Privacy Policy

1. Scope and contact

OnTheFarm ("OnTheFarm," "we," or "us") operates the OnTheFarm iOS app and onthefarmapp.com. OnTheFarm is a Stanford-first campus events and social-planning service.

Privacy questions and requests can be sent to privacy@onthefarmapp.com or mailed to:

2. Information we collect

Optional automatic diagnostics in the iOS app are off by default. You can opt in under Profile → Privacy & Sprout AI → Share anonymous diagnostics, and turn this off at any time. These reports contain only feature areas, error counts or numeric crash codes, app and iOS versions, and the device type (iPhone or iPad). They contain no account identifier, name, email, location, message content, screenshots, or raw call stacks. Withdrawing consent stops future reports. Network providers still process the connection metadata needed to deliver and protect the service.

Manual bug reports are associated with your account. A bug-report screenshot is attached only when you choose to include it. The report screen lets you review and remove the screenshot before sending.

3. Permission-based features

OnTheFarm requests a system permission only when a feature needs it. You can decline or later revoke a permission in Settings.

• Location. When-in-use location centers maps, measures distance, and supports nearby recommendations. If you grant Always Location for ambient discovery, iOS may deliver low-power significant-location changes and visit events while the app is not open. Continuous precise location runs only during an explicitly started transit ride, directions session, or one-hour live share with a friend; the system location indicator remains visible while it runs. When iOS wakes the app in the background to look for events starting soon nearby, the app downloads public events and compares them with your last known location on the iPhone; that check does not send your location to OnTheFarm.
• Photos and camera. Used for images you select or capture for flyers, profiles, event albums, messages, photos of places and dishes, and bug reports, and for QR scanning. A place or dish photo is re-saved on your iPhone before it is sent, which leaves its location and other camera details behind. An image is saved to your library only when you choose that action.
• Calendar. Calendar events are read on your device to calculate whether a time is free. Event titles and calendar contents are not uploaded for that availability check. OnTheFarm writes an event only after you choose Add to Calendar.
• Apple Music. On your request, the app searches Apple's catalog and stores selected track metadata with an event. Subscription eligibility is checked on device; OnTheFarm does not store your Apple Music subscription status.
• Local network and Bluetooth. Find friends nearby uses peer-to-peer discovery only while that feature is active. Devices advertise an ephemeral peer name and short-lived server-issued discovery token, not a person's name, email, location, contacts, or profile. The server resolves a selected token after account and block checks.
• Motion. Device tilt can drive artwork depth effects. Motion readings stay on the device.
• Microphone and speech recognition. Used only when you choose voice input in Sprout. Apple's speech recognition, which can send the audio to Apple to transcribe it, turns what you say into text in the message box. OnTheFarm receives the text you send, not the recording.
• Notifications and Live Activities. Used for event, message, safety, and time-sensitive updates you enable. Device tokens are associated with the account or activity needed to deliver them. Class reminders are scheduled on your device. Every alert OnTheFarm's server sends you is also saved to your in-app Notifications list with its title, text, and the identifiers needed to open it; for a message, that text is a preview of up to 180 characters. Saved alerts older than 30 days are deleted the next time your list loads. If your account is Stanford-affiliated, OnTheFarm can also send the AlertSU updates Stanford posts on emergency.stanford.edu; turn Stanford Emergency Alerts off in Settings to stop them. Morning Weather, under Daily Digest, starts off. When you turn it on, your phone picks the nearest of OnTheFarm's areas (such as Stanford or San Francisco) from your location, and you can change it. OnTheFarm saves only that area, never your position, and around 7:30 AM sends you its forecast with what to bring; on a chilly or wet morning it may name a café open in that area.
• Closed-app class countdowns. On by default if Live Activities are allowed. The app sends OnTheFarm the next seven days of class meetings (course code, class name, room, start and end times), a Live Activity start token, and an identifier for this app on this device, so the countdown can begin before class without the app open. The token is stored encrypted. Turning Start it when the app is closed off in the quarter planner deletes that schedule and token from OnTheFarm's servers, as does deleting your account; each upload expires after the week it covers.
• Class website alerts. On by default. To notify you while the app is closed, OnTheFarm stores the course codes you follow, but not the planner's assignments or full schedule. Turn Alerts when the app is closed off in the quarter planner to delete that subscription.
• Live location sharing. Only when you choose Share live for 1 hour in a chat with a friend, the app sends updated coordinates to OnTheFarm. Only that friend and your account may retrieve them. You can stop the share from its chat card, and it expires after one hour. A static map point remains in the sent message as a fallback; live updates stop when the share ends. For shares started since October 5, 2026, when the share stops or runs out, OnTheFarm puts the stored position back to the point it started from, so no later position is kept. While the share is live, that friend's Sprout can tell them roughly how far away you are (section 5).
• Hop on (transit rides). When you hop on a bus or train, your phone reports the vehicle's position so other riders see it move. These reports carry a random ride code, not your account, are deleted when you hop off, and are deleted after 30 minutes in any case. So the ride's Live Activity can keep updating with the app closed, OnTheFarm also stores the activity's push token (encrypted), the vehicle, and the stops from the next one to your drop-off under that ride code, until you hop off, the vehicle reaches your stop, or 3 hours pass, whichever comes first.
• Count me when I'm here. On unless you turn it off, and only once you have allowed OnTheFarm to use your location; it never asks for location by itself. Turn it off under Profile → Privacy & Sprout AI or under any gym's or dining hall's busy times. Since October 13, 2026 it starts on for accounts that had not chosen; before that it started off. While the app is open, the phone checks whether you have been inside a listed gym, dining hall, place, or happening event for at least five minutes and tells OnTheFarm only which one and when, never your coordinates. Others see a count only once three or more people are counted, never who. Gym, dining hall, and event check-ins older than a day are deleted whenever the next gym or dining hall check-in arrives. A visit to a place stays with your account, so the app can show you that you have been there and ask how your visit was; deleting your account deletes it.
• Stanford sign-in. When you sign in to Stanford inside the app (for your class list, syllabi, Canvas, or meal plan balances), the sign-in is kept on this iPhone in its own web storage, apart from every other page the app shows. Session cookies that would otherwise end when the app closes are kept in the device keychain, on this device only, for at most seven days. None of this is sent to OnTheFarm. What the app reads from those pages stays on the phone, except the course codes it looks up in Stanford's public catalog. Signing out of OnTheFarm clears the stored sign-in.
• Canvas. When you connect Canvas, the app reads your Canvas calendar link from your own Canvas profile, using your Stanford sign-in on this iPhone, and keeps the link in this iPhone's keychain. If you are already signed in to Stanford in the app, it may read the link without you opening Canvas, unless you have disconnected Canvas; Sync classes and Canvas in the quarter planner does both with one sign-in. From then on the phone downloads the calendar straight from Canvas to keep the planner's assignments current. Neither the link nor your assignments are sent to OnTheFarm. Disconnecting Canvas, or signing out of OnTheFarm, erases the link from the phone.

4. How we use information

• Provide accounts, events, maps, searches, RSVPs, saves, invitations, messages, groups, eligible passes, and support.
• Personalize event and place recommendations using the interests, searches, feedback, and location context you choose to provide.
• Send service messages, event updates, security notices, and notifications you request.
• Send at most one message email a day, after 9 PM Pacific time, listing the people whose messages to you are still unread and how many each sent. It contains no message text, and turning off message notifications stops it. If someone messages an email address that has no OnTheFarm account, that address receives an invitation naming who wrote.
• Detect abuse, investigate reports, enforce our Terms, protect accounts, and maintain service integrity.
• Diagnose failures, measure feature performance, and improve accessibility and reliability.
• Comply with law and respond to valid legal process.

5. Sprout AI and automated moderation

When you choose a Sprout or AI-assisted feature, OnTheFarm may send your prompt, bounded event context, selected search area, public-source excerpts, or an image, event link, or event email you submit to configured AI providers. These features support event discovery, flyer extraction, search, summaries, and recommendations. Sprout's answers and most AI tasks use Google Gemini. When Gemini is unavailable, some tasks use models that run on Cloudflare Workers AI instead (gpt-oss-120b for text, Llama 4 Scout for pictures).

Sprout's agent. In the iOS app, Sprout's chat goes through an agent that belongs to your account alone. It runs on Cloudflare and opens only with your OnTheFarm sign-in. A question about your own circle, such as which friends are nearby or what your notifications say, is answered only if you turn on Friends nearby & notifications in Profile → Privacy & Sprout AI (it starts off). With it on, a Workers AI model (GLM-4.7-flash) can look up the names of friends who are sharing their live location with you (given to the model as a distance, never as coordinates), statuses your friends made visible to friends, and up to 25 of your most recent notifications. For a message notification the model sees who wrote and when, never what they wrote. With it off, Sprout says how to turn it on and looks nothing up. Any other question, and any question with pictures, goes to Sprout's Gemini answer. If the agent cannot be reached, the app asks Sprout directly instead.

The agent keeps a copy of the conversation you are having now, including what it looked up to answer, so it can follow up. The app replaces that copy whenever you start a new chat or switch conversations. If you choose Add My Location in the chat while Friends nearby & notifications is on, the agent also keeps the approximate positions (rounded to about 1 km) sent with your questions: at most 50, of which it uses only those from the last 24 hours. Older ones are dropped when the next position arrives, and the newest one stays until it is replaced. Deleting your account erases the agent's copy of your conversation and its location log before the account itself is removed; if the agent cannot be reached at that moment, the deletion stops and asks you to try again, so neither is left behind.

Pictures you attach. Each picture attached to a Sprout question is read by the flyer reader (Google Gemini, or Llama 4 Scout on Workers AI when Gemini is unavailable), and any QR code in it is read by the QR code service listed in section 6. Reading a picture for a question does not post an event. What the pictures say travels beside your question, never inside it, and Sprout is told to treat it as untrusted text from whoever made the picture, not as instructions; QR code links are not passed on with it, and the agent's own model never sees picture text. Whenever OnTheFarm's AI reads an image, words in the image are treated as content to describe, never as instructions.

Sprout Safety screens what you publish before it appears: event listings, profile names and bios, group names, descriptions, and bulletin posts, public memories, captions, posts, comments, dining reviews, and photos of places and dishes, plus images uploaded to those surfaces. The text or image is sent to the configured AI provider for classification only. A clearly unsafe submission is not published and is recorded as a safety case; a repeat within 30 days can pause posting and publishing for 1 to 24 hours. A photo you add to a place or a review is published as soon as the screen does not block it; if the screen is unsure, or cannot check it, the photo stays up and a human reviewer is asked to look at it. Reported content may also be classified automatically. You can appeal any automated action, and an authorized human reviewer controls final content-removal, restriction, and appeal decisions.

Optional AI personalization and AI-data sharing are separate from accepting the general policies. See the AI and Sprout Disclosure for feature limits and the kinds of context that should not be included.

6. Service providers and other disclosure

We do not sell personal information. We disclose information to providers only for the service they perform, and may disclose information when required by law or reasonably necessary to protect users, rights, or service security.

OnTheFarm displays event details gathered from public sources and may link to organizer, venue, or ticketing websites. These sources include Stanford's public calendars, Eventbrite, Ticketmaster, SeatGeek, Luma, Partiful's Bay Area explore page, and Poppin's public event feed. OnTheFarm reads Partiful and Poppin on its own schedule, every two hours, without any account information; a listing from them can name its host and show the guest counts the host chose to publish there. Loading a listing inside OnTheFarm does not give that third party your OnTheFarm account information. If you open the external site, its own data practices apply.

7. Advertising and tracking

The iOS app shows ads from Google (AdMob) and labels advertising as Ad, Advertisement, or Sponsored. Before any ad is requested, the app asks for Apple's App Tracking Transparency permission. iOS shows that question once, the first time the app opens, and Google's advertising software does not start until you have answered it. Production ad requests remain off unless a release has valid production configuration, that question has been answered, and any required consent choice has been resolved.

If you choose Allow, Google's advertising software can read this device's advertising identifier. Google may combine it with what it knows from other companies' apps and websites to show you personalized ads and to measure them. Apple calls this tracking.

If you choose Ask App Not to Track, iOS does not give the app that identifier, OnTheFarm asks Google for non-personalized ads only and for restricted data processing, and the app works the same. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking, or from Profile → Privacy & Sprout AI → Ad tracking.

Apple's question is the only one OnTheFarm asks about advertising, and your answer is what Google is told. The app does not show Google's own consent form. Where the law requires consent before ads, such as the European Economic Area, the United Kingdom and Switzerland, OnTheFarm requests no ads. If you answered Google's consent form in an earlier version of the app, you can clear that answer under Profile → Privacy & Sprout AI. OnTheFarm's own servers never receive the advertising identifier.

These choices cover Google's ads only. OnTheFarm does not ask KLIPY for sponsored GIFs. KLIPY receives only your GIF search words, from OnTheFarm's server rather than your device, and OnTheFarm does not give KLIPY your account number, name, email address, or location (section 6). If a sponsored GIF ever appears in GIF results, it is labeled Sponsored.

Apart from Google's ads with your permission, OnTheFarm does not use your activity to track you across other companies' apps or websites, and does not sell your account information. Available advertising privacy choices can be reviewed in the app under Profile → Privacy & Sprout AI.

8. Public, group, and private content

Your visibility choices affect who can see content. Public events, public profiles, reviews, and Global posts may be visible broadly. Group content is visible according to group membership and role rules. A group's owners and admins, and the OnTheFarm team, can see its members' email addresses; if you ask to join a private club, they also see your answers to its questions when deciding. A request for a new group goes to the OnTheFarm team. Private invitations and direct messages are intended for their recipients, but recipients can copy or share what they receive. Do not post information you do not have permission to share.

Activity status and read receipts. Your friends, and people you have an accepted conversation with, can see when you were last active on OnTheFarm; someone whose message request you have not accepted cannot. With Read Receipts on, the person who messaged you can see when you opened their messages. Turn off Activity Status or Read Receipts under Profile → Privacy & alerts to stop sharing either.

9. Retention and account deletion

We keep account information while the account exists and retain content and service records for as long as needed to provide the feature, protect the service, resolve disputes, or comply with law. Retention varies by record and context; this policy does not promise one fixed period for every category. Where OnTheFarm applies a fixed period, it is listed here:

• Saved notifications: deleted once older than 30 days, the next time your Notifications list loads.
• Live location shares: live for one hour at most. For shares started since October 5, 2026, the stored position then returns to the share's starting point.
• Transit ride position reports: deleted at hop off and after 30 minutes at most. A ride's Live Activity record: deleted at hop off, at your stop, or after 3 hours.
• Gym, dining hall, and event check-ins and crowd reports: deleted once older than a day, when the next one arrives. Busy-time charts and a place's all-time record keep only counts, by weekday and hour and by day, with no person attached.
• Sprout agent location log: at most 50 approximate positions, of which only the last 24 hours are used, kept only while Friends nearby & notifications is on, and erased with your account (section 5).
• Stanford sign-in cookies kept in the device keychain: seven days at most, on the device only.
• Dining hall and dish ratings and reviews: kept with your account until you delete it. You can delete a review of your own at any time.
• Photos you add of places and dishes: kept, credited to you, until you delete them (a dish photo from the dish's page) or your account.

You can delete your account from Profile → Account & security → Delete Account. The authenticated deletion workflow removes account-owned profile, relationship, message, event, pass, notification, verification, report, dining rating and review, and owned-media records covered by that workflow, and erases Sprout's agent copy of your conversation and its location log. Shared records may be removed, anonymized, or disconnected from your identity where needed for another user's conversation, aggregate attendance, fraud prevention, safety, dispute resolution, security, or legal obligations. See the Account Deletion page for the current workflow.

10. Your choices and rights

• Update profile, discovery, notification, AI, and advertising choices in the app.
• Use iOS Settings to revoke location, photos, camera, calendar, Bluetooth/local network, motion, microphone, speech recognition, or notification access.
• Delete content where the feature provides a delete action, block another account, or delete your account.
• Request access, correction, deletion, or export by emailing privacy@onthefarmapp.com. We may need to verify the request before acting.

Depending on where you live, additional rights may apply, including rights to object to or restrict certain processing. We will not discriminate against you for exercising an applicable privacy right.

11. Children

OnTheFarm is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Contact privacy@onthefarmapp.com if you believe a child under 13 provided information to OnTheFarm.

12. Security

OnTheFarm uses HTTPS/TLS, access controls, server-side authorization, and other administrative and technical safeguards intended to protect information. No system or transmission method is completely secure, so we cannot guarantee absolute security. Direct messages travel over TLS but are not end-to-end encrypted: OnTheFarm's servers can read them, which is how a message is delivered, how its notification preview is written, and how a conversation you report is reviewed. Report a suspected vulnerability privately to security@onthefarmapp.com; do not include passwords, secrets, payment credentials, or another person's private data.

13. Changes to this policy

We will update the Last updated date and document version when this policy changes. For a material update, OnTheFarm may provide an in-app notice and ask signed-in users to review the current policy. Acceptance records include the policy type and version, acceptance state and time, locale, and client platform. Optional marketing, AI-sharing, and advertising choices remain separate.

Contact

• Privacy requests: privacy@onthefarmapp.com
• Safety reports and moderation appeals: safety@onthefarmapp.com
• Security reports: security@onthefarmapp.com
• Copyright notices: Copyright and DMCA Policy