PRIVACY POLICY

Nothing about you. Materials And Practices does not include analytics, telemetry, crash reporters, advertising SDKs, or any third-party libraries that phone home. There is no developer account to sign in to, no server we operate, and no place we could store your data even if we wanted to.

Concretely, the app does not:

• Send grow, field, cultivar, amendment, harvest, lease, worker, or time-clock data anywhere off your device.
• Use any advertising identifier, device identifier, or cross-app tracking signal.
• Read or write the iOS Contacts, Calendar, or Reminders databases.
• Use Siri intents, Spotlight donation, or Handoff.

The data you enter — grows, cultivars, fields, soil tests, amendments, harvests, work orders, worker time entries, lease agreements, photos — is stored in a Core Data SQLite database inside the app's private container. iOS protects the container with the standard Data Protection class tied to your device passcode; the file is not readable by other apps and not exposed outside the device sandbox.

The app does not add a second layer of encryption on top of iOS Data Protection. If you require an additional layer (for example, for high-stakes regulatory archives), keep the device passcode strong, enable Face ID / Touch ID, and back the device up to an encrypted destination.

This release does not enable iCloud or CloudKit sync. Your records exist only on the device that created them. If you have iOS device backups turned on (encrypted iCloud Backup or encrypted Finder/iTunes backup), your records are included as part of the standard device backup — that is governed by Apple's policies, not ours. We do not have an iCloud container, and we cannot read those backups.

When you open the dashboard, the app asks for "While Using the App" location access at coarse accuracy (roughly the nearest 100 metres). Your location is passed to Apple's WeatherKit service so the app can show current conditions for your growing area. Apple handles that request under its own privacy terms; we do not log or store the coordinates. Refer to Apple's WeatherKit privacy notice for details.

If you decline location access, the rest of the app continues to work — only the dashboard weather card is affected.

You can attach photographs to grows, fields, soil tests, and other farm records. The camera and photo-library permissions are requested by the system the first time you tap to attach a photo. Captured or selected images are stored only inside the app's private Core Data container — they are not added back to the iOS Photos library, not shared with other apps, and not uploaded anywhere.

The app generates records that you may choose to share with your organic certifier, FSMA inspector, lessor, lessee, or worker. Sharing happens through the standard iOS share sheet — exporting a PDF, emailing a summary, or printing — and is initiated by you. Once exported, that file is governed by the privacy policy of whatever destination you send it to. The app itself does not transmit those records on your behalf.

Materials And Practices is distributed through Apple's App Store. Apple processes the purchase (if any), handles your payment information, and supplies receipt validation. We receive aggregate sales reports from Apple (units sold per day, by region) that do not identify you. Refer to Apple's privacy policy for how Apple handles its part of the transaction.

This site (river.io) is a static page hosted on GitHub Pages. We do not run our own analytics here. GitHub may keep standard web-server access logs for security and abuse-detection purposes; refer to GitHub's general privacy statement for what they retain. We do not embed advertising tags, tracking pixels, or third-party scripts. The page loads webfonts from Google Fonts; consult Google's privacy policy for that connection.

Materials And Practices is built for adults running a farm. It is not directed at children under 13 (or under 16 where the applicable law is GDPR), and we do not knowingly collect any data from children. If you believe a child has used the app, please contact us at privacy@river.io and we will help, although practically there is nothing for us to delete because we never had it.

Because we do not collect or store data about you, the usual rights to access, correct, delete, port, or restrict processing of personal data (GDPR Articles 15–22, CCPA §1798.100 et seq., and equivalents) do not produce a record from us. The data lives on your device. You can delete it by uninstalling the app, which removes the app's private container in full.

If we change how the app or this site handles data, we will update this page and the effective date above. Because the app does not phone home, there is no in-app banner to notify you — re-visit this page when a new version ships.

Privacy questions: privacy@river.io.
Security disclosure: reporting@river.io with subject materialsandpractices vuln:.