Privacy Policy

Information You Provide

• Account registration: Email address, password (stored as a one-way hash -- we cannot read your password), and optional display name.
• Compost uploads: Photos you upload, plus optional metadata you choose to provide (composting method, approximate age, ingredients, turned frequency, climate zone, and notes).
• Ratings, comments, and reactions: The scores you assign, comments you write, and emoji reactions you select.
• Profile information: Display name and avatar URL, if you choose to set them.

Information Collected Automatically

• Anonymous fingerprint: When you rate a compost photo without an account, we generate a one-way hash of your IP address and browser user-agent string. This is used solely to prevent duplicate ratings on the same post. We do not store your raw IP address or user-agent for this purpose.
• Approximate geolocation: If you grant permission during the upload flow, we use your browser's geolocation API to auto-detect your climate zone. We round coordinates to reduce precision. You can skip this or select your climate zone manually.
• Server logs: Our hosting provider (Railway) may collect standard server logs including IP addresses, timestamps, and request URLs. These are retained for operational and security purposes per Railway's own privacy policy.
• Cookies and local storage: We use a small amount of browser local storage to remember your theme preference (light/dark mode) and session authentication token. We do not use third-party tracking cookies. If we add Google AdSense in the future, Google may set cookies for ad personalization -- we will update this policy and display a consent banner before that happens.

Information We Do NOT Collect

• We do not collect your real name (unless you choose to use it as your display name).
• We do not collect payment information directly -- if you make a purchase (e.g., ad removal), payment is processed by Stripe. We receive only a confirmation of payment, not your card details.
• We do not use analytics tracking tools at this time. If we add analytics (e.g., Google Analytics), we will update this policy.

We do not sell your personal data.

We may share data in the following limited circumstances:

• Aggregated, anonymized data: We may publish or share aggregate statistics about compost ratings, composting methods, and other trends. This data cannot identify any individual user.
• Dataset licensing: We may license an anonymized, aggregated dataset of compost photos and associated ratings/metadata to third parties for purposes including agricultural research, machine learning, computer vision, AI model training, and commercial data products. This dataset will not include email addresses, passwords, account identifiers, display names, or precise geolocation coordinates. What is retained in the dataset: photos, composting method, approximate age, ingredients, turned frequency, climate zone (general, not coordinates), community ratings, and green/brown balance scores. Third parties who license the dataset may create derivative works including trained AI models. See the Terms of Service (Section 4) for the full content license.
• Service providers: Our hosting provider (Railway) and payment processor (Stripe) process data on our behalf under their own privacy policies.
• Legal requirements: We may disclose data if required by law, court order, or governmental authority.

• Account data: Retained as long as your account exists. You can delete your account at any time (see Your Rights below).
• Compost photos and metadata: Retained as long as the post exists. You can delete your own uploads. We generate anonymized dataset snapshots periodically -- if you delete your content before the next snapshot, it will be excluded from future datasets. However, if your photos were included in a dataset snapshot prior to deletion, the anonymized version may persist in that dataset and in any derivative works (e.g., trained AI models) already created from it.
• Ratings, comments, reactions: Retained as long as the associated post exists. If the post is deleted, associated ratings, comments, and reactions are also deleted.
• Anonymous fingerprints: Retained indefinitely (they cannot be traced back to you -- they are one-way hashes).
• Server logs: Retained per Railway's data retention policies.

Depending on where you live, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update your display name, avatar, and email through your profile settings.
• Deletion: Delete your account and all associated data. This permanently removes your profile, uploads, comments, reactions, and ratings. Go to your profile settings to delete your account.
• Data export: Download a machine-readable export of your data from your profile page.
• Withdraw consent: You can revoke geolocation permission through your browser settings at any time.
• Object: You can object to processing based on legitimate interest by contacting us.

To exercise any of these rights, contact us at privacy@roastmycompost.com. We will respond to requests within 30 days. We may ask for identity verification before processing deletion or export requests.