Privacy Policy

Your B-hyve® password is never stored

To control your sprinklers, Verdyn signs in to your Orbit® account the same way the official B-hyve app does. We take this seriously:

• Your password is sent over an encrypted connection and used exactly once — to exchange it for a session token from Orbit.
• It is never written to disk, never logged, and never shared. The moment the token is issued, the password is discarded from memory.
• On the web, the resulting session token is sealed with AES-256-GCM authenticated encryption and stored only in a secure, httpOnly cookie your browser sends back to us — it is not readable by JavaScript and not exposed to third parties.
• On iOS, the token stays in the app's memory for the session and is never persisted to the device.
• You can revoke the token at any time by disconnecting or canceling — see “Your choices” below.

What we collect

• Lawn profile: your ZIP code, soil type, grass type, sun/slope and sprinkler details per zone, and whether your lawn is newly sodded. This is what powers the schedule.
• Controller data: the zones and device names Verdyn reads from your B-hyve account so it can write schedules back to it.
• Session token: the encrypted Orbit access token described above. Not your password.
• Operational data: basic, short-lived technical logs (e.g., error counts and rate-limit counters) used to keep the service reliable and secure. We do not sell this or use it for advertising.

We do not collect your B-hyve password, payment-card numbers (handled by our payment processor, not stored by us), or precise location beyond the ZIP code you provide.

How we use it

• To build your daily watering plan from agronomy, local weather, and your area's watering rules.
• To read your zones and write the resulting schedule to your B-hyve controller.
• To keep the service secure (rate limiting, abuse prevention) and to fix problems.

We do not sell your personal data, and we do not use it for third-party advertising.

Third parties we rely on

• Orbit / B-hyve: to read your zones and send watering commands. Verdyn is an independent product and uses an unofficial interface, which Orbit may change at any time.
• Open-Meteo: weather and evapotranspiration data, looked up by ZIP. No personal account data is sent.
• Hosting & payments: our infrastructure and payment processors handle delivery and billing under their own terms.

Retention & storage

Your lawn profile is kept while your subscription is active so Verdyn can keep watering. On iOS, your profile is stored on your device. Encrypted session tokens expire and are re-minted; operational logs are short-lived. When you delete your data, we remove your profile and revoke any active token.

Your choices

• Disconnect at any time from the dashboard — this immediately revokes the stored session token.
• Cancel your subscription — Verdyn stops all zones, turns off access, and revokes the token. See the Terms for details.
• Delete my data — removes your stored profile. On iOS, deleting the app removes the profile from your device.

Security

Connections are encrypted in transit (HTTPS/HSTS). Session tokens are sealed with authenticated encryption at rest. We apply a strict Content-Security-Policy, per-IP rate limiting, and server-side input validation. No system is perfectly secure, but we design Verdyn so that the most sensitive secret — your password — is never something we hold.

Children

Verdyn is intended for adults managing their own irrigation and is not directed to children under 13.

Changes & contact

We may update this policy as the product evolves; we'll revise the “last updated” date above. Questions or data requests: contact us at privacy@verdyn.com.