Privacy Policy

1. Data We Collect

1.1 Account & Profile Data

When you create a Farmer Copilot account, we collect your name, email address, farm name, and geographic region. If you sign in with your phone number, we also collect that number: Firebase Authentication uses it to send you a sign-in code, and it is stored with your profile. If you sign in with Apple or Google, we receive an account identifier from that provider and the name and email address it shares with us; with Apple, the email address can be a private relay address. Profile data helps us personalise weather forecasts, breed recommendations, and regional benchmarks. This data is stored in our secure cloud database (Google Cloud Platform, with AES-256 encryption at rest).

1.2 Farm & Agricultural Data

Farm data includes animal records (species, breed, tag numbers, health events, production metrics), crop fields, feed inventories, and financial transactions. This is the most sensitive data we handle. By default, all farm data is stored locally on your device and is NOT synced to our servers unless you explicitly enable Cloud Sync in Settings → Data Management.

1.3 Device & Usage Data

With your consent, we collect anonymised usage metrics such as which features you use most frequently, session duration, and crash reports. This data has no personal identifiers and is used purely to improve app stability and prioritise development. You can disable this in Settings → Privacy → Analytics.

1.4 Location Data

Location data (farm address, latitude, and longitude) is used to provide accurate hyper-local weather forecasts and localized farm management services. By default, location data is stored locally on your device. When Cloud Sync is enabled with your consent (under Profile Sync), your farm address and coordinates are securely stored in your private cloud account (Firestore) to synchronize weather forecasts and farm settings across your authorized devices. When resolving weather forecasts from your device, coordinates are sent to our integrated weather providers (OpenWeatherMap, WeatherAPI.com, and NOAA); we do not share your identity or farm boundaries with these providers. If you take part in benchmarking and set the location precision for shared data to regional or exact, only the half-degree grid cell (about 50 km across) containing your farm is sent for benchmarking (see 2.4). The app asks for your device’s location only when you choose to fill in a farm, field or service location from the device, or to show weather for where you are. It asks for approximate location only, only while the app is in use and never in the background, and you can always type an address or coordinates instead.

1.5 Communication Data

If you contact our support team, submit a ticket, or communicate via in-app chat, we retain that conversation history to provide effective support and to improve our knowledge base. Support communications are stored for up to 3 years.

1.6 Hardware Integration Data

When you pair Bluetooth devices (scales, EID readers, activity sensors), the pairing credentials and last-synced readings are stored locally on your device. No Bluetooth device data is transmitted to our servers.

2. How We Use Your Data

2.1 Core Agricultural Services

Your farm data is used to power Farmer Copilot’s core features: animal health tracking, breeding calendar automation, feed formulation, crop planning, financial reporting, and AI-powered health predictions. Farmer Copilot works even when offline — by default, these core services and most of our AI process your data locally on your device, using deterministic rules and on-device machine-learning models that need no internet connection. The optional cloud AI features are off until you turn them on, and the app asks you before it first sends anything; only the safety check on posts and comments you publish to the community runs without a switch (see 2.7).

2.2 Weather & Environmental Services

Coordinates for your farm or fields are shared directly with our weather data providers (OpenWeatherMap, WeatherAPI.com, and NOAA) to deliver hyper-local weather forecasts, frost alerts, and spray window calculations. Only coordinates necessary to fetch meteorological data are transmitted (never your name, account credentials, or farm boundaries). We do not share your personal identity with these providers.

2.3 AI & Machine Learning (Federated Learning)

If you opt in to "Community Learning" in More → Federated Learning or in Privacy Settings, your on-device AI model improvements (not your raw data) may contribute to our federated learning system. Under federated learning, your device trains a local model improvement on your data, and only the mathematical gradient update (with differential privacy noise, ε ≤ 1.0) is shared. Your raw animal records, financial data, or personal information is NEVER transmitted under this scheme. A minimum of 10 farms must contribute before any aggregate model is updated, preventing individual farm identification.

2.4 Benchmarking & Community Insights

Benchmarking lets you compare your farm with similar farms. It is off by default. To take part, a farm owner or manager turns on data sharing and the benchmarking switch for livestock, crops, feeds or finance in More → Federated Learning & Benchmarking → Sharing, or turns on “Compare my farm” on Finance → Statements or in Settings → Privacy & Data, which first shows exactly what will be sent and then turns benchmarking on for every area this section describes. Each person makes this choice for themselves on each farm, and only the devices of the farm’s owners and managers can contribute, so if any one owner or manager turns benchmarking on, that person can contribute the farm’s figures. A farm counts once, however many of its owners, managers or devices contribute.

What is sent. For each closed period (a calendar month for livestock and feeds, a calendar year for crops and finance), when an owner or manager contributes, the app sends our servers a small set of farm performance figures: average daily gain, milk yield per cow, calving interval, mortality rate and feed intake for livestock; yield per hectare for crops; feed conversion ratio for feeds; and, for finance, eight ratios from your financial statements, each shown with the range it must fall in: current ratio (0 to 10), debt-to-asset ratio (0% to 150%), rate of return on farm assets (−30% to 30%), rate of return on farm equity (−50% to 50%), operating profit margin (−50% to 50%), term debt coverage ratio (−5 to 10), operating expense ratio (0% to 150%) and asset turnover (0% to 150%). Each livestock, crop and feed figure is first limited to a fixed range (for example, average daily gain is kept between −0.5 and 2.5 kg per day, and a value outside the range is replaced by the nearest limit). A finance ratio is never limited that way: a ratio outside its range is withheld — not sent at all — because a value that far out usually means a missing record rather than a real result. The finance ratios are worked out on your device from your own records, only for a year whose opening and closing balance sheets balance and whose records cover at least six months and at least 24 entries; no amount of money, currency, account balance or transaction is sent, only the ratios. With the figures the app sends the period, the app version, and coarse descriptions used to group similar farms: the farm type (for finance, the operation type in your farm profile, or unknown); the species and, where it matches our breed list, the breed, or the crop (for finance, “whole farm”); a size band (such as 100–249 animals; for finance it may be unknown); the production system (for example pasture, confinement, organic, or unknown; always unknown for finance); and, only if you set the location precision for shared data to regional or exact and the farm has stored coordinates, the half-degree grid cell (about 50 km across) that contains the farm (the exact setting is still reduced to that cell for benchmarking). Your exact coordinates, name, email address and farm name are never sent for benchmarking.

How it is stored. The app sends the farm’s identifier with each contribution so that our server can check that you are an owner or manager of that farm. The server then stores the contribution under a pseudonym — a code computed from the farm’s identifier with a secret key unique to the farm — and never stores the farm identifier, your account identifier or your name with it. Because we hold the key, a stored contribution can in principle be linked back to the farm, so we treat it as personal data. Until a period is aggregated, our servers therefore hold your farm’s actual figures for that period (after the range limit above). Contributions for a period are accepted until 45 days after a month ends, 100 days after a quarter ends, or 120 days after a year ends; the period is aggregated after that.

What is published. When a period is aggregated, we add random statistical noise to every statistic we publish (differential privacy), so that the published results reveal very little about any single farm. A group’s statistics (an average and, for large groups, percentile bands) are published only if the group has at least 10 farms and is large enough that the added noise stays small compared with the range of the measure — in practice, several hundred farms, and for a finance ratio at least about 450. Groups are formed by the descriptions above, or by grid cell. Published statistics and the number of farms in each group are visible to signed-in Farmer Copilot users. Your identity and farm name are never published.

Deletion. Once a period has been aggregated, the individual contributions for it are deleted from our servers. We keep only the noised group statistics and a record of which groups were published or withheld. Until we start publishing benchmarks, aggregation does not run and contributions already received are kept until it does.

Turning it off, and erasure. You can turn benchmarking off at any time with the same switch. Your device then stops contributing, and contributions it has prepared but not yet sent are not sent. Turning benchmarking off does not remove contributions our servers have already received; they are deleted when their period is aggregated, as described above. When a farm is deleted — by its owner in the app, or because deleting your account deletes every farm you own alone (see 4.2) — its contributions that have not yet been aggregated, and its pseudonym key, are deleted with it. Leaving a farm, or deleting your account while the farm has another active member, deletes no benchmarking data, because the contributions belong to the farm. Neither turning benchmarking off nor deleting your account or farm withdraws statistics already published, because they cannot be traced to your farm; we may still remove a published statistic ourselves, for example if it was computed with a faulty measure or app version. Research contributions are a separate opt-in, described in section 3.5.

2.5 Service Improvements

Anonymised and aggregated usage patterns (e.g., "40% of users record health events weekly") may be used to prioritise feature development, optimise app performance, and personalise the app experience. No individual-level analysis is performed.

2.6 Legal Compliance & Safety

We may use or disclose your data where required by applicable law, government request, or to prevent fraud, abuse, or activities that could harm users, animals, or third parties. We are also required to retain certain financial and veterinary records for compliance audit purposes as required by law in your jurisdiction.

2.7 How AI Is Used in Farmer Copilot

Farmer Copilot works offline, including most of its AI. What we call AI comes in three tiers, and only the third sends anything to a server.

1. Rules and Smart Alerts. Fixed, deterministic rules run on your device and raise alerts on well-understood patterns — for example a heat-stress warning from temperature and humidity, a milk-yield drop of 15% or more within a week, an overdue vaccination or due date, a spray window closed by wind or rain, an unusual or duplicate transaction, or spending past a budget. They need no network and send nothing.

2. Machine-learning models on your device. These models run on your phone and work with no network connection: crop yield forecasting, weather risk and spray-window scoring (on the forecast your device has already downloaded), livestock health and condition risk, task priorities on the Today screen, learning recommendations, and photo analysis for plant diseases, weeds, animal body condition, and equipment condition. Baseline versions of these models are installed with the app so they work offline from first launch, and the app downloads updated model versions from our Firebase and Google Cloud Storage infrastructure when you are online. Downloading a model update sends no farm data, and nothing a model on your device reads or produces is sent anywhere because of it.

3. Optional cloud AI. Some questions need more than your device can answer. The optional cloud AI features — cloud photo analysis and cloud answers for Farm Copilot — are off by default. Each has its own switch in Settings → Privacy & Data, and the app asks you in context, the first time it would use it, before anything is sent — for example when the on-device model is unsure about a photo. Turning a switch off stops further sending straight away. The community safety check described below is different: it is part of publishing to the community and has no switch. Cloud AI can come from two kinds of source: Farmer Copilot’s own models, which we host in Firebase and Google Cloud Storage, and third-party AI providers, whose models our servers call for you. Today our own models run on your phone and receive updates from Firebase and Google Cloud Storage (tier 2), while cloud AI features use third-party AI providers or cloud-hosted models.

Cloud photo analysis (switch: Cloud photo analysis). When the on-device model is unsure about a disease, weed, body-condition, or equipment photo, or is unavailable, the app offers to analyze the photo in the cloud. With your consent it sends the photo, the kind of scan, and the crop, species and breed, or equipment type you chose. Our server passes them to a third-party AI provider and returns the answer. Images sent to the cloud for analysis are deleted once the analysis is done, whether it succeeded or failed: our servers never save the photo, its location or the result, and never write the photo or a link to it into our logs. We keep only the times you used the feature, to enforce a daily limit. The result is saved with the scan on your device.

Cloud answers for Farm Copilot (switch: Cloud answers for Farm Copilot). Farm Copilot first answers from the records on your device. When it cannot answer confidently, it offers to ask the cloud. With your consent it sends your question, the app language and a short summary of what your device found in your records (such as livestock, crop, feed, weather, or finance figures for a period) to a third-party AI provider; your name, account and farm identifier are not sent to the provider. Our servers keep neither the question nor the answer, only the times the farm used the feature, to enforce a daily limit; the conversation stays on your screen until you leave it.

Community safety check. When you publish a community post or comment, its title and text — not its photos and not your name — are sent to a third-party AI provider to screen for unsafe content, as part of publishing. It has no separate switch: it applies only to content you choose to make public, so if you do not want it, do not publish. The verdict is kept with the post for moderation.

Editorial tools. To decide which guides and answers to write, our editorial tools send a third-party AI provider the titles of popular public community posts and search terms that found nothing, without names, account identifiers or farm data.

How AI providers handle it. A third-party AI provider receives only what is described above, never your name, email address or account. It processes it under its API terms as our service provider; under the terms that apply to our account it does not use it to train its models, and it may keep it for a limited period to monitor for abuse before deleting it. We describe AI providers by category rather than by name.

Accuracy and continuous model improvement. Our machine-learning models are trained and continuously refined using agricultural research datasets, simulated scenarios where field data is scarce, and opted-in anonymised community data, and are updated over time as model performance matures. All AI features produce probabilistic output with an inherent error rate. Predictions, recommendations, and alerts are decision-support tools only — always confirm with a licensed veterinarian or qualified agricultural professional before acting on a critical health, breeding, crop, or financial decision. Farmer Copilot is not a substitute for professional advice (see section 6 of the Terms of Service).

3. Data Sharing & Third Parties

3.1 We Do NOT Sell Your Data

Farmer Copilot has never sold, and will never sell, your personal or agricultural data to advertisers, data brokers, financial institutions, agricultural commodity traders, or any other commercial third party. This is a core commitment.

3.2 Infrastructure Providers

We use Google Cloud Platform (GCP) for cloud storage and Firebase for authentication. These providers operate under strict data processing agreements that prohibit them from accessing your farm data for their own purposes. GCP is SOC 2 Type II, ISO 27001, and GDPR-compliant. The optional cloud AI features use third-party AI providers, which receive only what section 2.7 describes. PDF reports exported while the app is set to Chinese, Japanese or Korean, or that contain Chinese, Japanese or Korean text such as a farm, buyer or animal name in any language (finance statements, invoices, and crop, feed, livestock and dashboard reports alike), need large font files, so the first such export downloads the open-licence Noto font for that script from Google Fonts (fonts.gstatic.com) and keeps it on your device for later exports. What the download sends is unchanged: only a standard request for the font file — no account, farm or report data, and none of the text being printed — though, like any web request, it reveals your device’s IP address to Google.

3.3 Payment Processing

Subscription payments are processed by Apple, Google, or Stripe according to the purchase channel. Billing synchronization is necessary service processing and is not controlled by optional farm-data Cloud Sync consent. We send only account, catalog, price, subscription, and transaction identifiers needed to bill and verify access; no farm operational records are sent to a biller. Farmer Copilot does not store full card numbers, payment credentials, receipts, or raw purchase tokens. After verification, we retain only provider transaction and invoice references plus payload hashes needed for audit and fraud prevention.

3.4 Veterinary & Compliance Integrations

If you explicitly connect a third-party veterinary record system, livestock registry, or government compliance portal, only the specific data required for that integration is shared — nothing more. You can revoke any integration at any time in Settings → Integrations.

3.5 Research Partnerships

We partner with universities and agricultural research institutions. Research contribution is opt-in and separate from benchmarking. A farm first accepts a research consent form from a named institution in More → Research Partnerships, and automatic contribution must also be switched on there; that switch is off by default and applies to the device it is set on. For each closed quarter, the app then sends the research pool the farm measures that the consent covers, each with random statistical noise added on your device before it is sent (differential privacy), together with a coarse region (a grid cell about 100 km across, when the farm has stored coordinates), a farm-size band, the farm type, the period and the app version. Each contribution carries a pseudonym computed on your device from the farm and the farm’s research key, and different for each institution, so institutions cannot link the same farm across them. The farm has one research key. It is created on a farm member’s device and is kept only on your farm members’ devices, never on our servers: every member device of the farm holds it, and it passes between those devices only encrypted so that only they can read it. Because we never receive that key in a form we can read, we cannot link a research contribution to your farm. Your name, account, farm identifier and exact location are never sent. A farm has one pseudonym per institution and contributes each quarter once, however many devices it uses. Our servers add further noise, publish only statistics of groups of at least 10 farms, and delete individual research contributions within 120 days. Turning automatic contribution off or withdrawing a consent stops further contributions; contributions already sent cannot be singled out and withdrawn.

4. Data Retention

4.1 Active Account Data

Farm data, animal records, and production history are retained for as long as your account is active. You may delete individual records, entire animal histories, or your complete farm profile at any time through Settings → Data Management.

4.2 Account Deletion

When you request deletion, personal and farm data that is not legally required is erased or de-identified within 30 days. An active paid or grace-period subscription must first expire or be cancelled through its billing channel. Every farm you own alone (you are its owner and it has no other active member) is deleted in full: the farm record and all of its data, its files in our cloud storage, its service-provider engagements and their chats, and its benchmark data, including contributions not yet aggregated and its pseudonym key. Files uploaded to such a farm just before it is deleted are removed by a second sweep about an hour later. Farms that have another active member are not deleted; they and their data stay with those members. When an owner deletes a farm in the app, the farm is deleted in the same way. A deleted farm’s audit logs and billing entitlements are kept for legal and accounting purposes for seven years, with names, email addresses and account identifiers removed, and are then deleted. A request to delete a farm from anyone who is not its sole owner is refused in the same way whether or not the farm exists, so it reveals nothing about the farm. Billing-account membership and customer identifiers are then redacted; legally required invoice and transaction references and immutable approval/audit history remain under restricted access. Anonymised aggregate data, including published benchmark statistics (see 2.4), may be retained when it cannot be re-attributed to you.

4.3 Veterinary & Compliance Records

Billing invoice and transaction references and catalog approval/audit history are retained for seven years. Transient encrypted verification and retry payloads expire within 30 days. Other veterinary treatment and financial records may be subject to jurisdiction-specific statutory retention periods; we will inform you when such obligations apply.

4.4 Backup & Exported Data

Backups you create are stored locally on your device. If you use our Cloud Backup feature, encrypted backups are retained for 90 days after the most recent backup. You can delete cloud backups at any time in Settings → Data Management.

4.5 Community Posts & Comments

The community forum is a shared space: anything you post or comment there is visible to every signed-in Farmer Copilot user, not just your farm. Because other farmers rely on those answers, community posts and comments are NOT deleted when you delete your account — they are de-identified. Your name is replaced with "Deleted user" and your account identifier is replaced with a one-way code that cannot be traced back to you. The content stays; the attribution does not.

Everything that is about you rather than about farming is deleted outright: your community profile, direct messages, who you follow and who follows you, your social links, your bookmarks, and the record of which posts you voted on.

If you want a specific post or comment removed rather than de-identified, delete it before requesting account deletion, or contact support.

4.5a Community Sync & Your Consent

Publishing to the community requires your cloud-sync consent for the Community domain. If you have not given it, or you withdraw it, nothing further you write is uploaded — new posts and comments stay on your device.

Reading the community does not require that consent, and works whether or not you have given it. Reading sends no farm, livestock, crop, finance, or location data anywhere; it only fetches content other farmers have already chosen to publish. We treat reading a public noticeboard and pinning something to it as different acts, and only the second one needs your permission.

Withdrawing consent also deletes the personal material already uploaded: your community profile, direct messages, who you follow and who follows you, and your social links are removed from our servers, not merely frozen.

Posts and comments you have already published are NOT withdrawn. Other farmers have replied to them and rely on them, and consent governs the mirroring of your personal data rather than the retraction of a conversation other people are part of. To remove a specific post or comment, delete it directly. Deleting your account de-identifies the rest, as described in section 4.5.

4.6 Community Metrics

We measure two different things in the community, and treat them differently.

Aggregate metrics — view counts, impressions, and how often a topic is read — are counted without recording who did the viewing. They cannot be traced to you or to your account, and they are retained indefinitely so that popular content stays discoverable.

Account-attributable activity — the posts and comments you write, the votes you cast, and the items you bookmark — is linked to your account and is covered by section 4.5 above and by your rights in section 5.

5. Your Rights (GDPR & CCPA)

5.1 Right to Access

You have the right to request a complete export of all personal data we hold about you. Use Settings → Data Management → Export Farm Data, or contact us at privacy@farmercopilot.app.

5.2 Right to Rectification

You can correct any inaccurate personal data directly in the app. For data you cannot edit directly, contact our support team.

5.3 Right to Erasure ("Right to be Forgotten")

You can request account deletion from Settings → My Account → Delete Account, or by emailing privacy@farmercopilot.app. Erasure or de-identification is completed within 30 days after any active paid/grace access can be closed. Data that law requires us to retain, including restricted financial references and audit history, is excluded until its retention period ends.

5.4 Right to Portability

You can export all your farm data in standard formats (CSV, JSON) at any time. This includes all animal records, financial transactions, health logs, and production data.

5.5 Right to Object

You may object to the processing of your data for analytics, benchmarking, federated learning, research, or cloud AI at any time by toggling the relevant settings in Settings → Privacy & Data.

5.6 CCPA Rights (California Residents)

California residents have additional rights under CCPA, including the right to Know, the right to Delete, the right to Opt-Out of Sale (we do not sell data), and the right to Non-Discrimination. Submit a request to privacy@farmercopilot.app.

6. Security

6.1 Encryption

All data transmitted between your device and our servers is encrypted using TLS 1.3. Data at rest in our cloud database is encrypted using AES-256. Local device storage uses encrypted databases where your farm data is stored.

6.2 Authentication

We support multi-factor authentication (MFA), biometric login (Face ID / Touch ID), and OAuth2 social login with major providers. We strongly recommend enabling MFA for accounts with farm financial records.

6.3 Security Monitoring

We continuously monitor for unauthorized access, data breaches, and security vulnerabilities. In the event of a breach affecting your personal data, we will notify you within 72 hours as required by GDPR Article 33.

6.4 Bug Reporting

We maintain a responsible disclosure program. If you discover a security vulnerability, please report it to security@farmercopilot.app. We acknowledge all reports within 24 hours.

7. Cookies & Tracking

7.1 Mobile App

The Farmer Copilot mobile app does not use browser cookies. We use anonymous device identifiers for session management, which you can reset by clearing app data or reinstalling the app. If you allow notifications, a push notification token for your device is stored with your account so we can deliver alerts to it; we remove it when you sign out.

7.2 Analytics SDK

With your consent, we use an anonymised analytics SDK to collect crash reports and usage statistics. This SDK is configured to prohibit cross-app tracking and does not collect advertising identifiers (IDFA/GAID). You can opt out in Settings → Privacy → Analytics.

8. Changes to This Policy

8.1 Notification of Changes

We will notify you of material changes to this Privacy Policy via in-app notification, email, and/or a notice on our website at least 30 days before the change takes effect. Continued use of Farmer Copilot after the effective date constitutes acceptance of the revised policy.

8.2 Version History

Version 2.8 (October 2026, effective on publication; describes existing practice): Section 1.1 now says that signing in with a phone number collects that number, and what Apple and Google share with us when you sign in with them. Section 1.4 now says when the app asks for your device’s location: only when you choose to, approximate only, only while the app is in use and never in the background. Section 7.1 now says that a push notification token is stored with your account if you allow notifications. Version 2.7 (October 2026; not a material change under section 8.1, effective on publication): Rewrote section 2.7 on AI in three tiers — rules and Smart Alerts and on-device machine-learning models, which work offline, and optional cloud AI features, which are off by default, have a switch each and ask before they first send anything — and said what each cloud AI feature sends, that images sent to the cloud for analysis are deleted once the analysis is done, and how third-party AI providers, now described by category rather than by name, handle what they receive. It replaces the statement that raw farm data is never sent to a server for inference. Section 2.4 now declares finance benchmarking: the eight financial ratios sent for each closed year, the range each must fall in, and that a ratio outside its range is withheld rather than sent. Sections 2.1, 3.2 and 5.5 refer to the new section 2.7. Section 3.2 now says that the Chinese, Japanese or Korean font download also happens for a report that contains Chinese, Japanese or Korean text, such as a farm, buyer or animal name, in any app language, and fetches the font for that script; what the download sends is unchanged. Section 3.5 on research contributions now says that a farm has one research pseudonym per institution, computed from a research key kept only on the farm members’ devices and never on our servers, that institutions cannot link the same farm, and that published research statistics cover at least 10 farms, not 10 pseudonyms. Version 2.6 (October 2026; not a material change under section 8.1, effective on publication): Rewrote section 2.4 on benchmarking to say exactly what an opted-in farm sends (range-limited performance figures, coarse group descriptions and, optionally, a half-degree region cell) under a per-farm pseudonym; that our servers hold those figures until the period is aggregated; the differential-privacy noise and minimum group sizes applied to published statistics; deletion of individual contributions after aggregation; who can contribute; and what turning benchmarking off, deleting a farm, or deleting your account does and does not remove. Rewrote section 3.5 on research contributions to describe on-device noise, the per-device pseudonym and the separate automatic-contribution switch. Section 4.2 now says what deleting your account or a farm deletes in full and what is kept de-identified, and for how long; the Data Controller’s postal address is added; sections 1.4 and 4.2 cross-refer to 2.4. Sections 2.7, 4.5, 4.5a and 4.6, previously only in the app, are now also on this page, so the app and this page carry the same text; sections 2.1 and 2.7 explain how Farmer Copilot uses AI offline-first (deterministic Smart Alerts and on-device machine-learning models that work with no network connection, plus optional consent-gated cloud ML via Farmer Copilot models in Firebase / Cloud Storage or third-party AI providers, which version 2.6 named by example, where any photo sent for cloud analysis is deleted once the analysis is done). Version 2.5 (October 2026): The on-demand Chinese, Japanese and Korean font download now covers every exported PDF report, not only finance statements, and is triggered by the app’s language. Version 2.4 (October 2026): Disclosed on-demand Chinese, Japanese and Korean font downloads from Google Fonts for exported reports. Version 2.3 (October 2026): Farm location stored for cross-device sync under Profile Sync; weather providers corrected. Version 2.1 (March 2026): Added federated learning differential privacy disclosures, CCPA expanded rights, and hardware integration section. Version 2.0 (November 2025): Major revision covering Phase 2 AI features. Version 1.0 (January 2025): Initial policy.

9. Contact Us

Data Controller

Farmer Copilot Ltd.
Data Protection Officer: dpo@farmercopilot.app
Privacy enquiries: privacy@farmercopilot.app
Security reports: security@farmercopilot.app
Postal address: PO Box 6141, Wilmington, DE 19801, USA

Supervisory Authority

EU/UK users have the right to lodge a complaint with their national data protection authority (e.g., ICO in the United Kingdom, CNIL in France). We encourage you to contact us first so we can address your concern directly.