Privacy Policy · homegrown

1. Who we are

homegrown ("homegrown," "we," "us") is an independent Kentucky-based education and transparency platform serving certified patients, caregivers, practitioners, cultivators, processors, dispensaries, and industry partners operating under KRS Chapter 218B. homegrown does not sell, ship, or distribute cannabis products.

2. Information you provide

Account details: name, email, ZIP code, optional phone, role (patient, caregiver, cultivator, etc.).
Date of birth used solely to confirm you are 21 or older.
Patient verification submissions: card state, last 4 digits of the registry/medical-card identifier, expiration, and an uploaded document image.
Profile content: avatar, bio, follows, collections, and any feedback you submit.

3. Information collected automatically

Device and browser information (user agent) for security, fraud prevention, and analytics.
Page views and feature usage to improve the beta experience.
Standard server logs (IP address, user agent, timestamp) retained for up to 90 days.
Sign-in and session events. Each time you sign in, we record a timestamped session event that includes your account, IP address, and user agent. We use these records to detect suspicious activity, protect your account, and understand aggregate beta usage.
Approximate location from IP. We derive an approximate city, region, and country from your IP address at sign-in using a third-party geolocation lookup (ipapi.co). We do not use precise device GPS, and we do not attempt to identify your street-level address. City-level geolocation is used only in aggregated administrator analytics (for example, "sign-ins by city this week") and to help investigate account-safety incidents.
Kentucky county (self-reported). Your county, when derived from the ZIP code you provide in your profile, may be shown to homegrown administrators in aggregate Kentucky-county analytics. This is separate from IP-based geolocation.

4. How we use information

Operate accounts and the patient verification workflow.
Confirm Kentucky residency and 21+ age eligibility.
Provide personalized education, follows, collections, and notifications.
Investigate abuse and protect the integrity of the directory and reviews.
Communicate program updates, beta feedback requests, and account notices.
Produce aggregate, administrator-only analytics (sign-in trends, Kentucky-county representation, approximate city-level traffic) to improve the beta.

5a. Third-party geolocation lookup

To translate an IP address into an approximate city/region/country, we send the IP address (and no other personal information) to ipapi.co, a third-party geolocation provider, at the time you sign in. The response is stored alongside your session event. We do not share your name, email, verification details, or any other profile data with this provider.

5. Verification documents

Documents uploaded for patient verification are stored in a private, access-controlled bucket and are visible only to homegrown administrators reviewing your submission. They are retained while your verification remains active and deleted within 90 days of denial or account closure.

6. Sharing

We do not sell personal information. We share data only with: (a) infrastructure providers under contractual confidentiality (hosting, database, email delivery, analytics, mapping); (b) law enforcement when required by valid legal process; and (c) successors in the event of a merger or acquisition, subject to this Policy.

7. Your choices

You may edit your profile, unfollow accounts, and clear collections at any time.
You may delete your account by contacting privacy@homegrownky.com.
You may opt out of non-essential email through unsubscribe links in those messages.

8. Children

homegrown is intended only for Kentucky residents 21 years of age or older. We do not knowingly collect information from anyone under 21. If we learn we have collected such information, we will delete it promptly.

9. Security

We use industry-standard safeguards including encrypted transport (TLS), encrypted-at-rest storage, row-level security on user data, and restricted administrative access. No system is perfectly secure; please use a strong, unique password and enable any available multi-factor options on your sign-in provider.

10. Changes to this policy

We may update this Policy as the platform evolves. Material changes will be announced in-app or by email at least 7 days before they take effect.

11. Contact

Questions, requests, or concerns: privacy@homegrownky.com.