Privacy Policy

When you create a SteadStack account, we collect your name, email address, and password (hashed via Firebase Authentication). When you subscribe to a paid plan, payment information is processed securely by Stripe — we never store your credit card details on our servers. As you use SteadStack, we store the operational data you enter: animal records, inventory items, tasks, events, financial transactions, contacts, photos, and site information. This data belongs to you and is stored in your tenant's isolated database partition. We also collect standard usage data including IP addresses, browser type, pages visited, and feature usage patterns. This helps us improve the product and diagnose issues.

The SteadStack mobile app stores a copy of your farm data locally on your device using an on-device database (SQLite). This allows the app to work offline — in the barn, the back pasture, or anywhere without a signal. When you make changes while offline, those changes are queued on your device and transmitted to our servers automatically when connectivity is restored. Photos you take or select in the app are stored temporarily on your device before being uploaded. The app requests device permissions only for features you use: camera and photo library access for attaching photos to records, and microphone access for recording voice notes — audio is only captured when you actively start a recording. If push notifications are enabled, we collect a device push token so we can deliver notifications to your device. Local data is removed when you sign out or uninstall the app.

Photos you attach to records (animals, crops, harvests, equipment, work orders, and so on) are uploaded to and stored in Google Cloud Firebase Storage within your tenant's storage area. You retain full ownership of your photos. We do not use them for any purpose other than displaying them back to you in the application. Deleting a record does not immediately remove its associated photos from cloud storage. Photos are permanently deleted when your account and data are deleted, or sooner on request — contact us and we will remove specific files.

We use your information to: - Provide and maintain the SteadStack service - Process your subscription payments via Stripe - Send transactional emails (password resets, payment receipts, PO emails to vendors) - Improve the product based on anonymized usage patterns - Respond to support requests - Prevent fraud and enforce our terms of service We do not sell, rent, or share your personal information with third parties for marketing purposes. Period.

Your data is stored in Google Cloud Firestore on Google Cloud Platform infrastructure located in the United States. All data is encrypted at rest using AES-256 encryption and encrypted in transit using TLS 1.2+. We use Firebase Authentication for identity management, which provides industry-standard security including bcrypt password hashing, OAuth 2.0 token management, and automatic token rotation. Access to production systems is restricted to authorized personnel only and requires multi-factor authentication.

SteadStack is a multi-tenant application. Every record in the database includes a tenant identifier that ensures your data is completely isolated from other customers. Firestore security rules enforce that users can only access data within their own tenant. There is no mechanism to query across tenants.

We use the following third-party services that may process your data: - Google Cloud Platform / Firebase — Application hosting, database, file storage, and authentication - Stripe — Payment processing for subscriptions - Google Maps API — Land tract mapping (only when you use the mapping feature). If you use the "Use Current Location" option when setting up a site, your device's coordinates are stored as part of that site's location data and are shared with Google Maps to render the map. This processing is subject to Google's own privacy policy. You can skip this feature or enter coordinates manually instead of sharing your device's location. - Weather data provider (Open-Meteo, with an IP-based location fallback) — Used to show local weather on your dashboard. Your approximate location is sent to fetch current conditions and is not stored by us; you can deny location access and the weather widget will simply not appear. - SMTP Provider — Email delivery for purchase orders and notifications Each of these providers has their own privacy policy and is bound by data processing agreements.

SteadStack uses essential cookies for authentication (Firebase session tokens). We do not use third-party advertising cookies or cross-site tracking pixels. We may use anonymized analytics to understand how the product is used (e.g., which features are most popular, where users encounter errors). This data cannot be used to identify individual users.

Your data is retained for as long as your account is active. If you cancel your subscription, your data remains in read-only mode for 30 days. After that period, data is scheduled for permanent deletion unless you request an extension or full data export. You can request a complete export of your data at any time by contacting us at contact@joeybartholomew.com.

You have the right to: - Access your data at any time through the application or via data export - Correct inaccurate information by editing your records or contacting support - Delete your account and all associated data by contacting support - Export your data in standard formats - Object to processing for specific purposes by contacting us For California residents: We do not sell personal information as defined by the CCPA. You may exercise your rights under the CCPA by contacting us at the address below.

If you are located in the European Union or United Kingdom, we process your personal data on the following legal bases: performance of our contract with you (providing the SteadStack service you signed up for) and our legitimate interests (improving the product, preventing fraud, and keeping the service secure). Your data is stored in the United States. Where data is transferred from the EU or UK, our infrastructure providers (including Google Cloud) rely on Standard Contractual Clauses and equivalent safeguards to protect it. In addition to the rights described above, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have mishandled your personal data. We would appreciate the chance to address your concern first — contact details are at the end of this policy.

SteadStack is intended for adults operating farms, ranches, and homesteads. It is not intended for use by individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us so we can delete it.

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or through a notice in the application. Your continued use of SteadStack after changes take effect constitutes acceptance of the updated policy.

If you have questions about this privacy policy or how we handle your data, contact us at: Bartholomew Development LLC Email: steadstack@bartholomewdevelopment.com Web: steadstack.com/contact