Legal
Privacy Policy
Effective 17 April 2026. Last updated 30 October 2026.
The Homestead Plan is designed to work without collecting more than the bare minimum we need to sell you a licence and validate it. Here's exactly what happens, in plain language.
What stays on your device
Everything you type into the calculators (family size, crop selections, bed dimensions, frost dates, mix recipes, prices and setup costs, preservation choices) and into the Growing Plan form lives in your browser's local storage on your device. So do the time of your last plan and a fingerprint of the inputs it was made from, which let the app tell you when they change. If you buy the paid tier, your licence key and the device identifier LemonSqueezy issues for this browser are stored there too, and for 48 hours after a purchase, the time you paid.
The generated plan itself is not stored anywhere, on your device or on our servers. It stays in the open tab until you reload or close it, so use Download as HTML to keep a copy. Your inputs leave your device only in the cases in the table below. You can clear them at any time in your browser's site settings.
What we collect
| When | What | Why |
|---|---|---|
| At purchase | Your email address, name, billing country (collected by LemonSqueezy) | To issue your licence key and a receipt. LemonSqueezy also uses the country for tax purposes. |
| At licence check: when you enter a key, each time you open the planner with a key stored in this browser, and when you arrive through an activation link | Your licence key, and the device identifier LemonSqueezy issued for this browser, sent as they are (not hashed) | Our validation service, a function hosted on Vercel, passes both to LemonSqueezy, which confirms the key is valid and within its 3-device limit. When a browser is activated for the first time, our server gives LemonSqueezy a random name for it. We keep no copy of the key itself. We keep a shortened SHA-256 hash of it as a marker that LemonSqueezy has confirmed the key, for 30 days from the last confirmation, and, when a check fails, in a failed-check counter for 1 hour. Your IP address is kept in a request counter for 10 minutes. An activation link carries your key in its web address, so the key also appears in the request log Vercel keeps for that page load. |
| At growing-plan generation (paid tier) | The inputs you chose (family size, hardiness zone, frost dates, hemisphere, garden space, sun exposure, soil type, watering method, experience, goals, selected crops, the crops that cannot ripen before your first fall frost, produce target per person and display units), your currency symbol, your licence key and your device identifier | The inputs are sent to Anthropic's Claude API, which writes the plan. Your licence key, device identifier, currency and IP address are not sent to Anthropic, and no name, email, address or payment details are sent at all. We do not store your inputs or the plan. If our server cannot read the model's reply, the first 200 characters of that reply are written to our server log so we can find the fault. To enforce the 3-device limit and the allowance of 20 plans a day, our server keeps your device identifier, as it is, as the one device this licence generates plans from, for 30 days, renewed as you generate plans; a shortened SHA-256 hash of the licence key in a "licence valid" marker for 1 hour and in a plan counter for 24 hours; and your IP address in a request counter for 1 hour. Anthropic's own data-use policy applies to the API call itself. |
| When the site loads | Aggregate visit data (page views, referrers, device class) via Vercel Web Analytics | To know whether the site is working and where users are coming from. No personal identifiers. No cookies. If the address carries a licence key, the key is removed before the visit is counted. |
Third parties
We use a small number of third parties. Each has their own privacy policy; we link them below.
- LemonSqueezy - payments, licence keys, tax collection and the licence checks above. Acts as the Merchant of Record. The planner loads LemonSqueezy's checkout script from assets.lemonsqueezy.com on every visit, before any purchase, so LemonSqueezy receives your IP address and browser details when the page loads. lemonsqueezy.com/privacy
- Anthropic - the language-model API used to generate the personalised growing plan on the paid tier. anthropic.com/legal/privacy
- Vercel - hosting, the licence-check and plan-generation functions, and Vercel Web Analytics (cookie-less, aggregate). Vercel processes each request, including your IP address, under its own policy. vercel.com/legal/privacy-policy
- Upstash - the database that holds the short-lived records above: a shortened hash of your licence key, your device identifier and your IP address, each with the expiry given. We use it through Vercel's integration. Upstash privacy policy
- Google Fonts - font files served from Google's CDN. Google logs the request (IP, user-agent). No cookies are set. Google Fonts privacy FAQ
What we don't do
- We don't sell or rent your data. Not to advertisers, not to anyone.
- We don't use advertising cookies or tracking pixels.
- We don't train any AI model on your inputs or generated plans.
- We don't require an account. Your licence key replaces an account.
Your rights
Under GDPR (if you're in the EU/UK), POPIA (if you're in South Africa), or equivalent laws in your jurisdiction, you can request a copy of your data, request deletion, or request correction. Most of what we have is your purchase record at LemonSqueezy - you can request deletion via them directly, or by emailing us and we'll coordinate. The records our own server keeps expire by themselves, after 10 minutes to 30 days as listed above. Email us if you want them deleted sooner.
To clear everything the Service has stored in your browser, open your browser's site-data settings and clear local storage for this domain. That removes your calculator inputs, your licence key and the device identifier from your device. It does not remove the server records above, which expire by themselves. If you've activated your licence, you can re-enter it from the paywall screen when you need it back.
Children
The Service is not directed at children under 13. We don't knowingly collect information from children. If you believe a child has provided information, email us and we'll delete it.
Changes
If this policy changes materially we'll post a note on the main site. The "Last updated" date above will change.
Contact
Privacy questions: urbanroot.contact@gmail.com.
← Back to the planner