Privacy

Tilth exists on one principle: the farm's data belongs to the farm. Not to us, not to advertisers, not to anyone selling you inputs. This notice says what is held, why, where it lives, who helps store it, and your rights over it.

Who this is from

Tilth is run by Tilth Ltd, a company registered in England and Wales (company number 17356418) and registered with the UK's data regulator, the Information Commissioner's Office (reference ZC205891). For your account details, Tilth Ltd decides how they are handled. For the records you enter about your farm, your farm is in charge and Tilth Ltd only holds and processes them on your behalf, to run the app for you. Questions: privacy@tilth.farm.

What is held

Your account: your name, email address and a scrambled one-way fingerprint of your password (the password itself is never stored and cannot be recovered from the fingerprint). Your farm's working data: field boundaries, cropping, spray and fertiliser records, stewardship options and payments, livestock, machinery, and the photos and documents you attach. A photo keeps any location your phone stored in it, which shows where it was taken, and that goes with the photo when you download or export your records. The people you add to your farm and their role. Any feedback you send, and basic technical error reports that help fix faults (these can note which page went wrong, but not your farm records).

Files sent to your farm through its upload link, or shared to Tilth from a phone, wait in the Sent to Tilth list until you file them, delete them or make drafts from them, with the name you gave the link they came through and any note typed with them. Somebody sending a file through your link needs no account, and nothing is held about them beyond what is in the file and the note; a count of how often the link's page was opened and files were sent, by internet address, is kept for 35 days to stop a link being abused, and then deleted.

To stop anyone guessing passwords or flooding the site, Tilth counts how often each internet address signs in, resets a password, signs up, asks for an invitation or sends an error report. For each email address it counts the wrong passwords typed and the emails the sign-up and invitation forms send to it. It also counts how often each person uses the heavier tools, such as the satellite maps and the document readers, so no one person can overload them. The counts are kept for 35 days and then deleted. If repeated wrong passwords pause sign-in for an email address, we are emailed that address and the time, whether or not it belongs to anyone on Tilth.

A pass recorded by driving, with Track work or from a job, keeps where the machine went and when it started and stopped, against the name of the person who recorded it. Everyone on your farm can see it, and it is in your farm's download. Track work keeps only the stretches in and near the fields the pass worked, so the drive there and back on the road is not kept.

If you ask for an invitation before you have an account, what you put in that form: your name and email address, and whichever of the optional answers you chose to give, which are your county, your farm name, your farm size, your farm type, whether you use an agronomist, what you use for records now, where you heard about Tilth, and anything you wrote in the box for that or in the message box. Nothing is required except your name and an email address to reply to. Those two boxes are your own words, so if you name somebody else in them, such as the neighbour who told you about Tilth, their name is held with the request until the box is cleared.

Why it is held

To run the app for you, which is our agreement with you, and to keep it working, secure and free of bugs. That is the whole of it. Your data is not sold, not shared, not used to profile you and not used to sell you anything, so there is no marketing to opt out of.

A request for an invitation is held for one reason: so we can reply to you and, if it suits you both, set you up with an account. That is a step taken at your request before any agreement between us. The optional answers exist so we can see what sort of farms are asking, and, in the case of where you heard about Tilth, so we can tell which of the places we talk about it actually reach farmers. They are used for nothing else. Asking is not signing up to anything, and it does not put you on a mailing list, because there is not one.

Where it lives, and who helps store it

The app runs on servers in London, and the database sits in the UK. A few trusted companies help run it, and only ever see the part they need to:

• Fly.io runs the app itself, in London.
• Neon holds the database, in the UK.
• Backblaze keeps the off-site backups: the daily copy of the database, and a copy of each photo and document you attach. These are encrypted with a key only the operator holds, so they cannot be read by anyone else, wherever they are stored.
• Resend sends the app's emails, such as password resets and invitations. It sees your name, your email address and the message, never your farm records.
• Stripe takes the payment, on its own page, when a farm is paid for. It sees the payer's name, email address and card, and the name of the farm being paid for, never your farm records. Tilth never sees the card number: it keeps only Stripe's own reference numbers for the payer and the subscription, and what Stripe says about it, which is the price, whether it is paid and the date it is paid until.
• The map and weather providers (Mapbox, Copernicus and Open-Meteo, listed on the Credits page) receive the requests that draw the maps and fetch the forecast. What those requests carry is set out below.

Every connection to the app is encrypted (https). Your farm records stay with the app, its database and its backups, all of them run by the companies named above. Six other things go out to an outside service, because the job cannot be done without them, and this is all of them:

• Opening plant health on a field sends that field's boundary to Copernicus, because a satellite service has to be told which shape to measure. The shape goes on its own: not the field name, not the crop, not a single record.
• The forecast sends the middle of your farm, to about ten metres, to Open-Meteo, because a forecast is for a place.
• Bringing your fields in from the Rural Payments Agency, and fetching their land covers and hedges, sends your SBI to the agency's own published services, which is how they find the land registered to you.
• Drawing the map asks Mapbox for the picture of the ground you are looking at, so Mapbox is told which piece of ground that is, and nothing else about it.
• Finding a field's worked area from the height survey, on the field's own page or with Set worked areas on the map, sends a box drawn round that field to the Environment Agency, whose height survey it reads. The box goes on its own: not the field name, not the crop, not a single record.
• Turning on one of the map layers published by public bodies (Natural England, the Environment Agency, and Cranfield University's soil map) makes your browser ask that body for the picture of the ground you are looking at, in the same way the map itself does, and nothing else about it.

Nothing else of your farm's goes to the map, map layer, weather, height survey and parcel services, and none of them is told your name or your email address.

Outside the UK

Most of the companies above are American, or owned from the United States. Two of them handle your account details on their own systems there: Resend, which sends the app's emails and so sees your name and email address, and Stripe, which takes the payment and so sees the payer's name, email address and card. Each is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving your details the same protection they have here, and that is the safeguard Tilth Ltd relies on when it sends them.

How long it is kept

For as long as your farm is active. Close your farm and its data is removed there and then, and the off-site copies of your photos and documents are removed with it, normally within a day. If the off-site backup cannot be reached at the time, the removal is tried again every night until it is done. Those copies are kept while your farm is here rather than on a rolling cycle, because a spray photo from three seasons ago is still the evidence for that spray. The daily off-site copy of the database is kept for two months before it is deleted, so a closed farm's records drop out of those copies within two months. You do not have to ask permission or give a reason.

Files in the Sent to Tilth list are kept until you file them, delete them or make drafts from them, and go with the farm when it is closed.

A request for an invitation is kept in a form that identifies you for no longer than twelve months from the day you sent it. If you become a Tilth farm within that time, the request is kept in full from then on, as the record of how your farm came to us. If you do not, then once twelve months have passed, your name, your email address and anything you wrote in the message box or the box about where you heard of Tilth are removed for good. What is left is the county, the size and type of farm, where you heard about Tilth, and the date you sent it: enough to show us where interest in Tilth is coming from, not who you are. If you would rather your request went sooner, say so at privacy@tilth.farm and it will be deleted outright.

Your rights

You can download everything from the Export page whenever you like, ask for anything to be corrected, and close your farm to remove it entirely. If you are ever unhappy with how your data is handled you can tell the operator at privacy@tilth.farm, and you can complain to the Information Commissioner's Office (ico.org.uk), the UK data regulator.

Cookies

Only the ones strictly needed to keep you signed in and remember which farm you are looking at. One of them is set when you sign in or set a new password: it lets that browser still sign in to your account while somebody else is guessing at your password, and it lasts 180 days. Setting a new password ends it on every browser, as it signs them all out, and the browser you set it on from the emailed link gets a new one. No tracking, no analytics cookies, which is why there is no cookie banner. We count how many times the home page, the features, pricing, about and SFI pages, the page on moving from Gatekeeper, and the guides are read, and which site the reader came from, as daily totals, and nothing about you is kept for it.

This notice is written plainly and honestly.

Terms of service · Credits · Back to the app

Tilth Ltd, registered in England and Wales, company number 17356418. Registered office: Claypit Hall, Mill Road, Braintree, CM7 4QG.