Privacy Policy

This policy explains how Farmly (farmlymc.com) handles personal data under the EU General Data Protection Regulation. We store what is needed to run your account and nothing more, we set no tracking cookies, we show no advertising today, and we never sell your data. The rest of this page goes through the details.

Who is responsible for your data

Farmly is built by a small team. The data controller is Michal Viktorýn, a private individual based in the Czech Republic. For anything concerning your data, write to contact@farmlymc.com or use the contact page.

Creating an account

To create an account we ask for an email address, a username and a password. The username is a public display name and does not have to be your real name, and we suggest that it is not. Your email address is never shown publicly; we use it to secure the account, to let you back in when you lose the password, and to send the occasional message about your account or important changes to the service. Passwords are stored only in hashed form; we cannot read them, and no one you talk to at Farmly will ever ask for one. You can also add an optional bio and an avatar colour, both public and both editable or removable at any time in Settings. We process this data because it is necessary to provide the account you asked for.

Signing in with Discord or Google

If you choose to sign in with Discord or with Google, that service tells us your email address, your display name and your profile picture, and we store those to create and connect your account. We ask for nothing beyond that basic profile: we do not receive your Discord or Google password, we cannot see your messages, contacts or files, and we do not post anything on your behalf. If you later sign in with the other service using the same confirmed email address, it is attached to the same account rather than creating a second one. What Discord or Google themselves record about the sign-in is governed by Discord's privacy policy and Google's privacy policy.

The newsletter

The newsletter is strictly opt-in. If you tick the box, we record when you did, and that timestamp is our record of your consent. The welcome mail goes out only after your email address is verified. Every newsletter contains an unsubscribe link that works instantly and without signing in; demanding a login before letting someone leave a mailing list is a dark pattern and we will not use it. You can also change the setting in Settings at any time. Withdrawing consent stops future mail and does not affect anything else about your account.

What you do on Farmly

When you use the site with an account, we store what you deliberately create: the farms you save, the collections you build, the people you share them with, the materials you tick off, notes, and your notification state. That is the product working as intended, and the data stays private to you and the people you share a collection with unless you make a collection public. A public collection, like your profile (username, bio, badge and public collections), is visible to anyone. You can change a collection's visibility or delete any of this content yourself at any time.

Messages you send us

If you write to us through the contact form or report a problem with a farm, we keep the message, the contact details you chose to include, and, for farm reports, which farm and version they concern. We use these to reply and to fix what you reported, which is our legitimate interest in running a working site.

Technical records and security

Like practically every website, we keep short-lived technical records to keep the service safe: failed sign-in attempts, temporary account locks after repeated wrong passwords, rate-limiting counters, and security events. These records can include your IP address. We use them only to prevent abuse of the service and we do not build profiles from them. Our infrastructure providers (below) also keep their own standard, short-lived connection logs.

Analytics

We measure traffic with Cloudflare Web Analytics, which is deliberately built without cookies and without cross-site tracking. It shows us aggregate numbers, such as how many visits a page gets and how fast pages load, and it cannot show us who you are. We do not use Google Analytics, advertising pixels or any similar tracker.

Cookies

Farmly sets only the cookies that are strictly necessary for signing in. There are no advertising or analytics cookies, which is also why the site does not greet you with a consent banner. The full list, lifetimes included, is in the Cookie Policy.

Who handles data for us

We do not sell or rent personal data, and we share it only with the processors that physically run the service: Cloudflare (serves the website and provides the cookieless analytics), Neon (hosts our database), and Resend (delivers our email: verification mails, password resets and the newsletter). If you sign in with Discord or Google, that service is involved in the sign-in as described above. Each of these companies processes data only to provide their service to us. Beyond that, we would disclose data only if the law genuinely required it.

Where your data is stored

The database lives on Neon servers in London, United Kingdom, a country the European Commission recognises as providing adequate data protection. Cloudflare and Resend are US companies operating globally; transfers to them are covered by the EU-US Data Privacy Framework and EU standard contractual clauses. In plain terms: your data sits in Europe, and the American companies that touch it in transit are bound by EU-approved safeguards.

How long we keep your data

Account data is kept for as long as the account exists. When you delete your account in Settings, your personal data is deleted with it. One thing survives by design: a shared collection you owned passes to its longest-standing member instead of being destroyed, because the farms and progress in it are also their work. Your name leaves it; their work stays. Solo collections are deleted outright. Messages sent through the contact form and security records are kept only as long as they are useful for their purpose, and routine backups expire on their own short schedule.

Your rights

Under the GDPR you can ask us for a copy of the data we hold about you, have mistakes corrected, have the data deleted, restrict or object to processing, and take your data elsewhere in a machine-readable form. Some of this you can do yourself in Settings: edit your profile, change your email, or delete the whole account. For everything else, including a copy of your data, write to contact@farmlymc.com and we will respond within a month. If you believe we are handling your data unlawfully, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the supervisory authority of your own country.

Children

You must be at least 13 to create an account. If the country you live in sets a higher age for consenting to data processing (up to 16 in parts of the EU, and 15 in the Czech Republic), you need a parent's or guardian's permission. We do not knowingly collect data from children below these ages; if you believe a child has an account, contact us and we will remove it.

How we protect your data

All traffic to Farmly is encrypted, passwords are stored only as salted hashes, database access is limited to the operator, and repeated failed sign-ins lock the account before a password can be guessed. No system on the internet is perfectly secure, but we collect little precisely so that little is at risk, and if a breach affecting your data ever happened we would tell you and the supervisory authority as the GDPR requires.

Changes to this policy

If the way we handle data changes, for example if the site ever introduces advertising, this policy will be updated before the change goes live, and the date at the top will tell you when it last moved. Significant changes will be announced on the site.

Contact

Anything about your data: contact@farmlymc.com. A real person reads every message.