FarmSolDirect is developed and maintained by an independent developer operating under Australian law.
com.farmsoldirect.appFor the purposes of the EU General Data Protection Regulation (GDPR) and UK General Data Protection Regulation (UK GDPR), the data controller is the developer identified above. If you are located in the European Economic Area (EEA) or United Kingdom and have questions about data protection, please contact us at the email address above.
FarmSolDirect is designed with a privacy-first, local-only architecture. All data you enter or create remains exclusively on your device in app-private storage (Android SharedPreferences, EncryptedSharedPreferences, and local JSON files). None of it is transmitted anywhere.
The one thing the App does send to an endpoint of ours is an anonymous, aggregate usage count, described in full in section 4a. It contains an event name and nothing else, and it can be switched off in Settings > Anonymous analytics.
| Data type | Purpose | Legal basis (GDPR) |
|---|---|---|
| User profile (role, display name, region, currency & unit preferences) | Personalise the app experience for buyers and sellers | Contract (Art. 6(1)(b)) |
| Wallet public address & wallet name | Display wallet identity in the App (opt-in) | Consent (Art. 6(1)(a)) |
| SGT status & member number | Display Seeker Genesis Token verification | Consent (Art. 6(1)(a)) |
| Buy requests (produce, quantity, specs, delivery address, pricing) | Store buyer-created purchase requests locally | Contract (Art. 6(1)(b)) |
| Sell listings (produce, pricing, availability, location) | Store seller-created listing information locally | Contract (Art. 6(1)(b)) |
| Counter-offers | Store negotiation responses locally | Contract (Art. 6(1)(b)) |
| Favourite produce items | Quick access to frequently used produce types | Contract (Art. 6(1)(b)) |
| Notification preferences (reminder frequency, market day) | Schedule local WorkManager reminders | Contract (Art. 6(1)(b)) |
| Disclaimer & onboarding acceptance state | Record that the user has acknowledged informational-only nature | Contract (Art. 6(1)(b)) |
FarmSolDirect requests no location permission of any kind and uses no IP-geolocation service. To detect whether the device is associated with a jurisdiction subject to international sanctions, the App reads only on-device signals at startup:
These signals are evaluated entirely on your device. The resulting country code is not stored, not logged, and not transmitted to any server.
Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)) — compliance with international sanctions law. The signals used are device configuration values, not location data, and are never transmitted.
FarmSolDirect requests the POST_NOTIFICATIONS permission to deliver local reminders scheduled via Android WorkManager (e.g., a weekly market-day reminder and periodic listing-review reminders). These notifications are generated entirely on your device — no push notification service, no server, and no external messaging infrastructure is involved. You can disable notifications at any time in Android Settings.
FarmSolDirect does not operate any backend servers, databases or cloud storage. We run a single analytics endpoint of our own, described below, which stores only anonymous aggregate counts. We have no server-side systems capable of receiving, storing, or processing user data. All data exists exclusively in your device's app-private storage and is inaccessible to other applications. Buy requests, sell listings, counter-offers, and user profiles never leave your device unless you explicitly share them using the Android Share Intent.
FarmSolDirect makes read-only API requests to the following third-party services to retrieve publicly available data. These requests are HTTPS-encrypted and no user-specific data is included in the requests except where noted:
| Service | Endpoint | Data retrieved | User data sent |
|---|---|---|---|
| Frankfurter API | api.frankfurter.dev | Currency exchange rates for price conversion | None |
| Solana RPC | api.mainnet-beta.solana.com | Seeker Genesis Token account check | Wallet public address* |
These are the only two third-party hosts the App contacts. The only other host it contacts at all is our own analytics endpoint, farmsoldirect-analytics.vercel.app, described in section 4a. There is no crash-reporting endpoint and no fallback RPC provider.
* Your Solana wallet public address is sent to the Solana RPC endpoint only when you have opted in by signing in with your wallet. Wallet public addresses are publicly visible on the Solana blockchain and are not generally considered personal information, though GDPR may classify pseudonymous identifiers as personal data. The legal basis for this processing is your explicit consent (Art. 6(1)(a) GDPR).
FarmSolDirect sends anonymous, aggregate usage counts to a single endpoint we operate, farmsoldirect-analytics.vercel.app. We use them to see which features are actually used and roughly where the App is used, so we know what to improve.
What is sent. The entire request body is one event name, for example
{"event_type":"app_open"}. That is the whole payload. It contains no buy request, no sell
listing, no produce type, no price, no quantity, no delivery address, no search term, no wallet address,
no device or advertising identifier, no install id, no session id, no user id, and no location.
What is derived. Our host records the request's approximate country (derived by the hosting provider from the connection and never stored alongside anything else) and the date. We keep a running count per event name, per country, per day. IP addresses are not stored. Because there is no identifier in the request, the counts cannot be linked to you, to your device, or to each other — two events from the same phone are indistinguishable from two events from two different phones.
How to switch it off. Settings > Anonymous analytics. While it is off, the App sends nothing to this endpoint at all. No feature of the App depends on it.
Legal basis (GDPR). Legitimate interest (Art. 6(1)(f)) in understanding aggregate product usage. The data is anonymous rather than pseudonymous — it carries no identifier that could single you out, so it is not personal data within the meaning of Art. 4(1) and there is nothing in it we could retrieve, correct, or erase on request. The off switch is provided regardless.
Retention. Aggregate counts are kept indefinitely, since they describe events rather than people. No raw request log is retained.
Wallet sign-in uses Solana's Mobile Wallet Adapter protocol with Sign In With Solana (SIWS), which operates entirely locally between FarmSolDirect and your wallet app on the same device via Android inter-process communication. During the MWA sign-in process:
If you choose to verify your Seeker Genesis Token, FarmSolDirect queries the Solana blockchain via RPC to check for the presence of an SGT in your wallet. This process:
We implement the following security measures to protect locally stored data:
EncryptedSharedPreferences (AES-256-SIV for keys, AES-256-GCM for values, via Google Tink), falling back to standard app-private storage if the device keystore is unavailableAll data is stored locally on your device and is retained until you explicitly delete it. You can delete all FarmSolDirect data at any time by:
The App sets allowBackup="false", so its data is excluded from Android/Google backups and does not survive uninstalling. Since no data is stored on our servers, deletion from your device constitutes complete deletion. Note that any data you have previously shared via the Android Share Intent (e.g., to WhatsApp, email) is governed by those third-party services and is outside our control.
FarmSolDirect does not transfer personal data to our servers (we have none). However, when FarmSolDirect makes API calls to third-party services (see Section 4), network requests may be routed through servers located outside your country of residence, including servers in the United States and Europe.
For users in the EEA or UK: these API calls are limited to fetching publicly available currency exchange rates and, where you have consented by connecting a wallet, querying that wallet's public address for a Seeker Genesis Token. We rely on the derogation under Article 49(1)(a) GDPR (explicit consent for the wallet query) and Article 49(1)(c) (necessary for the performance of the contract for currency data retrieval).
If you are located in the EEA or UK, you have the following rights under the GDPR:
Under the Australian Privacy Principles (APPs), you have the right to:
If you are a California resident, you have the right to:
If you are located in Japan, you have the right to request disclosure, correction, cessation of use, and deletion of your personal information. All data is stored locally on your device and can be deleted by clearing app data or uninstalling. For inquiries, please contact us at the email address in Section 1.
If you are located in South Korea, you have the right to:
All data is stored locally on your device. The personal information protection officer for this application can be contacted at aardappvark@proton.me.
If you are located in Singapore, you have the right to access and correct your personal data. We have designated the developer as the Data Protection Officer. For PDPA inquiries, contact aardappvark@proton.me.
FarmSolDirect is not directed at, marketed to, or intended for use by children under the age of 16 (or 13 in jurisdictions where that threshold applies, including the United States under COPPA). We do not knowingly collect any information from children. If you believe a child has provided data to the app, the data exists only on that child's device and can be removed by clearing app data or uninstalling the app.
FarmSolDirect performs one automated decision: sanctions region screening at app startup. If your device is detected in a sanctioned jurisdiction, the app displays an informational screen explaining the restriction. This automated decision is based on legitimate interest in regulatory compliance (GDPR Art. 22(2)(b)) and does not produce legal effects beyond restricting access to the app's informational features. You may contact us to contest this decision.
We have conducted an internal assessment of our data processing activities and determined that a formal Data Protection Impact Assessment (DPIA) under GDPR Art. 35 is not required because:
FarmSolDirect builds no profile of any user and performs no cross-site or cross-app tracking, so a Do Not Track signal has nothing to switch off. The one thing you can switch off is our anonymous analytics, in Settings > Anonymous analytics.
For the purposes of the EU ePrivacy Directive (2002/58/EC) and its national implementations: FarmSolDirect stores configuration data, user profiles, buy requests, sell listings, counter-offers, and favourites on your device using Android SharedPreferences, EncryptedSharedPreferences, and local JSON files. This storage is strictly necessary for the functioning of the application (exempted from consent requirements under Art. 5(3)) and does not involve any tracking, profiling, or advertising functionality.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Continued use of FarmSolDirect after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.
For any privacy-related questions, concerns, or to exercise your data subject rights, please contact:
We aim to respond to all privacy inquiries within 30 days.
This Privacy Policy is governed by the laws of Australia, without regard to conflict of law principles. This does not affect your statutory rights under the laws of your country of residence, including rights under GDPR (for EEA/UK residents), CCPA/CPRA (for California residents), or other applicable local privacy laws.