DRAFT: not reviewed by a lawyer, owner must review before launch
Last updated: 2026-10-30
This page describes what LawnYear collects, why, and who handles it. It is a plain-language draft, not legal advice.
What we collect and why
- ZIP code. The ZIP schedule tool looks up your state in your browser. The ZIP you type is not sent to our server by the tool.
- Email address. Required for the free photo diagnosis. We keep a record that the address already used its free diagnosis, so the offer is one per email. If you ask for reminders, we also keep the address on the lists "spring-reminder" (a reminder in spring) and "launch-notify" (a notice when paid features launch). The address is not verified. The list holds the address itself; the free-use record holds only a hash of it.
- IP address. Used to count requests so the diagnosis cannot be abused. In our storage the IP appears only as a hash inside counters that expire within about a day. It is not used for advertising. The hosting provider also sees IP addresses in its request logs (see below).
- Cookie. One anonymous device cookie,
lawn_device(a random id, HTTP-only, kept for one year). It is set when you use the photo diagnosis and is used for the once-per-device rule and for request limits. We store only a hash of it. It does not identify you by name. - Usage analytics. If analytics is switched on (PostHog), we record events such as "ZIP tool used" (with the state, if known) or "diagnosis completed" (with the outcome). Events never include your email address or other personal details. If analytics is not switched on, nothing is sent.
- Counters. Aggregate counters, for example the money spent on diagnoses per day, which are not tied to a person.
Photos
A photo you upload for diagnosis is processed in memory and sent to OpenAI, which analyses it and returns the result. We ask OpenAI not to store the request and response for later retrieval (the setting is called "store: false"). Our code does not save the photo and does not write it to logs. How long OpenAI itself keeps API data, for example for abuse monitoring, is governed by the OpenAI API terms and the settings of our account, and this page does not state a period. Do not upload photos that show people, faces or house numbers.
Service providers
- OpenAI: analyses the photo you upload for the diagnosis.
- Upstash (Redis database): stores the email lists, the free-use records, request counters and daily spend counters.
- Vercel: hosts the website and keeps ordinary request logs (such as IP address and requested page).
- PostHog: product analytics, only when switched on, with events that carry no personal details.
We do not sell your data and we do not run advertising.
How long we keep data
- Request counters that contain a hashed IP or device id: about a day.
- Daily spend counters: a couple of days.
- Free-use records (a hash of your email and of your device id, with the time of use): kept with no end date, so the one-free-diagnosis rule keeps working.
- Email lists: kept until the address is removed.
- Analytics events and hosting logs: kept according to the settings and terms of those providers.
Access and deletion
You can ask what we hold about you or ask us to delete it. This page does not list a contact address yet, so there is no channel for such requests today; one will be published here. Residents of some US states have privacy rights under state law, and a lawyer has not yet reviewed what this page must say about them.
Data sources
ZIP-to-state data comes from GeoNames (CC BY 4.0).
Changes
We may update this page. The date above shows the last update.