Privacy Policy

Your B-hyve® password is never stored

To control your sprinklers, Verdyn signs in to your Orbit® account the same way the official B-hyve app does. We take this seriously:

• Your password is sent over an encrypted connection and used exactly once — to exchange it for a session token from Orbit.
• It is never written to disk, never logged, and never shared. The moment the token is issued, the password is discarded from memory.
• On the web, the resulting session token is sealed with AES-256-GCM authenticated encryption and stored only in a secure, httpOnly cookie your browser sends back to us — it is not readable by JavaScript and not exposed to third parties.
• On iOS, the token stays in the app's memory for the session and is never persisted to the device.
• You can revoke the token at any time by disconnecting or canceling — see “Your choices” below.

What we collect

• Lawn profile: your ZIP code, soil type, grass type, sun/slope and sprinkler details per zone, and whether your lawn is newly sodded. This is what powers the schedule.
• Controller data: the zones and device names Verdyn reads from your B-hyve account so it can write schedules back to it.
• Session token: the encrypted Orbit access token described above. Not your password.
• Operational data: basic, short-lived technical logs (e.g., error counts and rate-limit counters) used to keep the service reliable and secure. We do not sell this or use it for advertising.

We do not collect your B-hyve password, any payment details (hosted Verdyn accounts are free — there is no payment rail to store), or precise location beyond the ZIP code you provide.

Connecting an AI agent (MCP)

The Expert tier lets you connect your own assistant — Claude, ChatGPT, or any MCP client — to your account. This is opt-in, and it is designed so that no private data is shared or stored beyond what you already gave us:

• Nothing is pushed anywhere. Verdyn never sends your data to an AI provider. Your assistant pulls from your endpoint only when you ask it something, over HTTPS.
• Your agent sees only your own account: the lawn profile, schedule, run history, and public weather — the same things your dashboard shows. It cannot see your B-hyve credentials (we don't have them), your email, other accounts, or anything else.
• We never see your conversations. The endpoint receives individual tool calls, not your chat. We store no prompts, no transcripts, and no record of what you and your assistant discussed — only the timestamp of the key's last use.
• The key is yours to kill: it's shown once, only its hash is stored (like a password), and revoking it from the dashboard cuts off any connected agent immediately.
• Nothing is used for training — by us (we don't train models on your data) and nothing is handed to model providers for them to train on either.

How we use it

• To build your daily watering plan from agronomy, local weather, and your area's watering rules.
• To read your zones and write the resulting schedule to your B-hyve controller.
• To keep the service secure (rate limiting, abuse prevention) and to fix problems.

We do not sell your personal data, and we do not use it for third-party advertising.

Third parties we rely on

• Orbit / B-hyve: to read your zones and send watering commands. Verdyn is an independent product and uses an unofficial interface, which Orbit may change at any time.
• Open-Meteo: weather and evapotranspiration data, looked up by ZIP. No personal account data is sent.
• AI models (optional features only): if you use the sprinkler-head photo scanner, that photo is processed transiently by a vision model and is not stored by Verdyn; the Expert restriction-research feature sends only a ZIP code. Neither ever includes your name, email, or credentials.
• Hosting: our infrastructure providers handle delivery under their own terms.

Retention & storage

Your lawn profile is kept while your subscription is active so Verdyn can keep watering. On iOS, your profile is stored on your device. Encrypted session tokens expire and are re-minted; operational logs are short-lived. When you delete your data, we remove your profile and revoke any active token.

Your choices

• Disconnect at any time from the dashboard — this immediately revokes the stored session token.
• Cancel your subscription — Verdyn stops all zones, turns off access, and revokes the token. See the Terms for details.
• Delete my data — removes your stored profile. On iOS, deleting the app removes the profile from your device.

Security

Connections are encrypted in transit (HTTPS/HSTS). Session tokens are sealed with authenticated encryption at rest. We apply a strict Content-Security-Policy, per-IP rate limiting, and server-side input validation. No system is perfectly secure, but we design Verdyn so that the most sensitive secret — your password — is never something we hold.

Children

Verdyn is intended for adults managing their own irrigation and is not directed to children under 13.

Changes & contact

We may update this policy as the product evolves; we'll revise the “last updated” date above. Questions or data requests: contact us at privacy@verdyn.app.