an account, material changes will be communicated by requiring re-acceptance upon your next login.

18. Complaints

If you have a complaint about how we use your personal information, please contact us first at groundskeeper@yardledger.com so we can try to resolve the issue. If you are in the European Union or the United Kingdom, you also have the right to lodge a complaint with your local data-protection regulator (for example, the UK Information Commissioner's Office). California residents may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210 or (916) 445-1254.

19. Contact Us

If you have questions or concerns about this Privacy Policy, contact us at: groundskeeper@yardledger.com.