Privacy Policy

2.1 Information you provide

• Account and profile data — such as email address and credentials used to sign in.
• Content you submit — such as notes, labels, strain selections, grow records, and photos or other media you choose to upload.

2.2 Information from devices and sensors

• Environmental and operational data — such as temperature, humidity, CO₂, and related readings from connected hardware. This data is stored in application databases and in time-series storage (for example, InfluxDB) for charts, alerts, and historical views.
• Device and technical data — such as app version, device type, and diagnostic logs.

2.3 Information from permissions you grant

Hypha may request access to capabilities such as:

• Bluetooth — to discover and configure supported hardware (for example, Wi‑Fi pairing workflows).
• Location — only where required by the mobile operating system for Bluetooth scanning, device discovery, or Wi‑Fi setup / provisioning flows, and to estimate elevation for more accurate CO₂-related features. To look up elevation, the app may send approximate or precise coordinates (depending on your device, OS, and the location permission you grant) to a third-party elevation service (for example, Open‑Meteo); our servers do not receive those coordinates from that lookup. We do not use location for third‑party advertising. The operating system's permission prompt (and in-app explanations where we show them) describe why access is requested at the time you grant or deny it.
• Camera and photos — where you choose to capture or attach images in the app.
• Notifications — to deliver alerts you configure.

You can control many permissions in your device settings. If you deny a permission, some features may be unavailable.

2.4 Service providers (subprocessors)

We use third-party providers to operate Hypha. Their terms and privacy policies apply in addition to this policy.

Google LLC (Firebase and Google Cloud Platform)

• Firebase Authentication — account sign‑in and session management.
• Firebase Cloud Messaging (FCM) — push notifications.
• Google Analytics for Firebase — we may enable this to understand how the app is used. Where required in the EEA, UK, or Switzerland, we will implement in-product consent, consent mode, or an equivalent mechanism before collecting non-essential analytics.
• Google Cloud Platform — including Cloud Storage for uploaded media and compute hosting for our backend API.

Databases and time‑series (our deployment)

• PostgreSQL — primary application database.
• InfluxDB — environmental sensor telemetry and related time-series.

These databases run on infrastructure we operate (for example, Google Cloud or comparable hosting).

Payments

• Stripe, Inc. — payment processing for paid plans and one-time purchases. Card details go directly to Stripe; we keep only a payment reference, the amount, and the plan or purchase it was for.

We may introduce additional providers (for example, error reporting, billing, or email). When we add material new subprocessors that process personal information, we will update this policy or provide notice as required by law.

2.5 Sensitive personal information and location

Under some U.S. state laws (including the CCPA/CPRA), certain location data may be treated as sensitive personal information. We use such information only as described in this policy. California residents have rights to limit certain uses, as described in §9.

2.6 Age and app store information

Some laws (for example, Texas's App Store Accountability Act) require app stores to share age information with apps, and require apps to act on it. We receive and use:

• Age range — from Apple's Declared Age Range or Google Play Age Signals, where your device provides it. We keep only whether you are under 18 or an adult, which service told us, and when. We never ask you to type in your age.
• App store country — the country of your App Store or Google Play account. We keep only whether it is a country where some features are limited, not the country itself.
• App store transaction identifier — on iPhone, Apple's identifier for your Apple Account's copy of Hypha. We keep it so that, if a parent or guardian withdraws consent for a minor to use Hypha, we can apply that to the right Hypha account.

We use this information only to apply age and regional limits (for example, limited accounts can't publish public pages), to honour a parent or guardian withdrawing consent, and to show notices about significant changes that the law requires. We don't use it for analytics, advertising, or anything else.

3.1 Machine learning, analytics, and AI

Our commitments on data and ML. We build machine learning to serve growers, not to monetize them. When we use your data for ML development, we commit to the following:

• Purpose-bound use. We use your data to develop, improve, and secure Demeter products and services — including features that benefit the broader grower community, such as improved environmental models and contamination detection. We do not use your data to build products unrelated to cultivation and growing operations.
• No sale of your data. We do not sell your data, and we do not share your identifiable data with third parties for their own advertising or model training.
• No public exposure of your content. Your media, notes, labels, and grow records will not be published, displayed, or made accessible to other users in identifiable form without your consent. Where we use aggregated or de-identified data (for example, in research or benchmarks), we take reasonable measures to prevent re-identification.
• You stay in control. You may request that we limit or exclude your data from ML development at any time by contacting support@demetermycolabs.com, and we will honor that request going forward.
• Assistive by design. ML features are built to support your judgment, not replace it. Outputs are assistive and should not be treated as professional agronomic, medical, or safety advice.

If we use your content for purposes not described in this policy, we will notify you and, where required by law, obtain consent first.

3.2 Advertising and 'Do Not Track'

We do not currently use third-party advertising networks or cross-context behavioral advertising in Hypha. We do not currently respond to "Do Not Track" signals.

3.3 Sale of data

We do not sell your personal information as "sale" is defined under applicable U.S. state privacy laws. We do not use your content to publicly identify you without a lawful basis and, where needed, your consent. If these practices change, we will update this policy and, where required, seek additional consent.

6.1 Environmental time-series

How long raw telemetry remains available may depend on subscription tier, product settings, and automated retention or downsampling.

6.2 Account deletion

When you complete in-app account deletion, our systems remove your ability to sign in and delete account-linked records from primary databases. Some information may persist temporarily in encrypted backups, security logs, time-series databases, and aggregated datasets. We target completion within approximately 30 days, subject to technical propagation, backup rotation, and legal holds.

6.3 Withdrawn parental consent

If a parent or guardian withdraws consent for a minor to use Hypha, we keep a record that consent was withdrawn for that Apple Account's app store transaction identifier (§2.6). We keep it after the Hypha account is deleted, without any link to that account, so the withdrawal still applies if a new account is created on the same Apple Account. We delete it if consent is restored and you ask us to lift the limit.