PRIVACY POLICY

RED WAGON FARM

Effective Date: April 29, 2026

1. Introduction

Welcome to Red Wagon Farm. Red Wagon Farm Inc (“we,” “our,” or “us”) operates the Red Wagon Farm mobile application (the “App”) available on iOS and Android devices, as well as the Red Wagon Farm website located at https://www.redwagonfarm.com/ (the “Site”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you download, install, or use our App.

We are committed to protecting your privacy and handling your data with transparency and care. Please read this Privacy Policy carefully. By creating an account or using the App, you agree to the practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the App.

This Privacy Policy applies to all users of the Red Wagon Farm App and Site, including visitors, registered users, and others who access or use our services. It does not apply to third-party websites, applications, or services that may be linked from within the App.

If you have questions about this Privacy Policy or our data practices, please contact us using the information provided in the “Contact Us” section at the end of this document.

2. Information We Collect

We collect information you provide directly to us, information collected automatically through your use of the App, and limited technical information from your device. We collect only the information necessary to provide and improve our services.

A. Personal Information You Provide

When you create an account or interact with certain features of the App, you may provide us with the following personal information:

Full name – used to personalize your experience and identify your account.
Email address – used for account registration, authentication, and communications.
Account credentials – your password is never stored by us in plain text; it is securely managed through our authentication provider (Supabase).
Profile photo (optional) – if you choose to upload a profile photo, it will be stored and displayed within the App. Camera access is requested only for this purpose and only if you initiate the upload.

B. Usage Data

We automatically collect certain information about how you interact with the App in order to improve functionality and your overall experience:

Features and screens accessed within the App.
Dates, times, and frequency of your interactions.
Loyalty rewards activity, including punch card progress and redemptions.
Event views and menu browsing history within the App.
In-app notification preferences and settings.

C. Device Information

We may collect limited technical information from the device you use to access the App:

Device type, model, and operating system version (iOS or Android).
Unique device identifiers required for push notification delivery.
App version and build number, used for troubleshooting and compatibility.
Crash reports and error logs, which may be collected automatically to help us identify and fix technical issues. These logs do not contain identifiable personal information beyond your device type and App version.

D. Information We Do NOT Collect

We want to be equally clear about data we do not collect:

We do not collect or track your precise or approximate location.
We do not collect payment information. No in-app purchases or payment processing occur.
We do not collect contacts, call logs, or SMS data from your device.
We do not conduct advertising tracking or use advertising identifiers.
We do not access your camera except when you explicitly initiate a profile photo upload.
We do not collect biometric data of any kind.

3. How We Use Your Information

We use the information we collect solely to provide, maintain, and improve the Red Wagon Farm App and to communicate with you about your account and our services. Specifically, we use your information to:

Create and manage your account, authenticate your identity, and keep your account secure.
Personalize your experience in the App, including displaying your name, loyalty rewards balance, and relevant event and menu information.
Operate and improve our loyalty rewards and punch card features.
Send you push notifications about events, promotions, and updates, if you have opted in to receive them. You may disable notifications at any time in your device settings or within the App.
Respond to your inquiries, feedback, and support requests.
Monitor and analyze usage trends to improve App performance, stability, and usability.
Enforce our Terms of Service and protect the safety, security, and integrity of the App and its users.
Comply with applicable laws, regulations, and legal obligations.

We do not use your personal information for advertising purposes, and we do not build advertising profiles based on your activity in the App.

4. Information Sharing and Disclosure

We do not sell, rent, trade, or otherwise transfer your personal information to third parties for their own commercial purposes. We may share your information only in the limited circumstances described below:

Service Providers:

We work with a small number of trusted third-party service providers who assist us in operating the App and delivering our services. These providers are contractually obligated to use your information only as necessary to perform services on our behalf and in accordance with this Privacy Policy. Our primary service provider is Supabase, described in detail in Section 5.

Legal Requirements:

We may disclose your information if required to do so by law, subpoena, court order, or other governmental or legal process, or if we believe in good faith that such disclosure is necessary to (a) comply with applicable law or legal process; (b) protect our rights, property, or safety, or that of our users or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

Business Transfers:

If Red Wagon Farm Inc is involved in a merger, acquisition, sale of assets, or other business transaction, your personal information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in the App of any change in ownership or control of your personal information, and you will have the opportunity to request deletion of your account and data prior to any such transfer.

With Your Consent:

We may share your information in other circumstances with your explicit consent.

5. Third-Party Services

The App uses Supabase as its backend infrastructure provider for authentication, data storage, and related backend services. Supabase is a reputable, cloud-based open-source backend platform.

What Supabase Receives:

When you create an account or use the App, your account credentials (email address and hashed password) and other account data you provide are stored and processed by Supabase on our behalf. Supabase also processes usage events and database queries generated by your use of the App.

Supabase’s Role:

Supabase acts as a “data processor” on our behalf and is contractually prohibited from using your data for its own purposes. Supabase maintains its own privacy and security standards, including compliance with applicable data protection laws.

Supabase Privacy Policy:

You can review Supabase’s privacy policy and data practices at: https://supabase.com/privacy

Data Location:

Your data stored via Supabase may be hosted on servers located in the United States or other countries where Supabase operates infrastructure. By using the App, you consent to the transfer and storage of your information on these servers.

We do not use any third-party analytics SDKs, advertising networks, social media trackers, or other third-party tracking tools within the App.

6. Data Retention

We retain your personal information for as long as your account remains active or as needed to provide you with the App’s services. Specifically:

Account data (name, email, account credentials) is retained for the duration of your account and deleted within 30 days following a verified account deletion request.
Usage data and activity logs are retained for up to 12 months to support service improvement and troubleshooting, after which they are deleted or anonymized.
Loyalty rewards data (punch card history, redemptions) is retained for as long as your account is active. Upon account deletion, this data is permanently removed.
Push notification tokens are deleted promptly when you disable notifications or when your account is deleted.
We may retain certain information for longer periods where required by applicable law or necessary to resolve disputes, enforce our agreements, or comply with legal obligations.

When we no longer have a lawful basis to retain your personal information, we will securely delete or anonymize it.

7. Data Security

We take the security of your personal information seriously and implement industry-standard safeguards to protect it from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

Encryption in transit: All data transmitted between the App and our servers is protected using Transport Layer Security (TLS) encryption.
Encrypted credential storage: Passwords are never stored in plain text. Supabase handles authentication with industry-standard hashing and salting practices.
Access controls: Access to your personal data is restricted to authorized personnel who require it to operate, develop, or improve the App, and they are bound by confidentiality obligations.
Secure infrastructure: Our backend infrastructure (Supabase) undergoes regular security assessments and maintains compliance with applicable security standards.
Session management: Authentication sessions are managed securely, with tokens stored in device-local encrypted storage (AsyncStorage with security configurations) rather than transmitted in plain text.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your information. In the event of a data breach that affects your personal information, we will notify you as required by applicable law, including providing details about what occurred and what steps we are taking in response.

You are responsible for keeping your account credentials confidential. We recommend using a strong, unique password for your Red Wagon Farm account and not sharing your login information with others. If you believe your account has been compromised, please contact us immediately.

8. Children’s Privacy (COPPA)

The Red Wagon Farm App is not directed to, and we do not knowingly collect personal information from, children under the age of 13. Our App is intended for use by individuals who are 13 years of age or older.

We comply with the Children’s Online Privacy Protection Act (COPPA) and applicable laws protecting the privacy of minors. If you are under the age of 13, please do not register for an account or submit any personal information through the App.

If we become aware that we have inadvertently collected personal information from a child under the age of 13, we will take immediate steps to delete that information from our systems. If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your consent, please contact us at redwagonfarminc@yahoo.com so that we can investigate and take appropriate action.

For users between the ages of 13 and 18, we encourage parents and guardians to review this Privacy Policy with their minor children and to supervise their use of the App.

9. Your Rights and Choices

We respect your rights with respect to your personal information. Depending on your location and applicable law, you may have some or all of the following rights:

Access:

You have the right to request a copy of the personal information we hold about you. You can access much of this information directly within the App by viewing your account profile and settings.

Correction:

You have the right to request that we correct inaccurate or incomplete personal information we hold about you. You can update your name and email address directly in your App account settings.

Deletion:

You have the right to request the deletion of your personal information. Please see Section 12 (Account Deletion) for detailed instructions on how to delete your account and associated data.

Portability:

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the right to receive a copy of your personal information in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.

Objection and Restriction:

Where applicable law provides such rights, you may object to our processing of your personal information or request that we restrict our processing of it in certain circumstances.

Withdrawal of Consent:

Where we rely on your consent as the legal basis for processing your personal information (for example, for push notifications), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Right to Lodge a Complaint (GDPR):

If you are located in the EEA or the United Kingdom and believe that our processing of your personal information violates applicable law, you have the right to lodge a complaint with your local supervisory authority. In the European Union, this is the data protection authority in your country of residence or place of work. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

Legal Basis for Processing (GDPR):

For users in the EEA or United Kingdom, we process your personal information on the following legal bases:

Contract performance: processing necessary to provide the App’s services to you, including account management and loyalty rewards.
Legitimate interests: processing for our legitimate interests such as improving the App, preventing fraud, and ensuring security, where those interests are not overridden by your rights.
Consent: processing based on your explicit consent, such as sending you push notifications.
Legal obligation: processing necessary to comply with our legal obligations.

To exercise any of these rights, please contact us at redwagonfarminc@yahoo.com. We will respond to your request within 30 days (or such shorter period as may be required by applicable law). We may need to verify your identity before processing your request.

10. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Categories of Personal Information Collected:

In the past 12 months, we have collected the following categories of personal information:

Identifiers (name, email address, unique device identifiers).
Internet or other electronic network activity information (App usage and feature interactions).
Inferences drawn from other personal information to create a profile (loyalty rewards activity).

We have not collected any other categories of personal information as defined by the CCPA.

We Do Not Sell Your Personal Information:

We do not sell your personal information to third parties, as defined by the CCPA. We do not share your personal information with third parties for cross-context behavioral advertising. Therefore, we do not offer an opt-out of “sale” or “sharing” of personal information because we do not engage in those activities.

Your CCPA Rights:

California residents have the following rights:

Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information we need to maintain to complete a transaction, detect security incidents, or comply with legal obligations).
Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. We will not deny you services, charge you different prices, or provide a lower quality of service because you exercised your rights.

Submitting a CCPA Request:

To submit a CCPA request, please contact us at redwagonfarminc@yahoo.com or visit https://www.redwagonfarm.com/. You may also submit a request on behalf of a minor child. We will verify your identity and respond to your request within 45 days, with an option to extend by an additional 45 days where reasonably necessary.

11. Push Notifications

The Red Wagon Farm App may send you push notifications to keep you informed about upcoming farm events, seasonal menu updates, special promotions, and loyalty rewards activity. Push notifications are entirely optional.

Opting In:

When you first launch the App, you will be asked whether you would like to receive push notifications. You must explicitly grant permission before any notifications are sent to your device. We will not send push notifications without your affirmative consent.

Managing Notifications:

You can manage your push notification preferences at any time in two ways:

Within the App: Navigate to the Settings section of the App and toggle push notifications on or off.
Device Settings: Use your iOS or Android device’s system settings to manage notification permissions for the Red Wagon Farm App.

Notification Tokens:

To deliver push notifications, we collect and store a device push notification token issued by Apple (APNs) or Google (FCM). This token is used solely for the purpose of delivering notifications to your device and is deleted when you disable notifications or delete your account.

No Marketing Tracking:

We do not use push notification engagement data (such as whether you opened a notification) to build advertising profiles or share such data with third-party advertisers.

12. Account Deletion

You have the right to delete your Red Wagon Farm account and all associated personal data at any time. We honor all account deletion requests promptly and completely.

How to Delete Your Account:

To request account deletion, you may:

In-App: Navigate to Settings → Account → Delete Account and follow the on-screen prompts.
By Email: Send a deletion request to redwagonfarminc@yahoo.com from the email address associated with your account. Include “Account Deletion Request” in the subject line.

What Happens When You Delete Your Account:

When we process your account deletion request:

Your account profile, including your name and email address, will be permanently deleted.
Your loyalty rewards history and punch card data will be permanently deleted.
Your push notification preferences and device token will be removed.
Any messages or in-app communications associated with your account will be deleted.

Account deletion is irreversible. Once your account is deleted, you will not be able to recover your account, loyalty rewards balance, or any associated data.

Retention After Deletion:

We will complete deletion within 30 days of a verified request. We may retain certain information in anonymized or aggregated form that cannot be used to identify you. We may also retain information we are required to keep by law for the minimum period required (e.g., transaction records required by tax law), after which it will be deleted.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

Posting the updated Privacy Policy within the App.
Updating the “Effective Date” at the top of this Privacy Policy.
Sending you an in-app notification or email notification where required by applicable law.

Your continued use of the App after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Privacy Policy, you should discontinue use of the App and may request deletion of your account as described in Section 12.

For significant changes that materially affect your rights, we will make reasonable efforts to provide you with at least 30 days’ advance notice prior to the change taking effect. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Prior versions of this Privacy Policy will be made available upon request by contacting us at redwagonfarminc@yahoo.com.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and thoroughly.

Red Wagon Farm Inc

Email: redwagonfarminc@yahoo.com

Website: https://www.redwagonfarm.com/

We aim to respond to all privacy-related inquiries within 30 business days. For urgent security concerns or suspected unauthorized access to your account, please indicate “URGENT” in your subject line and we will prioritize your request.

If you are located in the European Economic Area and are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your country of residence.

Red Wagon Farm Inc • Privacy Policy • Effective April 29, 2026