Privacy Policy

Last updated: May 10, 2026

1. Who I am

Henalytics is built and operated by Riley, a single individual homesteader. Contact: slowbuildacres@gmail.com. This privacy policy explains what data Henalytics collects when you use the app at henalytics.com or its mobile counterparts.

2. What I collect

If you create an account

• Your email address. Used for sign-in and account recovery. Stored by Supabase (my authentication provider).
• Your password. Stored as a one-way hash by Supabase — I never see it in plaintext, and neither do they.

What you enter into the app

• Your homestead data. This includes whatever you log — egg counts, garden harvests, animal records, photos, notes, sales, and so on. This is your data, used to power the app's features for you.
• Your zip code or approximate location. Used to show local weather and determine your USDA hardiness zone for garden recommendations. Stored as part of your homestead profile.
• Photos you upload. Photos of your garden, animals, or harvests are stored privately, accessible only to you (and any farmhands you've invited to your homestead).

What I don't collect

• I don't run analytics scripts (no Google Analytics, no Mixpanel, no Segment).
• I don't use third-party advertising networks.
• I don't track your activity across other websites.
• I don't collect data from children under 13.
• I don't request access to your phone's contacts, microphone, or other sensors.

3. How your data is used

Your data is used only to make the app work for you:

• Your homestead data is shown back to you in the app, used for the analytics and weekly digest features.
• Your zip code or location is used to fetch weather data from weather APIs and to display your USDA hardiness zone.
• Your email is used to send you the weekly digest (if you opted in), invite emails (if you invite a farmhand), or to respond to support requests.
• If you invite a farmhand, they get access to the homestead you shared with them — that's the whole point of the feature.

I do not sell, rent, or share your data with any third party for any reason other than the service providers listed below who help me run the app.

4. Service providers I rely on

Henalytics is hosted and operated using a few third-party services. These providers have access only to the data they need to perform their role, and they're each contractually bound by their own privacy policies and security commitments:

• Vercel — hosts the app and serves the web pages you see. They process page requests but don't store your homestead data. Vercel privacy policy.
• Supabase — stores your account (email, hashed password), your homestead data, and your photos. Supabase privacy policy.
• Resend — sends transactional emails (weekly digest, farmhand invites, account notifications). They process your email address to deliver mail. Resend privacy policy.
• Stripe — if you choose to donate, Stripe processes the payment. I never see your card details. Stripe privacy policy.
• Zippopotam — converts your zip code to a latitude/longitude for weather lookups. Only the zip code is sent. No personal data attached. Zippopotam.
• Open-Meteo — provides weather forecasts. Only a latitude/longitude is sent. Open-Meteo terms.

5. Data security

Your data is protected in several ways:

• Encrypted in transit. All connections to henalytics.com use HTTPS.
• Encrypted at rest. Supabase encrypts the underlying database.
• Row-level security. The database is configured so that even if someone gained access to it, they could only see their own data. No user can read another user's homestead.
• Private photos. Photos are stored in user-namespaced folders and served via short-lived signed URLs. Only you (and farmhands you've invited) can access yours.
• No password storage. Passwords are hashed by Supabase using industry-standard algorithms.

That said, no system is perfectly secure. If a breach occurs, I'll notify affected users promptly.

6. How long your data is kept

Your data is kept as long as your account exists. If you delete your account (Settings → Delete my account), your data is permanently removed within minutes:

• Your account row is deleted from Supabase Auth.
• Homesteads you own with no other members are deleted along with all entries, photos, sales, and calendar events.
• Homesteads you share with farmhands transfer to the oldest other member so they don't lose access. Your own membership row and personal access are removed.
• All photos you uploaded are removed from storage.

Backup snapshots taken by Supabase may retain your data briefly before they cycle out (typically within 30 days). Logs of API requests may retain truncated metadata (timestamps, IP addresses) for shorter periods for security and abuse-prevention purposes.

7. Your rights

You have the following rights regarding your data:

• Access. You can see all your data inside the app — it's literally what the app shows you.
• Export. If you want a copy of your raw data for your own records, email me at slowbuildacres@gmail.com and I'll export it for you.
• Correction. You can edit or delete any entry in the app at any time.
• Deletion. Settings → Delete my account permanently removes your account and data.
• Opt out of emails. The weekly digest is opt-in only. Toggle it off in Settings anytime.

For California residents: under the California Consumer Privacy Act (CCPA), you have the right to know what personal information I collect, to access and delete that information, and to not be discriminated against for exercising those rights. Henalytics complies with these by default — see above.

8. Children's privacy

Henalytics is not intended for children under 13. I don't knowingly collect personal information from children under 13. If you believe a child has provided information to Henalytics, please contact me and I'll delete it.

9. Changes to this policy

If I update this policy in any significant way, I'll update the date at the top and post a notice in the app's "What's New" feed. Continued use of the app after a change means you accept the updated policy.

10. Contact

Questions, concerns, or data requests? Email me directly at slowbuildacres@gmail.com. I read every email personally.