Privacy policy

Sparrow is software that farms use to run community-supported agriculture: seasonal shares, weekly deliveries, payments, and member email. It is operated by Strata Studio. This page explains what the software collects, who it goes to, and how to get it removed.

Two relationships, and which one is yours

Sparrow sits between two different kinds of people, and the answer to “who is responsible for my data” is different for each.

• If you are a member of a farm and you signed up on a farm’s own site, your relationship is with that farm. The farm decides what to collect, what to do with it, and how long to keep it. Sparrow stores and processes it on the farm’s instructions, and does not decide what happens to it. Ask the farm first; they can reach us for anything they cannot do themselves.
• If you are farm staff and you sign in at sparrowcsa.com to run a farm, your account is ours. We decide how it is handled, and this policy is the whole answer.

What Sparrow stores

For farm staff accounts: your name, your email address, and which farms you belong to. If you choose to sign in with Google, we receive your Google account identifier, email, and name, and nothing else — no access to your Gmail, Drive, contacts, or calendar. Each active sign-in session also records its IP address and browser user-agent string, which is how a session can be recognized and revoked.

For private farm trials and setup: Sparrow records when a verified owner first uses their one trial, the farm’s seven-day deadline and billing state, the selected starter type, whether the private preview and saved setup sections were completed, and the ordinary farm contact, website, address, season, share, fulfillment, and policy details the owner confirms. Expired trials keep those records so the owner can subscribe and continue instead of rebuilding the farm.

For a farm’s own subscription to Sparrow: the farm’s billing contact and, from Stripe, an identifier for the farm’s customer record and subscription, plus a copy of each invoice (amount, period, status, and a link to Stripe’s hosted copy). When subscription setup starts, Sparrow also keeps the contact name and email, return pages and expiry sent to Stripe, plus the hosted-session link and the Stripe customer, session, and subscription identifiers returned for each attempt. Those attempt records prevent an interrupted retry from creating a second recurring subscription. Sparrow also retains the contents of signature-verified Stripe billing events so an interrupted update can be retried without waiting for Stripe to send it again. This is the farm paying Sparrow, separate from members paying the farm. As with member payments, Sparrow never receives or stores the card number: it is entered on Stripe’s hosted page and managed in Stripe’s hosted billing portal.

For farm payout setup: Sparrow keeps the farm name, payout contact email, country, and a local attempt identifier exactly as sent when it asks Stripe to create the farm’s connected account. It also keeps the Stripe account identifier and the capability flags Stripe reports. This frozen attempt is used to find a created account safely if the original response is interrupted, instead of creating a second payout account. When a farm owner opens Stripe’s embedded Tax settings and Tax registrations controls, Sparrow creates a short-lived Account Session for that connected account. Sparrow does not store the Account Session client secret.

For farm members: your name, email address, phone number, and postal address. When an address is selected through Google Places, Sparrow also keeps its latitude and longitude so the farm’s radius or custom-area delivery rule can be checked; the coordinates are copied into the subscription and each order as the delivery destination changes. The rest of the member record includes the shares you are enrolled in, the deliveries you have received, the ones you skipped, weekly add-ons, prepaid delivery allocations and credits, and any items you asked to avoid; your pickup site or delivery zone; the exact farm and season agreement revisions you accepted; and your payment history. Your farm can also write private notes on your record, which are visible to the farm and not to you. If you joined a waitlist without creating an account, that is your email, your name, and anything you typed in the note field.

For payment methods: Sparrow never receives or stores your card number. Cards are entered on Stripe’s own hosted payment page and stay with Stripe. What Sparrow keeps is an identifier Stripe gives us, plus the card’s brand and last four digits, so an agreed per-delivery payment can be charged and you can tell which card is on file. When an online checkout or card setup starts, Sparrow also keeps the Stripe session identifier and hosted-page link, the description, email address, return pages, and expiry sent to Stripe; payment checkouts also keep the amount. That snapshot makes a retry repeat the same request instead of silently changing it. Sparrow also retains the contents of signature-verified Stripe payment and refund events so an interrupted update can be retried without waiting for Stripe to send it again. Payment history includes each line’s reviewed product type and Stripe tax code, the tax amount Stripe calculated, and Stripe’s tax calculation, transaction, and refund reversal identifiers when they apply.

For farm operations: a record of significant actions taken inside a farm’s account — who changed what and when — kept so a farm can answer its own questions later. Deliveries record who marked them and at what time. Delivery events collect no proof photos, signatures, or location tracking. Farm staff may separately upload public storefront and season images. Pickup sites may keep selected address coordinates, and radius delivery zones may keep a selected center label and coordinates. A farm may also keep its editable member agreement and native privacy-policy drafts and immutable published revisions in Sparrow.

For optional Google Places search: while an authenticated farm user or member types in a Google-assisted farm, pickup, radius-center, or delivery-address field, Sparrow sends the typed text and a temporary search-session token to Google. Resolving a selection returns its structured address and coordinates; farm lookup may also return the listing’s display name, business status, national phone number, and website. Sparrow does not store the typed search, Google Place ID, temporary token, or raw Google response. Only ordinary details the user saves are retained. Manual address entry remains available when search is unavailable or no result is suitable; a geometry-based delivery entered without coordinates is marked for the farm to review.

What Sparrow does not do

There is no analytics, no advertising pixel, and no tag manager. Nothing you do here is measured for anyone else. One thing does report outward: when a page or a request fails, a description of the failure goes to Sentry so that we can fix it. That is breakage, not behaviour — it happens only when something goes wrong, and what it carries is listed below. We do not sell personal information, we do not share it for advertising, and we do not build profiles across farms: a farm can see its own members and nothing beyond that.

Cookies

Sparrow sets one kind of cookie: a sign-in session cookie, named with the prefix sparrow-auth. It exists so that you stay signed in between pages, and it is scoped to the site you signed in on — a session on one farm’s site is not a session on another’s. There are no advertising, analytics, or tracking cookies, which is why there is no cookie banner to click through.

Who else sees it

Sparrow runs on other companies’ infrastructure. These are all of them:

• Vercel hosts Sparrow’s Next.js application, including its authenticated pages, API routes, webhooks, and image delivery.
• Railway runs Sparrow’s scheduled maintenance worker.
• Neon hosts the PostgreSQL database where everything above is stored.
• Stripe processes payments and holds card details. Member charges are created on Sparrow’s platform account and settled to the farm’s connected account; the farm remains the seller and settlement merchant. Stripe’s privacy policy governs the card and tax data it holds. Stripe Tax uses the connected account’s Tax settings and registrations plus the product type supplied with a charge to calculate and record member-sales tax for that farm. Stripe also bills each farm for its own Sparrow subscription. Where a farm collects from members through Sparrow, Sparrow records its platform fee, Stripe’s processing fee, tax allocations and provider references, and the amount settled to the farm.
• Cloudflare R2 stores farm-uploaded storefront and season images. Uploads use short-lived links, and published images are normalized before they are served from Sparrow’s media domain.
• Resend delivers transactional email — sign-in links, enrollment confirmations, delivery notices, receipts, farm-trial reminders, and one internal notice to Sparrow when a new farm signs up. The relevant email address, farm name, and message contents pass through it.
• Google handles Google sign-in when a farm staff member chooses it. Google Places also receives the typed text and temporary session token from an optional farm or fulfillment lookup, and returns the selected listing or address details described above.
• Sentry receives a report when a page or a request fails: the error message, the place in our own code it came from, the address of the page without anything after the question mark, and your browser’s name and version. It is configured to receive nothing else — no cookies, no form contents, no database values, and no recording of your screen.

Beyond these, information is disclosed only when the law requires it, or to the farm you belong to.

How long it is kept

Until it is deleted. Sparrow has no automatic expiry: a farm’s records stay while the farm uses the service, because a farm needs its own history. We would rather say that plainly than publish a retention schedule no software enforces. Deletion happens on request, as below.

Getting your data, or getting it deleted

If you are a member of a farm, ask the farm — it is their record, and they can export it, correct it, or delete it. If they need help, or if you would rather come to us directly, email james@stratastudio.dev and say which farm you belong to.

If you are farm staff, email the same address. We will confirm you are who you say you are before acting, since account data is exactly what someone impersonating you would want.

Deleting a member record removes personal details. It does not erase a farm’s financial history: records of payments and refunds are kept because a business has to be able to account for money it took, and because Stripe keeps its own record regardless.

Where it is held

Sparrow’s infrastructure is in the United States. If you are reading this from elsewhere, your information is processed there.

Children

Sparrow is software for running a farm business. It is not directed at children and accounts are not knowingly created for anyone under 13.

Security, honestly

Each farm’s data is isolated at the database level, so one farm’s queries cannot reach another’s. Sign-in is passwordless — a one-time email link, or Google — so there is no password of yours for us to lose. Access to the platform console requires a current Google-authenticated session. Card numbers never touch our systems.

What we will not claim: Sparrow has no third-party security certification, no completed audit, and no guarantee against breach. It is a young product. If we ever discover a breach affecting your information, we will tell you and the affected farm rather than wait to be asked.

Changes

If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and farms are emailed. Small corrections just change the date.

Contact

james@stratastudio.dev