Privacy Policy
CasaGrown, Inc. (dba "MyYardWatch", "we", "us", or "our") · Effective Date: September 10, 2026
Executive Privacy Summary
At MyYardWatch, we treat your home exterior, garden scans, and family privacy with institutional-grade security. We collect camera video scans, sensor telemetry, and optional facial recognition portraits strictly to deliver AI diagnostic reports, automate microclimate protection, and filter perimeter security alarms.
01. Information We Collect
We collect personal information that you provide directly, data generated automatically through platform use, and telemetry received from paired IoT hardware:
A. Account & Property Information
- Contact & Identity: Name, email address, mobile phone number, and authentication credentials (hashed passwords, one-time passcodes via SMS/Email).
- Property Telemetry: Physical address, boundary parcel area (
lot_size_sq_ft), planting zone configurations, and plant specimen inventories. - Billing Data: Payment transaction references, subscription tier identifiers, and promo code redemptions. (All credit card processing is handled by Apple App Store, Google Play, or Stripe; CasaGrown does not store raw credit card numbers or CVVs).
B. Video Scans, Diagnostic Keyframes & Camera Streams
- Walkthrough Scans: Continuous 30-to-60 second video recordings of your property exterior captured through the mobile viewfinder.
- Diagnostic Keyframes: High-resolution extracted still frames analyzed for plant diseases, fungal infections, weed infestations, and structural defects.
- IoT Camera Feeds: Motion-triggered video clips, RTSP streams, and snapshots from paired smart cameras (Tuya OpenAPI, CasaCam solar hubs).
C. Biometric Facial Recognition Data (Family Members)
To prevent false security alarms and unwanted sprinkler deterrence, our mobile app allows homeowners to enroll family members through facial portrait captures (family_member_faces).
- Specific Purpose: Biometric facial embeddings are used solely to compare camera detection snapshots against enrolled family members to silence Night Watch perimeter alarms.
- Informed Written Consent: We collect biometric data only after you provide explicit, affirmative in-app consent before facial enrollment.
- No Commercial Exploitation: CasaGrown will NEVER sell, lease, trade, or monetize biometric identifiers.
- Retention & Deletion Schedule: Biometric data is permanently destroyed when: (1) you delete the family member from the app; (2) you close your account; or (3) within three (3) years of the user's last interaction with the platform, in strict compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14/) and California privacy statutes.
D. Geolocation, Weather & Actuator Telemetry
- Geolocation: Property geographic coordinates (latitude and longitude) used exclusively to query localized weather forecasts via Open-Meteo for frost (<32°F), heatwaves (≥95°F), and rain-skip predictions.
- Actuator Telemetry: Sprinkler controller runtimes, valve trigger timestamps, water burst durations, and skip logs from paired smart controllers (Rachio, Tuya).
02. How We Use Your Data
We process your information for legitimate business and operational purposes:
- AI Horticultural Diagnosis: Generating real-time analysis of plant pathologies, pest entries, and structural defects using multimodal Google Gemini vision models.
- Search Grounding & Cost Estimation: Chaining Google Search Grounding to estimate local plant replacement and repair costs without sharing personal identifiers.
- Perimeter Defense & Intrusion Filtering: Executing real-time biometric comparisons to filter family members from intruder alarms and actuating smart deterrents.
- Microclimate Weather Protection: Delivering actionable push notifications for upcoming frost, severe heat stress, and automated irrigation rain skips.
- Service Communications: Dispatching OTP codes via Postmark/Twilio and notifications via Expo Push.
03. Cloud Infrastructure & Subprocessors
We partner with industry-leading cloud providers who adhere to strict data processing agreements and enterprise security standards:
| Subprocessor | Purpose | Data Transferred | Security & Location |
|---|---|---|---|
| Cloudflare, Inc. | Cloudflare R2 Object Storage | Encrypted video scans, diagnostic keyframes | AES-256, SigV4 presigned URLs (US) |
| Google Cloud / Gemini | Multimodal AI Vision & Grounding | Keyframe imagery, plant health prompts | Zero training on customer scans (US) |
| Supabase, Inc. | Database, Auth, Edge Functions | Relational account data, telemetry, logs | PostgreSQL RLS, TLS 1.3 (US) |
| Postmark (ActiveCampaign) | Transactional Email Dispatch | Recipient email, invitation & OTP tokens | DKIM/SPF, TLS (US) |
| Twilio Inc. | Transactional SMS Dispatch | Phone numbers, OTP verification codes | SOC 2 Type II (US) |
| Expo (650 Industries) | Mobile Push Notifications | Expo push token, alert titles & bodies | APNs / FCM encrypted transit |
04. California Consumer Privacy Act (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information:
Right to Know & Access
Request disclosure of the categories and specific pieces of personal information we have collected about you over the past 12 months.
Right to Delete
Request permanent deletion of your personal information, video scans, and biometric records, subject to legal exceptions.
Right to Correct
Request correction of inaccurate personal information maintained in your profile or property records.
Right to Limit Sensitive Data
Limit the use of sensitive personal information (biometric data, precise geolocation) strictly to necessary service operations.
Notice of No Sale or Sharing: CasaGrown does not sell personal information and does not share personal information with third parties for cross-context behavioral advertising.
To exercise your California privacy rights, submit a verifiable consumer request to privacy@myyardwatch.com. We will respond within 45 calendar days.
05. European & UK Privacy Rights (GDPR)
For users in the European Economic Area (EEA) and the United Kingdom, CasaGrown, Inc. operates as Data Controller. Our legal bases for processing under GDPR Article 6 and Article 9 include:
- Contract Performance (Art. 6(1)(b)): Providing diagnostic yard walkthroughs, weather alerts, and hardware integrations.
- Explicit Consent (Art. 9(2)(a)): Processing biometric facial portraits for family member recognition. You may withdraw consent at any time.
- Legitimate Interests (Art. 6(1)(f)): Protecting our platform from intrusion, fraud, and security vulnerabilities.
You maintain the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You also have the right to lodge a complaint with your local EU/UK data protection supervisory authority.
06. Children's Privacy (COPPA)
Our services are directed exclusively to property owners, tenants, and adults aged 18 and older. We do not knowingly solicit or collect personal information from children under 13 (or under 16 in the EEA). If we learn that personal information of a child has been collected without parental consent, we will promptly purge the data.
Contact Privacy & Data Protection
If you have questions, inquiries, or requests concerning this Privacy Policy or our biometric and video data practices, contact our Data Protection Officer:
CasaGrown, Inc.
Attn: Privacy & Data Protection Officer
548 Market St, Suite 34567, San Francisco, CA 94104
Email: privacy@myyardwatch.com
DPO: dpo@myyardwatch.com