Privacy Policy · Row & Bed

The short version

We collect what we need to run Row & Bed for you: an email address so you can sign in, your ZIP so we can match your garden to real weather data, your payment details (held by Stripe, not by us), and the garden data you create — beds, plants, notes, eventually photos. We use that to deliver the product you paid for, to talk to you about your account, and to make the product better. We use a small set of service providers (listed below) who receive the data they need to do their specific job. We don't operate outside the US and don't intentionally serve anyone under 13. You can access, correct, export, or delete your data by emailing us.

1. Who we are

Row & Bed is operated by ABS Ventures LLC, an Alabama limited liability company, doing business as "Row & Bed." In this policy, "Row & Bed," "we," "us," and "our" refer to ABS Ventures LLC DBA Row & Bed.

Contact: hello@rowandbed.com. Designated privacy contact: Andy Smith.

2. Information we collect

We collect the following categories of information, and only these categories:

2.1 Information you give us directly

Account info. Your email address. Optionally your name. Your password is stored as a one-way hash; we never see or store it in readable form.
Location. Your ZIP code. We use it to look up your USDA zone, your NOAA weather grid cell, and your climate normals. We don't collect precise GPS location.
Garden data. The beds you set up, the plants you add, the notes and journal entries you create, and (in a future version) photos you upload for the plant health check-in feature.
Payment info. When you subscribe, Stripe collects your card details. We never receive the card number — we only receive a Stripe Customer ID and the last four digits for display in your account. See Stripe's privacy policy at stripe.com/privacy.
Support and correspondence. If you email us or submit a correction through the app, we keep that message so we can respond and track fixes.

2.2 Information collected automatically

Usage data. We use PostHog (privacy-focused product analytics) to understand which pages and features are used. We configure PostHog to avoid collecting personally identifying information where possible.
Technical data. Standard server logs — IP address, browser type, pages requested, timestamps. Used for security and debugging, kept short-term.

2.3 Information from third parties

We look up weather and climate data from NOAA (public API) using your ZIP. No identifying information about you is sent to NOAA.

3. How we use your information

To provide the product you signed up for — giving you zone-aware, weather-informed guidance for the plants in your garden.
To communicate with you about your account — sign-in, billing, receipts, and transactional notices.
To send product updates and marketing emails if you've opted in. Every marketing email includes a one-click unsubscribe.
To improve Row & Bed — analyze usage patterns, fix bugs, and decide what to build next.
To enforce our Terms of Service and to protect against fraud or abuse.
To comply with law — respond to legal process, prevent harm, exercise or defend legal claims.

4. Service providers we use

We use a small set of vendors to run the product. Each receives only the data it needs for its specific job.

Service

Role

What they receive

Supabase

Auth, database, file storage

Email, hashed password, garden data, photos

Stripe

Payment processing

Name, email, card details (direct to Stripe)

Resend

Transactional & marketing email

Email, name, message content

PostHog

Product analytics

Usage events, anonymized where possible

NOAA (US National Weather Service)

Weather & climate data

No personal data — only your ZIP is used for lookup

We don't currently sell personal information to data brokers. Our service providers are contractually limited to processing data on our behalf for the purposes listed above.

5. Cookies and similar technologies

We use the minimum set of cookies needed to keep you signed in and to understand site usage. PostHog sets an anonymous session cookie. Stripe sets cookies on payment pages for fraud prevention. We don't use cross-site advertising cookies.

6. Your rights

No matter what state you live in, you can:

Access the personal information we have about you.
Correct anything that's wrong.
Delete your account and associated data.
Export your garden data in a portable format.
Opt out of marketing emails (transactional emails remain necessary to operate your account).

To exercise any of these rights, email hello@rowandbed.com. We'll respond within 45 days, with a single 45-day extension available for complex requests.

6.1 Additional rights for residents of states with comprehensive privacy laws

If you live in a state that has passed its own comprehensive privacy law — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, among others — your state law may give you additional rights beyond the ones listed above.

In every case we recognize the following, regardless of whether your state's specific law currently applies to us:

Right to know. You can ask us what personal information we have collected about you in the previous 12 months, where we got it, why we collected it, and who we shared it with.
Right to delete. You can ask us to delete personal information we have about you, subject to the narrow exceptions recognized by applicable law (for example, information we need to complete a transaction, detect fraud, or comply with a legal obligation).
Right to correct. You can ask us to correct inaccurate personal information.
Right to data portability. You can ask us to send your garden data to you in a machine-readable format. The fastest path is the in-app export at Settings → Data.
Right to opt out of "sale" or "sharing." We do not sell or share personal information as those terms are defined by state law. If you want an opt-out recorded on your account, email us and we'll record it.
Right to opt out of targeted advertising. We do not engage in targeted advertising as defined by state law. If you want an opt-out recorded, email us and we'll record it.
Right to limit use of sensitive personal information. We do not process sensitive personal information as defined by CCPA/CPRA or by equivalent state statutes — we don't collect Social Security numbers, precise geolocation, health information, biometric data, login credentials for other services, or contents of personal mail or messages.
Right to appeal a denied request. If we deny a privacy request, we will explain why in writing and describe how to appeal. Details at privacy-requests.html §7.
Right to non-discrimination. We will not deny you service, charge you a different price, or degrade the quality of Row & Bed because you exercised any of these rights.

To exercise any of these rights, email hello@rowandbed.com with the subject Privacy request and mention the state you live in, or follow the detailed instructions at privacy-requests.html.

6.2 California residents — additional disclosures

This section applies if you are a California resident. It supplements the rights described above.

Notice at Collection. At or before the point we collect personal information from you, we provide notice of what we collect and why — this policy serves as that notice. The categories of personal information we collect, the business or commercial purpose for collecting each category, and the categories of third parties we share each with are described in sections 2, 3, and 4 above.

Categories of personal information collected in the last 12 months, using the categories defined by CCPA/CPRA:

Identifiers — name (optional), email address, ZIP code, Stripe customer reference, IP address (from server logs), a hashed user ID for analytics.
Customer records — billing information held by Stripe (we only see last-four digits of the card and Stripe's reference).
Commercial information — subscription plan, purchase date, payment status.
Internet or other electronic network activity — pages visited, features used, device and browser type, anonymized interaction events via PostHog.
Inferences — your USDA zone, NOAA weather grid, and climate normals, derived from your ZIP.
User-generated content — the beds, plants, notes, corrections, and (in a future version) photos you create in the app.

We have not collected the following categories in the last 12 months: protected classification characteristics, biometric information, geolocation data more precise than ZIP, sensory data, professional or employment information, education information, or sensitive personal information as defined by CPRA.

Business and commercial purposes for collection. To provide and maintain the service you paid for; to process payments; to communicate with you about your account; to improve the product; to prevent fraud and enforce our Terms; to comply with law.

Sale and sharing declaration. We have not "sold" personal information in the last 12 months as that term is defined by CCPA/CPRA, and we do not currently sell personal information. We have not "shared" personal information for cross-context behavioral advertising, and we do not currently share personal information for that purpose.

How to exercise California rights. Email hello@rowandbed.com with the subject California privacy request, or follow the instructions at privacy-requests.html. We will respond within 45 days, with a single 45-day extension available for complex requests, consistent with CCPA/CPRA. We will not charge you for a reasonable request. If we deny your request, you may appeal by replying to our denial and we will respond within 45 days.

Authorized agents. You can designate an authorized agent to make a request on your behalf. We will require proof of the agent's authorization (such as a signed permission, a power of attorney, or direct verification from you) before we act on the request.

"Shine the Light." California Civil Code §1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

6.3 Appeals

If we deny any privacy request, we will explain the reason in writing and describe how to appeal. You can appeal by replying to our denial email or by emailing hello@rowandbed.com with the subject Privacy appeal. We will respond to appeals within 45 days, or within the shorter window required by your state's law if applicable.

7. Children's privacy

Row & Bed is not intended for users under 13. We don't knowingly collect personal information from children under 13. If you believe a child has signed up, email us and we'll delete the account.

8. Data retention

We keep your account data while your subscription is active and for a reasonable period after you cancel (so you can come back without starting over). If you delete your account, we remove your personal data from active systems within 30 days. Some data may persist in backups for up to 90 days after that, after which it is overwritten.

Support emails and correction submissions may be retained longer, without personal identifiers, for quality and auditing purposes.

9. Security

We use standard industry practices to protect your information — encryption in transit (TLS), encryption at rest for databases and file storage, hashed passwords, access controls, and the least-privilege principle for internal access. No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you without unreasonable delay, and in any case within the time required by the applicable state breach-notification laws that cover you. In practice we commit to notifying you within 30 days of confirmed discovery, and sooner where your state's law or the nature of the breach requires faster notice.

10. Where your data lives

Row & Bed is a US-only product. Our service providers (Supabase, Stripe, Resend, PostHog) host data in the United States. If you access the service from outside the US, your information will still be transferred to and stored in the US.

11. Third-party links

We link out to extension-service pages, seed-company grower libraries, YouTube videos, and similar references. Those third-party sites have their own privacy practices. We don't control them.

12. Changes to this policy

If we make a material change to this policy, we'll notify you by email and post an update at the top of this page. Routine clarifications and non-material changes will simply update the "Last updated" date.

13. Contact

Privacy questions, requests, or complaints: hello@rowandbed.com.