Privacy Policy

GrainSolution (“GrainSolution,” “we,” “us”) provides a mobile and web application that helps Canadian prairie grain farmers photograph, parse, store, map, and export grain elevator tickets and the fields they came from. The mobile app is distributed on Google Play and the Apple App Store (including TestFlight beta builds); the web app lives at grainsolution.ca. This policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using GrainSolution, you agree to this Privacy Policy. If you do not agree, please do not use the service.

Information you give us

• Account information. First name, last name, email address, username, province, and password (stored as a one-way hash). You may also link a Google account through Google Sign-In, in which case we receive your email address and basic profile information from Google.
• Grain ticket photos and PDFs. Images and PDF documents you capture or upload to record grain tickets. These files, along with the structured fields we extract from them (elevator name, date, commodity, weights, dollar amounts, and similar grain ticket fields), are stored on your behalf so that you can review, edit, and export them later.
• Manually entered ticket fields. Information you type or correct on a ticket review screen.
• Field mapping data.Polygon shapes you draw on the map, the crop / variety / planted date / Dominion Land Survey (DLS) legal description you attach to each field, and any field-share short codes you mint or accept. When you tap “Walk perimeter” we record the GPS pins you drop while walking the boundary, and when you open the Fields tab we use your current GPS position to centre the map and to show per-field weather. We do not log a continuous track or location history — only the discrete points you create, plus the most recent reading used to centre the map.
• Crop rotation history.Whenever you change a field's current crop or planted/harvest dates, we also write a row to a multi-year planting history table (one row per field per growing year). That history lets the field detail screen show your rotation over time. It never leaves your account.
• Communications. When you submit our contact form or email support@grainsolution.ca, we receive your name, email address, and the contents of your message.

Information we collect automatically

• Device and app data. Basic technical information needed to operate the app, such as device type, operating system version, and app version.
• No third-party analytics or ad tracking. We do not embed third-party product-analytics or advertising SDKs in the app, we do not use advertising identifiers, and we do not build behavioural or cross-app tracking profiles of you. Limited crash and performance diagnostics may be collected by the app stores themselves (Google Play, Apple) under their own policies — see the providers list below.
• Authentication metadata. Sign-in events, session tokens, and the IP address used to sign in. We use this to keep your account secure.
• Image fingerprints.When you upload a grain ticket photo or PDF we compute a short numeric fingerprint of the file (a hash of five 1 KB byte samples plus the file size) and store it on the ticket row. We use this only to warn you before you import the same file twice. The fingerprint is not a copy of the image and cannot be reversed back into the image.

Information we do not collect

• We do not record audio or video.
• We do not track your location in the background. Location is only sampled while you have the Fields tab open or while you are actively using “Walk perimeter” — never with the app closed or in the background.
• We never receive or store your biometric data. The mobile app offers optional Face ID / Touch ID / fingerprint unlock. When you enable it, the match is performed entirely on your device by the operating system's secure biometric hardware; GrainSolution only stores a local on/off preference on the device and never sees, receives, or transmits your face or fingerprint data.
• We do not access your contacts or text messages.
• We do not sell or rent your information to third parties.
• We do not show third-party advertising in the app.

• To provide the core service: storing your grain ticket photos and parsed fields, letting you review and edit them, mapping your fields, and exporting your data as a CSV or Excel file.
• To run automated extraction of grain ticket fields from the photos and PDFs you upload.
• To render the maps you draw fields on, and to overlay per-field weather forecasts and live commodity prices for the crops you grow. For these features we send the field centroid (latitude / longitude) to our map and weather providers — we do not send your account identity along with it.
• To mint and resolve field share links you create. A share link is a short random code; anyone with the URL can view the shared field's polygon, crop, variety, and legal description, but they cannot see your other fields, your tickets, or your account. To stop sharing, delete the source field — which also removes any copies recipients imported.
• To authenticate you, secure your account, and respond to security incidents.
• To send you transactional emails (e.g. one-time passcodes, account verification, password reset, receipt confirmations, year-end exports).
• To respond to your support requests.
• To improve the app — for example, to fix parsing accuracy, diagnose crashes, and improve performance.
• To comply with legal obligations.

We use a small number of trusted service providers (“processors”) to run GrainSolution. They process your information on our behalf, under contract, and only for the purposes described here.

• Supabase — database, authentication, file storage, realtime, and serverless functions. Your account information, grain ticket data, field polygons, share links, and uploaded files are stored on Supabase infrastructure (Canada region).
• Anthropic— provides the AI model that extracts fields from your grain ticket images and PDFs. When a ticket is uploaded, the image is sent to Anthropic for analysis. Anthropic does not use customer data submitted via the API to train its models. See Anthropic's privacy policy at anthropic.com/legal/privacy.
• Mapbox — renders the satellite and vector basemaps you draw fields on. When you pan and zoom the Fields tab, your device sends the visible map area (a bounding box) to Mapbox so the right tiles can be served. When we generate a static preview image for a public field share link or the Field detail screen, we send the field centroid to Mapbox. We do not send your account identity to Mapbox, and we have disabled Mapbox's optional event telemetry, so Mapbox receives only the map-tile requests needed to draw the map — not usage or location analytics. See mapbox.com/legal/privacy.
• Open-Meteo — provides the per-field weather forecast shown on the Fields tab and field detail screen. When you open a field, the app sends the field centroid (latitude / longitude) to Open-Meteo and receives current conditions plus a 7-day forecast in return. Open-Meteo is a non-profit weather service that does not require an API key and does not, to our knowledge, log identifying information against forecast requests. See open-meteo.com/en/terms.
• Barchart OnDemand— provides the live commodity-price feed and 30-day price history shown on the Home tab. Your device fetches prices through our server-side proxy, so Barchart sees our server's requests rather than your device.
• Vercel — hosts the web application at grainsolution.ca and the contact form API. Receives the IP address and user-agent of visitors.
• Resend — sends transactional emails (account verification, OTPs, password resets, contact form auto-replies, year-end exports).
• ImprovMX — forwards inbound mail sent to addresses on the grainsolution.ca domain (e.g. support@grainsolution.ca) to our support inbox.
• Google— when you choose to sign in with Google, Google authenticates you and shares your email address and basic profile with us under Google's own privacy policy.
• Google Play — distributes the Android app and provides crash-and-ANR reports we use to fix issues. Google Play sets its own privacy policy for app downloads and reviews. See policies.google.com/privacy.
• Apple TestFlight — if you receive the iOS beta build, Apple distributes it via TestFlight and may collect crash diagnostics. See apple.com/legal/privacy/data/en/test-flight.
• Expo / EAS — used to build and distribute the mobile application. Receives anonymous build metadata only.

The mobile app requests the following permissions on first use. Each one is requested in context (the first time you tap a feature that needs it) and can be revoked at any time from your device's Settings app.

• Camera — to photograph grain tickets. Used only while the Capture screen is open; never in the background.
• Photo library — to let you pick an existing grain ticket photo or save a captured photo to your gallery. We only read photos you explicitly pick.
• Precise location — to centre the Fields-tab map on your current position and to drop GPS pins while you walk a field perimeter. Sampled only while the Fields tab is foregrounded, not in the background.
• Approximate location — a fallback used by the Fields-tab map when precise location is denied or unavailable.

The app does not request access to your contacts, microphone, calendar, SMS, call logs, or device files outside what the OS share sheet hands us when you explicitly forward a grain ticket.

From the field detail screen you can mint a short share link (for example, grainsolution.ca/f/AbCd1234). Anyone who has the URL can open a public, read-only page showing the field's polygon, crop, variety, planted date, and legal land description. The recipient does not see your other fields, your tickets, your name beyond what you have chosen to make public on your profile, your email, or any of your account settings.

If a recipient is signed in to GrainSolution, they can tap “Add to my fields” — this copies the shared field's geometry and crop snapshot into their own account, where it lives in a separate “Shared with you” list and is read-only(no edit, no re-share, no production / ticket data exposed to the recipient). To stop sharing a field, delete the source field. When you delete the source field or delete your entire account, the share link stops working and every recipient's imported copy is automatically removed too — the cascade prevents stale snapshots from outliving the original.

We store your account information, grain ticket data, field polygons, share links, and uploaded files on Supabase in the Canada (Central) region. Some of our service providers (notably Anthropic, Mapbox, Open-Meteo, and Vercel) operate internationally and may process data in other countries, including the United States and Europe. By using GrainSolution you consent to such cross-border processing.

• Account information — for as long as your account exists.
• Grain tickets and photos — until you delete them, or until you delete your account. When you delete an individual ticket (trash icon in the app, or Discard on an unreviewed parse), both the ticket record and the associated photo or PDF in our storage are removed together as a single atomic operation. We do not retain orphan files.
• Fields and field polygons — until you delete them, or until you delete your account.
• Field share links— until you delete the underlying field (or your account). Deleting the source field removes the share link and, through cascading deletes, also removes every copy that recipients had imported into their own accounts — so when you delete a field, it disappears from recipients' accounts too. Stale snapshots of your land do not outlive the source.
• Contact form messages — for up to 24 months, for support and abuse-prevention purposes.
• Authentication logs — for up to 90 days.

When you delete your account, we delete or de-identify your grain tickets, fields, share links, uploaded files, and profile information within 30 days, subject to any retention required by law.

Two URLs are available for users who can't access the in-app deletion path: grainsolution.ca/delete-account for a full account-and-data wipe, or grainsolution.ca/delete-data for step-by-step instructions on removing individual tickets or fields from within the app without deleting the whole account.

We use industry-standard safeguards including encrypted transport (HTTPS/TLS) for all data in transit, encrypted storage at rest, row-level security in our database (so users can only access their own tickets), passwords hashed with a strong one-way algorithm, and protections against leaked-password reuse. No online service can guarantee absolute security; please use a unique password and keep your sign-in credentials private.

Depending on where you live, you may have rights under applicable privacy laws (such as Canada's Personal Information Protection and Electronic Documents Act). These typically include the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your account and your data;
• Export a copy of your data;
• Withdraw consent to certain processing.

You can exercise most of these rights directly in the app — for example, edit any ticket field, delete tickets, change your password, export your data as CSV or Excel, or delete your account from Settings → Account → Delete account (two-step confirmation, immediate). When you delete your account from inside the app we wipe your tickets, fields, planting history, photos, and profile within a few seconds. For anything else, email support@grainsolution.ca. We respond within 30 days.

GrainSolution is a tool for adults running farm businesses. You must be at least 18 years old, or the age of majority in your province or territory, to create an account and use the Service — see our Terms of Service. The app is not directed to children, and we do not knowingly collect personal information from anyone under the age of majority. If you believe a minor has provided us with information, please email support@grainsolution.ca and we will delete it.

The app's App Store and Google Play content rating reflects that GrainSolution contains no objectionable content; it is separate from this 18+ account-eligibility requirement.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top and, if the changes are material, notify you by email or in the app before they take effect.

Questions about this policy or about how we handle your information? Email support@grainsolution.ca or use our contact form.