Privacy Policy

The Farm To You, Inc. ("The Farm To You," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect when you use our website, mobile experiences, and services (collectively, the "Service"), why we collect it, how we use and share it, and the choices you have. By using the Service, you agree to the practices described here.

2.1 Information you provide to us

• Account information — name, email address, password (stored as a salted hash), and optional phone number.
• Order information — shipping address, recipient name, products purchased, and order history.
• Payment information — handled entirely by Stripe; we receive only a non-sensitive customer reference and the last four digits / expiration of a card for receipts.
• Communications — content of messages you send via our Contact page or in reply to our emails.
• Preferences — favorites, recipe saves, recently-viewed items, dietary tags, and notification settings.

2.2 Information we collect automatically

• Device & usage data — IP address, browser type and version, operating system, referring page, and pages viewed within the Service.
• Cookies and similar technologies — see the Cookies section below.
• Diagnostics — non-personal performance metrics and error reports collected to keep the Service reliable.

2.3 Information from third parties

• Sign-in providers — if you choose to sign in with Google, we receive your name, email address, and profile photo as authorized by you.
• Payment processor — Stripe shares minimal billing status updates with us (charge succeeded, refunded, etc.) so we can keep your account current.

We use personal information to:

• Create and operate your account, authenticate sign-ins, and provide member benefits;
• Process orders, communicate shipping updates, and provide customer support;
• Send transactional notifications (order confirmations, shipping updates, password resets);
• Send membership-related communications such as drop announcements and the weekly digest — you can unsubscribe at any time from the link inside each email or text;
• Improve and personalize the Service (recipe recommendations, drop relevance, search results);
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms & Conditions.

Cookies are small text files that a website places on your device. We use them — together with similar technologies like local storage and pixel tags — to remember your sign-in session, secure your account, and improve the Service.

4.1 Categories of cookies we use

• Strictly necessary — required to sign you in, keep your cart populated, and protect against cross-site request forgery. Without these the Service cannot function. (Example: access_token session cookie.)
• Functional — remember your preferences such as language, dietary tags, and last-visited drop.
• Analytics — help us understand which features are used most so we can improve them. These are aggregated and never tied to your name or email.
• Security & abuse prevention — used by our rate-limiting and error-tracking systems to detect automated abuse.

4.2 Managing cookies

Most browsers let you accept, refuse, or delete cookies through their settings. Blocking strictly-necessary cookies will prevent you from signing in or placing orders. We do not currently respond to "Do Not Track" browser signals because no industry standard for honoring them has been finalized; we do honor opt-out signals from Global Privacy Control (GPC) where required by applicable law.

We do not sell your personal information. We share it only as described below:

• With farm partners — the originating farm receives only the shipping name, address, and order line items needed to fulfill your order. Email and phone are shared only when you opt in to delivery notifications.
• With service providers — Stripe (payments), Twilio (SMS), Resend (transactional email), our cloud hosting providers, and our analytics / error-tracking vendors. Each is bound by confidentiality and data-processing terms.
• For legal reasons — to comply with a valid court order, subpoena, or governmental request; to protect the rights, safety, or property of The Farm To You, our members, or the public; or to investigate suspected violations of our Terms.
• In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choice you may have.

The Service integrates with carefully selected third parties. Each operates under its own privacy policy:

• Stripe — payment processing & subscription billing
• Twilio — SMS delivery
• Google — optional social sign-in
• Sentry — error monitoring (no personal data sent intentionally)

• Access & correction — sign in to your account dashboard to view and edit your profile, addresses, and preferences. You may also request a copy of your data by contacting us.
• Deletion — you may request deletion of your account at any time. We will delete or anonymize personal information that is not required for tax, fraud, or legal-compliance recordkeeping.
• Marketing opt-outs — unsubscribe from any non-transactional email using the link inside the message, or reply STOP to opt out of SMS.
• Portability — request a machine-readable export of the information you have provided to us.

California residents have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what categories and specific pieces of personal information we collect, the right to delete personal information we hold about you, the right to correct inaccurate information, and the right to opt out of "sales" or "sharing" of personal information for cross-context behavioral advertising. We do not "sell" personal information as that term is defined under California law. To exercise any of these rights, contact us via the Contact page.

We retain personal information for as long as your account is active and as needed to provide the Service. After account closure we may keep limited information for legitimate business reasons (such as fraud prevention, accounting, or legal compliance) for up to seven (7) years, after which it is deleted or anonymized.

We use industry-standard safeguards to protect personal information, including TLS encryption in transit, salted bcrypt hashing for passwords, restricted-access database controls, rate-limiting on authentication endpoints, and continuous security monitoring. No system is perfectly secure, however, and we cannot guarantee absolute security. Please notify us immediately if you suspect unauthorized access to your account.

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If we learn that a child has provided us with personal information, we will delete it as quickly as possible. Parents or guardians who believe a child has provided us with information may contact us via the Contact page.

The Service is operated from the United States. By using the Service from outside the U.S., you understand that your information will be transferred to, processed, and stored in the United States, where data-protection laws may differ from those of your country.

We may update this Privacy Policy from time to time. Material changes will be highlighted at the top of this page and, where appropriate, communicated by email. Continued use of the Service after a change takes effect constitutes your acceptance of the updated Policy.

For privacy-related questions, data-access requests, or to exercise any right described in this Policy, contact our privacy team via the Contact page.

© 2026 The Farm To You, Inc. All rights reserved.