Privacy Policy

1. Introduction

This Privacy Policy explains how Cat Barn LLC ("Company," "we," "us," "our"), an Idaho limited liability company, collects, uses, stores, and protects your personal information when you use the Verdica application ("App").

By using the App, you consent to the collection and use of information as described in this Privacy Policy. This Policy should be read alongside our Terms of Service.

Data Controller: Cat Barn LLC, Boise, Idaho, United States. Contact: [email protected].

EU/EEA Users: As Cat Barn LLC does not have an establishment in the European Union, and processes data of individuals in the EU, we acknowledge the obligation under GDPR Article 27 to designate a representative in the EU. If you are an EU/EEA user and wish to exercise your data rights, contact [email protected] and we will respond within the timelines specified in this Policy.

2. Data We Collect

2.1 Account Data (from Google OAuth)

2.2 User-Generated Data

2.3 Transient Data (not stored by us)

3. Data We Do NOT Collect

• ✗ No analytics — No Google Analytics, Firebase Analytics, Mixpanel, or any usage tracking
• ✗ No advertising SDKs — No ads, no ad networks, no ad identifiers
• ✗ No crash reporting — No Sentry, Crashlytics, or Bugsnag
• ✓ Anti-bot protection — A non-identifying session hash is generated from browser characteristics for automated access detection. No IMEI, advertising IDs, or hardware serial numbers are collected.
• ✓ Minimal cookies — One httpOnly, Secure session cookie for authentication only. SameSite policy is set to the most restrictive value supported by each access context (Strict for web sessions, adjusted for cross-origin authentication where required by the Android app). No tracking, analytics, or third-party cookies.
• ✓ Request integrity verification — API requests may include a cryptographic signature derived from the request payload and a server-side secret to verify request authenticity and prevent tampering. No personal data or device identifiers are included in this signature.
• ✗ No persistent location tracking — GPS is only used during a scan if you enable it, and is not stored
• ✗ No data sales — We do not sell, rent, lease, or trade your personal data to anyone
• ✗ No behavioral profiling — We do not build user profiles for marketing or advertising

4. How We Use Your Data

We use your data solely for the following purposes:

5. Third-Party Services

The App integrates with the following third-party services. Your substance/drug names are encrypted and NEVER shared with any third party.

We do not control the data practices of third-party providers. We encourage you to review their privacy policies.

6. Data Encryption & Security

6.1 Encryption at Rest

• Field-level encryption: 10 sensitive fields across 6 database tables are encrypted with AES-256-GCM (authenticated encryption with associated data). Each field uses a unique initialization vector.
• Disk encryption: The database volume is encrypted with LUKS full-disk encryption.
• Encrypted fields include: substance names, dosages, frequencies, notes, garden nicknames, Light Scout spot names, chat messages, and scan feedback.

6.2 Encryption in Transit

• All data transmitted between your device and our servers is encrypted via TLS 1.3 (HTTPS), managed by a dedicated reverse proxy with automatic certificate renewal.

6.3 Access Controls

• Server access is restricted to the application owner only (no employee access)
• Database credentials are environment-variable injected, not stored in code
• Application containers run as non-root user with read-only filesystem where possible

7. Data Retention

Legal Hold — Agreement Records: Upon account deletion, we retain the following pseudonymized data from each legal agreement you accepted (Terms of Service, Privacy Policy, Health Disclaimer) for seven (7) years from the date of account deletion, pursuant to GDPR Article 17(3)(e) (establishment, exercise, or defence of legal claims):

• Your email address
• An HMAC-SHA256 cryptographic hash of your email address (pseudonymized lookup key)
• Acceptance timestamp
• Your IP address at the time of acceptance
• Your user agent (browser/device identifier) at the time of acceptance
• The waiver type and version identifier
• A SHA-256 hash of the exact agreement text you accepted (cryptographic proof of what you signed)

This data is stored in an append-only audit log and is used solely for the purpose of proving your consent to these agreements in legal proceedings. It is never used for marketing, profiling, or any other purpose. The legal basis for this retention is compliance with a legal obligation (GDPR Art. 6(1)(c)) and the defence of legal claims exception to the right of erasure (GDPR Art. 17(3)(e)).

8. Your Rights Under GDPR (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

We will respond to all GDPR requests within thirty (30) days. You also have the right to lodge a complaint with your local data protection authority.

9. Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out of Sale: We do NOT sell your personal information. We do not share personal information for cross-context behavioral advertising. Therefore, no opt-out is required.
• Right to Correct: You may request correction of inaccurate personal information (CPRA addition).
• Right to Limit Use of Sensitive Personal Information: Your substance/drug names are encrypted and used solely for displaying interaction references. We do not use sensitive PI for purposes beyond providing the service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your rights, contact [email protected]. We will verify your identity and respond within forty-five (45) days.

10. Health Data & Special Category Data (GDPR Article 9)

We process this data only with your explicit consent (GDPR Art. 9(2)(a)), which you provide when you first access the interaction reference feature. You may withdraw consent at any time by deleting your substance entries within the App.

Your substance and drug names are:

• Encrypted with AES-256-GCM at rest — we cannot read them in plaintext without your session key
• Never shared with any third-party service (including Plant.id, Google Gemini, or Google Play)
• Never used for advertising, profiling, or any purpose other than displaying interaction educational references to you
• Permanently destroyed upon account deletion (encryption keys discarded)

HIPAA Disclaimer: Cat Barn LLC is not a HIPAA-covered entity. The App is not a medical device or health service. Substance data is collected for educational reference purposes only.

11. Children's Privacy

The App is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

If we discover that a child under 13 has created an account, we will immediately delete the account and all associated data. If you believe a child under 13 has provided us with personal information, please contact [email protected].

12. International Data Transfers

Our servers are located in the United States. If you access the App from the European Union, European Economic Area, or other regions with data protection laws, your data will be transferred to and processed in the United States.

For EU/EEA users, this transfer is based on:

• Your explicit consent (GDPR Art. 49(1)(a)) — you are informed of the risks of transfer to the United States (which lacks an EU adequacy decision for general data processing) and consent when you create an account
• Performance of contract (GDPR Art. 49(1)(b)) — necessary to provide the service

Scan photos sent to Plant.id are processed by Kindwise s.r.o. in the Czech Republic (EU), subject to GDPR directly.

13. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

• We will notify affected users via email within 72 hours of becoming aware of the breach (GDPR Art. 33)
• We will notify the relevant data protection authority within 72 hours
• We will notify the FTC as required under the Health Breach Notification Rule (16 CFR Part 318) if health data is involved
• We will notify the Idaho Attorney General as required under Idaho Code §28-51-105

Our internal breach response procedures are documented and tested.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• A prominent in-app notification requiring acknowledgment
• Email to your registered Google account address
• At least thirty (30) days before the changes take effect

Your continued use of the App after the effective date constitutes acceptance of the updated Privacy Policy. If you do not agree, you must stop using the App and delete your account.

15. Contact

For privacy inquiries, data requests, or complaints (response within 30 days for GDPR, 45 days for CCPA):

Cat Barn LLC
Email: [email protected]
Boise, Idaho, United States

EU residents may also contact their local data protection authority.