Toph — Privacy Policy

1. Information we collect

1.1 Information you provide directly

When you create an account or use the App, we may collect:

• Full name and email address
• Farm or organization name and your role (worker or manager)
• Voice recordings you initiate for field activity logging
• Photos and documents you capture or upload (e.g., pesticide labels, field paperwork, compliance records)
• Activity log entries, notes, and other content you create in the App
• Communications you send us for customer support purposes

1.2 Information collected automatically

When you use the App, we automatically collect:

• Precise GPS location data while you are actively conducting a voice logging session
• Device identifiers and operating system information
• App usage data such as session duration, features accessed, and interaction events
• Crash reports and technical performance diagnostics

1.3 Information from third-party service providers

We use the following third-party services that may collect or process data in connection with your use of the App:

• Supabase: authentication and backend database services
• Daily.co: optional real-time WebRTC audio routing for lower-latency voice sessions
• Google (Gemini / Pipecat): AI-powered transcription and structuring of voice logs
• Expo: mobile runtime diagnostics and crash reporting

2. How we use your information

We use the information we collect to:

• Create and manage your account and authenticate your identity
• Provide core App functionality: voice logging, transcription, activity log management, and audit report generation
• Transmit your voice recordings to our AI backend for transcription and structured log creation
• Record your GPS location during active logging sessions to associate field activity with a physical location
• Enable managers to review worker logs, manage team members, and generate compliance reports
• Store and sync your data across sessions, including in low-connectivity field environments
• Respond to your customer support requests
• Diagnose crashes, fix bugs, and improve App performance
• Comply with legal obligations applicable to agricultural compliance and record-keeping

3. How we share your information

We do not sell your personal information. We may share your information in the following limited circumstances:

3.1 Within your organization

If you are a farmworker, your activity logs, location data, and voice-derived records are visible to the manager(s) of your farm account. Sharing this data within your organization is the core purpose of the App.

3.2 Service providers

We share data with vendors who assist in operating the App, including Supabase (database and authentication), Daily.co (WebRTC audio), and Google (AI transcription). These parties are contractually required to protect your data and may only use it to provide services to us.

3.3 Legal requirements

We may disclose your information if required to do so by law, regulation, court order, or governmental authority, or if we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business transfers

In the event of a merger, acquisition, financing, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

4. Location data

The App collects precise GPS location data when you are actively conducting a voice logging session. This data is used exclusively to associate your field activity with a physical location for compliance and audit purposes.

Location collection occurs only while you are actively using the App for logging. We do not collect location data in the background when you are not actively logging.

You may disable location access at any time in your device settings. Doing so will limit core App functionality, as location tagging is a required element of many agricultural compliance records.

5. Voice and audio data

Voice recording is the primary feature of Toph. When you initiate a voice log, your audio is transmitted to our AI processing backend (powered by Google Gemini via Pipecat) for transcription and structuring into an activity log entry.

Audio may be routed via WebRTC (Daily.co) when the real-time voice path is enabled. Voice sessions are always explicitly initiated by you. We do not record ambient audio and do not activate the microphone without a direct action on your part.

6. Data retention

We retain your personal information and activity records for as long as your account is active or as needed to provide the Services. Agricultural compliance records may be retained for extended periods to satisfy legal recordkeeping requirements applicable to California farm audits and other regulatory obligations.

You may request deletion of your account and associated personal data at any time by contacting us at gavinhua@usc.edu. We will fulfill deletion requests promptly, subject to our legal obligations to retain certain records.

7. Security

We implement industry-standard security measures to protect your information, including:

• Encrypted data transmission via HTTPS/TLS for all network communication
• Secure credential storage using Apple's Keychain (via expo-secure-store)
• Access controls limiting employee access to personal data on a need-to-know basis

No data transmission or storage system is perfectly secure. We encourage you to use a strong, unique password for your account and to enable Face ID protection within the App for an additional layer of security.

8. Children's privacy

The App is not directed to individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at gavinhua@usc.edu and we will delete the information promptly.

9. Your rights and choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data (subject to legal retention requirements)
• Object to or request restriction of certain processing activities
• Receive a portable copy of your personal data in a structured, machine-readable format

To exercise any of these rights, contact us at gavinhua@usc.edu. We will respond to verified requests within 30 days.

10. California privacy rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to delete your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right to non-discrimination for exercising your privacy rights

We do not sell or share your personal information for cross-context behavioral advertising purposes.

To submit a California privacy rights request, contact us at gavinhua@usc.edu or use the support feature within the App. We will verify your identity before processing the request.

11. International users

The App is designed for use by farms operating in the United States, primarily California. If you access the App from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

By using the App, you consent to the transfer of your information to the United States and its processing in accordance with this Privacy Policy.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" and "Last Updated" date at the top of this policy
• Notify you via a notice in the App or by email to the address associated with your account

Your continued use of the App after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: