Privacy Policy

1. Information collected

When you use Contact Us, we collect your name, email address, message, and submission time. Please include only information needed for your question.

When you submit the launch-list form, you provide your email address, city, nearest crossroads, ZIP code, and product interests. You may also provide your name. A successful signup also includes the time of submission. The form does not ask for your street address, payment information, or an account password.

If you request delivery in your area, we collect your name, email, delivery address, recurring-delivery preference, and selected cart items, if any. When you check delivery or save checkout details, we also keep your selected order frequency, fulfillment preference, priced cart, optional delivery/access notes, and the delivery eligibility or review result. Saving these details does not place an order or take payment.

Our hosting and infrastructure providers may process technical information, such as IP addresses, browser information, requested pages, and request times, to deliver the website, maintain service logs, and help prevent abuse.

Unfinished checkouts

Once you enter a valid email at checkout, we automatically save your email, name, selected products and quantities, delivery details, frequency, selected date, and checkout activity times as you fill them in, even if you do not submit the checkout or complete a purchase. We use these records to help with checkout support and understand incomplete checkouts and sales. They do not place an order or enroll you in marketing emails. We do not capture passwords, sign-in codes, or payment-card fields through this feature.

When advertising tracking is allowed, we also keep the entry page, referring website domain, and campaign tags from your link with your checkout. We do not copy arbitrary URL parameters into these records or send your checkout contact information to Meta. Browser session storage holds an opaque checkout identifier and those campaign tags, not your contact details. Global Privacy Control and our advertising opt-out stop new campaign attribution capture.

Automatically captured checkout records are deleted after 90 days without saved activity, on our daily cleanup schedule. Submitted requests, checked delivery details, and completed order records follow the business-record retention described below. Clearing browser storage does not delete database records; contact us to request access, correction, or deletion.

2. How information is used

For orders, we keep your contact details, items and quantities, totals, fulfillment preference and date, delivery address and access notes when provided, payment and refund status, and payment-provider references. For subscriptions, we also keep your frequency, payment authorization, delivery schedule, cutoffs, skips, pauses and cancellations. We use these records to grow and fulfill orders, manage authorized payments and refunds, and provide support.

Accounts use a verified email address and account identifier. Sign-in uses an emailed code, with no password required. After verification, we may link orders placed with that email address to your account. Account and order-service emails include sign-in codes, confirmations, renewal reminders and relevant status or payment notices. Creating an account or placing an order does not add you to the marketing launch list.

We use contact-form information to answer questions and handle requests, including privacy and unsubscribe requests. Sending a message does not add you to the launch list.

Delivery requests help us assess demand for future routes and contact you about delivery availability. They do not place an order or enroll you in a paid subscription.

We use launch-list information to maintain the list, plan our initial service area and product availability, and send news about the Sonoran Microgreens launch. Technical information supports website operation, troubleshooting, and security. Aggregate analytics help us understand visits and improve the website. Signing up is optional.

3. Service providers and sharing

Supabase stores account, order and subscription records and authenticates sign-ins. Stripe processes payments and refunds and stores payment methods for authorized recurring charges. We do not store full card numbers or card security codes. Resend delivers account and order emails and processes the recipient email address and the relevant sign-in code, name, order details, dates or deadlines.

We use Supabase to keep submitted contact, launch-list, and delivery-request information as business records. Delivery-request notifications in Discord include your name, email, city, state, ZIP code, and recurring-delivery preference; the full street address and cart are kept in our database.

As you type a street address at checkout, Google Maps processes the entered text to suggest addresses. Selecting a suggestion fills the address fields. When you check delivery, Google Maps processes the delivery address to find its location and estimate driving time. We do not send your name, email, or cart to Google Maps for this check. See Google’s Privacy Policy. Checkout drafts and address-review requests are stored in Supabase. Review notifications contain your name, email, city, state, ZIP code and request reference; the street address and cart remain in our database.

Contact messages, including your name, email address, message text, and submission time, are sent to our private Discord notification channel so we can respond.

When the launch-list integration is enabled, submitted names (when provided), email addresses, ZIP codes, cities, nearest crossroads, product interests, and signup times are sent to Discord as notifications for Sonoran Microgreens. Discord processes this information under its own policies. We use Resend to send welcome emails, which includes processing your email address and your name when provided. Website hosting providers also process information needed to operate their services.

We do not sell customer contact lists. Unless you opt out or your browser sends Global Privacy Control, we share the limited website activity described below with Meta for advertising measurement and targeting. Information may also be disclosed when required by law or when reasonably necessary to protect the website, its visitors, or legal rights.

For more about Discord’s practices, read its Privacy Policy.

4. Cookies and tracking

The shop uses a first-party cookie named sonoran_cart_v1 to remember your selected product IDs, sizes, and quantities for up to 30 days after your last cart change. It contains no contact or payment details. Clearing your cart removes this cookie; you can also clear it in your browser settings. Cart selections do not reserve products or place an order.

Sign-in cookies with names beginning with sb- keep your account signed in. They are set for up to 400 days and refreshed during use, although sessions may expire or be revoked sooner and browsers may shorten storage. The sm_checkout_draft cookie connects your browser with recently saved checkout details for up to one hour. A temporary session-storage timestamp helps restore checkout when you return from Stripe; it contains no contact or payment details. The sm_order_receipt cookie lets your browser view one verified paid order for up to 30 days; it does not grant access to the rest of your account or allow subscription changes.

Sign-in, checkout-draft and receipt cookies cannot be read by website JavaScript. Signing out or choosing “Forget this order” removes this browser’s sign-in, draft and receipt access; your cart remains. Removing cookies does not delete business records or cancel an order.

To prevent abuse, request limits use keyed hashes of source IP addresses and, for sign-in, email addresses. The rate-limit table keeps these coded counters rather than the original identifiers; expired counters are removed as further requests arrive. Separate provider logs may contain technical information described above.

We use Vercel Web Analytics on public pages; account, checkout, order-status, order-management and admin pages are excluded. We use it to measure visits and page views. Vercel processes information such as visited pages, referring sites, approximate location, browser, and device type to provide aggregate statistics. It uses a temporary request-derived identifier instead of third-party cookies; visitor sessions are discarded after 24 hours. We do not send launch-list or contact-form fields to Web Analytics.

Optional Meta advertising tracking

Meta Pixel measures public page visits, adding products to your cart, beginning checkout, and confirmed purchases. Meta can receive product IDs, sizes, quantities, order value and currency, an opaque event identifier, page information, and technical data such as IP address, browser and advertising-cookie identifiers. This can connect activity with a Meta account and help measure and personalize advertising. We do not include names, email addresses, phone numbers, delivery addresses, card or bank details, or private account links in these events. Our integration disables automatic form tracking and does not supply advanced-matching identifiers.

Our public website uses advertising tracking by default without an automatic cookie banner. You can turn it off through “Privacy choices” at the bottom of a public page. Previously saved opt-outs remain in effect. Opting out does not affect shopping, sign-in, payments or subscription management. Private account and admin pages and test payments are excluded. We honor Global Privacy Control by keeping Meta tracking off when that browser signal is enabled.

When you make a choice, we store it in this browser’s local storage as sm_advertising_consent_v1. Opt-outs remain until you change the choice or clear that storage. A saved choice to allow advertising lasts up to 180 days; after it expires, tracking stays off until you renew that choice. After a purchase event is sent, a local-storage marker beginning with sm_meta_ helps prevent counting the same purchase again in that browser. It contains an opaque identifier, not your contact or card details, and remains until browser storage is cleared. Meta may set advertising cookies such as _fbp and _fbc. Meta’s use and retention of information are described in its Privacy Policy and Cookies Policy.

Our launch form does not require an account or a marketing cookie. Infrastructure providers may use technical mechanisms needed for security and service delivery. Browser settings let you control cookies and other website storage. Read more about Vercel Web Analytics privacy practices.

5. Retention and security

Account, order, payment-reference and communication records are kept while needed for fulfillment, support, refunds, recurring orders, business records and applicable obligations. Clearing browser storage does not remove those records. Access to customer and administrative records is limited to the permissions needed to provide the service.

Contact messages are kept while needed to respond and handle follow-up requests. Delivery-interest records are kept while needed to assess route demand and follow up about availability. Launch-list records are intended to be kept while needed to administer the list and launch communications. Records may also need to be retained for legal obligations or to honor an opt-out. Copies processed by service providers are subject to their retention practices.

No website, storage system, or internet transmission can be guaranteed completely secure. Please do not submit sensitive information through the launch form.

6. Your choices

Advertising choices apply to the browser and device where you make them. You can change your choice at any time through “Privacy choices.” Opting out stops future Meta events from our integration and attempts to remove its first-party advertising cookies; it does not recall information already sent to Meta. You can also manage cookies and site storage in your browser, and review advertising and off-Meta activity controls in your Meta account. Clearing site storage removes this site’s saved choice and restores the default tracking setting unless your browser sends Global Privacy Control. You may need to opt out again after clearing storage or changing browsers or devices.

Sign out on shared devices. From your order page, you can skip eligible recurring deliveries or cancel future uncommitted deliveries. For account access, correction or deletion requests, use Contact Us. Stopping marketing emails does not cancel orders or subscriptions; account and order-service emails are separate.

You can browse without joining the launch list. To stop launch emails, use the unsubscribe link in an email, reply with “unsubscribe,” or send us an unsubscribe request through our contact form using the address you used to sign up. Depending on applicable law, you may also have rights to access, correct, or delete personal information.

For privacy questions, information requests, or help unsubscribing, use Contact Us.

7. Children’s privacy

This website and launch list are intended for a general adult audience and are not directed to children under 13. Children under 13 should not submit personal information through the form.

8. Changes to this policy

This policy may change as the website and business develop. Updates will be posted on this page with a revised date. Material changes to the handling of information will be communicated as required by applicable law.

See also our Terms of Use.