Privacy Policy
In plain English
Summary, not a substitute for the full policy.
- We collect the minimum needed to run the app, most of it expires on its own, and we never sell your personal data.
- Place listings and public check-in photos you submit are shown to other users with your display name.
- No advertising identifier, no cross-app tracking, no screen recording, and your data is never sold, rented, or traded.
- Each check-in is visible to others or only to you: you choose, nothing is pre-selected, and you can change it any time.
- Delete everything at any time from Account or /delete-account, or email us for a JSON export of your check-ins.
- WeedCentral is for adults 21+ only.
WeedCentral ("we", "our", "the app") is built by WeCe LLC. This policy explains what data we collect, why we collect it, how we store it, and the rights you have over it. We collect the minimum data needed to operate the app and we do not sell your personal data to anyone.
1. Data we collect
| Data type | Why we collect it | Where it's stored |
|---|---|---|
| Firebase Authentication user ID | Identifies your account so your check-ins persist across devices. | Firebase Authentication (Google Cloud, US-region) |
| Email address | Provided by Apple or Google when you sign in. Used for account recovery and security alerts only, never marketing. | Firebase Authentication |
| Check-in content (strain ID, rating, notes, mood, photos, optional location) | This is your personal record. We store it so you can read it back and so other signed-in users can see content you've made public via the community feed. | Firebase Firestore + Firebase Storage |
| Push notification token | If you grant notification permission, we use this to send you streak reminders and social activity. Removed when you sign out. | Firestore, on your User document |
| Usage events (e.g. strain_viewed, check_in_saved) | Helps us understand which features matter and which to retire. Events do not include free-text notes or photos. Each event is tagged with the same random account identifier your crash reports use: not your email address and not your name. When you use Cannabi Helpful, our servers also record an event for each reply: whether it worked, how long it took, and the general type of question (for example a recommendation or a strain lookup), never the question or the reply itself. Deleted after 12 months. | Firestore AnalyticsEvents collection |
| Check-ins and messages sent to the Cannabi Helpful guide | When you open Cannabi Helpful or ask it a question, we send your recent check-ins (strain, product type, date, star rating, moods, and up to the first 240 characters of your notes), your question, and the recent messages of the conversation to Google's Vertex AI so it can answer questions about your own history. We do not send your name, your email address, your photos, or your location. Nothing is sent unless you open the feature. | Google Vertex AI (Google Cloud, US-region). Not retained by us beyond the conversation record in the row below. |
| Cannabi Helpful conversations | The questions you ask the guide and the answers it gives, so you can reopen a past conversation instead of starting over. They stay private to your account: other users can't see them, and no one at WeedCentral reads them. The one exception is a conversation you choose to send us, for example by emailing support@weed-central.com when you report a problem. Then we read only what you sent. Kept until you delete the conversation or delete your account. | Firestore, in your account's CannabiConversations subcollection |
| Reports + blocks (when you submit them) | Required by Apple Guideline 1.2 to enforce the zero-tolerance content policy described in our Terms. | Firestore Reports + Blocks collections |
| Scanned web links (Smart Scan) | When you use Smart Scan and a scanned QR code contains a web link, the app sends that link to our server, which fetches the linked page to extract product details such as strain, brand, and THC/CBD. We only read links that you scan. | Firestore UrlExtraction cache (Google Cloud, US-region), auto-deleted after 7 days |
| Smart Scan diagnostic logs | While you use Smart Scan, the app records a diagnostic log of the scan session: the codes it read (QR links, barcodes, package tags), what each lookup resolved, and basic device/app-version details. We use these logs solely to fix scanning and lab-report parsing problems, including reproducing a scan you report as wrong. They are visible only to WeedCentral administrators. | Firestore ScanSessions collection (Google Cloud, US-region), auto-deleted after 90 days |
| Crash and performance diagnostics | When the app crashes, freezes, or hits an unexpected error, we send a diagnostic report so we can fix it. A report contains the error and its stack trace, the app version, the device model and OS version, and a trail of recent in-app screen names (for example "Navigation to Strain Detail"). Reports are tagged with a random account identifier, so we can tell whether one person hit a bug fifty times or fifty people hit it once, and so we can follow up if you write to support about it. That identifier is not your email address and not your name: only we can match it back to an account, and our error-monitoring provider cannot. We use these reports only to diagnose and fix defects. We do not record your screen and we do not capture session replays or screenshots. | Sentry (Functional Software, Inc.), our error-monitoring provider, US-region. Retained per Sentry's standard retention (90 days). |
| App-open and logged-out browse counts | Tells us how many people open the app at all, and which tabs they look at before deciding whether to sign up. These counts are tied to a random ID the app generates for itself on first launch: it is not your device ID, no other app can read it, and it is gone for good if you delete the app. Once you sign in, we link that ID to your account so we can see the path from first open to first check-in. We record the tab name only (Explore, Learn, Places, Strain), never what you searched for or viewed. | Firestore Installs, InstallOpens, and BrowseEvents collections |
| Which link brought you here | If you reached the app store by tapping a link we posted somewhere (a social post, a printed QR code, a page on our website), we carry a short label for that place, for example "threads" or "qr_code", into the app on your first launch and store it on your account. It tells us which of our own posts is worth repeating. It is a label for our link, not a profile of you: it says nothing about who you are, carries no identifier from the other site, and is never shown to anyone but us. The label reaches us because our link leaves it on your device's clipboard, so on your very first launch the app looks there once, and only once. It keeps the label if it finds one; otherwise it keeps a single word recording that our label was absent, or that the check could not run, which is how we tell an app-store search apart from a broken link. Nothing else on your clipboard is read, kept or sent, and if you found us by searching the app store no label is stored. | Firestore Installs and User collections |
| How you heard about us (optional) | Right after you create an account, the app asks once how you heard about WeedCentral (for example TikTok, a friend, or an app store search). Answering is one tap and entirely optional: if you tap Skip we store the word "skipped" so we never ask again. We keep your answer and the time you gave it on your account, to learn which of our channels actually reach people. It is a single label you chose from a fixed list, never free text. The app never shows it to other users, and we do not sell it or share it with third parties. Kept until you delete your account. | Firestore, on your User document |
| Outbound booking taps | If you tap a "Book" link on a place listing, we record that one tap so we can reconcile the commission a partner later reports (see section 4). The record holds the single-use click id, the place, the partner, the outbound link, and the same random account identifier used above: not your email address and not your name. It holds nothing about the booking itself. Deleted after 12 months, or immediately if you delete your account. | Firestore BookingClicks collection |
Crash and performance diagnostics are the only category above that is processed outside Google Cloud. Sentry acts as our service provider (a data processor): it may use the data only to provide the error-monitoring service to us, and never for its own purposes. You can read Sentry's privacy policy for details.
How long we keep it
Usage events and outbound booking taps are deleted after 12 months. Smart Scan diagnostic logs are deleted after 90 days, scanned-link caches after 7 days, and logged-out browse and per-day open records after 6 months. Crash diagnostics expire on Sentry's own 90-day schedule. Deletion is automatic: Firestore removes each record on its expiry date without anyone having to run anything.
Two things have no expiry date, because neither one identifies you. The first is the per-install record that counts how many people opened the app, which we keep so our historical signup numbers stay comparable. The second is your own account and check-ins, which stay until you delete them. Your Cannabi Helpful conversations follow that same rule: they stay until you delete them, and they go with your account if you delete it. The invite records described in section 8 are the one exception: they have no expiry date and stay after you delete your account.
The newsletter (only if you subscribe)
We publish a free weekly email newsletter, Lab Notes. It is separate from the app: signing in never subscribes you, and we never add your account email to it. To subscribe, you type an email address into the signup form at newsletter.weed-central.com. That form and the newsletter run on beehiiv, our email provider, which stores the address and processes it on our behalf only to send you the newsletter. beehiiv also records whether each issue was delivered and opened, whether a link in it was clicked, and which page sent you to the form (our website adds a short label for that). We look at those numbers only to learn which topics are worth writing about.
Every issue has an unsubscribe link, and one click stops all further emails. We never sell, rent or trade your address, and we use it for nothing but the newsletter. To have it deleted from the list entirely, email privacy@weed-central.com and we will remove it. beehiiv's privacy policy describes how it handles the data it processes for us.
2. Community content shown publicly
When you submit a place listing to the Places directory, the business details you provide (name, address, hours, description, category) and the approximate coordinates we derive from that address are shown publicly to every other signed-in WeedCentral user. Photos you attach to a listing are also shown publicly, captioned with your display name. If you do not want this information to be visible to other users, do not submit it. You can request removal of a submission at any time by emailing support@weed-central.com or by using the Report action on the place page.
Public check-in photos. When you make a check-in public, one of its photos may be featured as a strain "hero" image in our strain catalog (for example on the Explore list and the Strain Detail screen), captioned with your display name. Private check-ins, and any individual photo you mark private, are never featured. You can request removal from strain hero placement at any time by emailing support@weed-central.com or using the Report action on the check-in.
3. Third-party content in the Learn tab
The Learn tab surfaces a curated set of third-party cannabis news and educational articles. For each article we store only the title, a short excerpt (capped at 280 characters) taken from the publisher's own RSS feed or open metadata, the author byline as provided, a hot-linked reference to the publisher's cover image when available, and a canonical link back to the original article on the publisher's site. Reading the full article requires tapping the canonical link, which opens the publisher's own site in your device's browser. WeedCentral does not republish article bodies, mirror images locally, or otherwise reproduce more than is necessary to identify the article and link to it.
WeedCentral is not affiliated with, endorsed by, or sponsored by any of the publishers whose articles appear in the Learn tab. Publisher names and trademarks remain the property of their respective owners and are used solely to identify the source of each excerpt. If you are a copyright owner and believe content reachable through the Learn tab infringes your copyright, see our DMCA policy for how to submit a takedown notice.
4. Affiliate and outbound booking links
Some place listings, such as cannabis-friendly hotels, may include a "Book" link to a third-party travel or lodging partner. When you tap such a link, the app opens the partner's website in your browser and appends a random, single-use click identifier (a "sub id") plus non-personal place details (such as the place name and city) to the URL, so the partner can credit a resulting booking to WeedCentral and pay us an affiliate commission. This click identifier is not your name, email, advertising identifier, or any cross-app tracking id, and we do not share your check-in history, location history, or account profile with booking partners. We log the tap (the click id, the place, and a coarse user reference) in our own systems to reconcile commissions; that record is deleted after 12 months, or immediately if you delete your account. Any booking, and anything you enter on the partner's site, is governed by that partner's own terms and privacy policy. We never receive your payment details.
5. What we do not collect
None of the following is collected or done by WeedCentral:
- The iOS IDFA or any cross-app advertising identifier. The app does not track you across other apps or websites.
- Contacts, calendar entries, microphone audio, or background location.
- Selling, renting, or trading your personal data. If we ever offer aggregated, anonymized insights (never identifying you), participation will be strictly opt-in.
- Sharing your check-in content with anyone. The only exceptions are features you explicitly opt into (e.g. publishing to the community feed) and the service providers listed in section 1, who process it on our behalf and only to run the app.
- Screen recording, screenshots, or session-replay tooling of any kind.
6. Sensitive information and consent
A check-in records what you consumed and how it felt: the strain, the product type, a rating, the moods you pick, your notes, and any photos you attach. WeedCentral is a lifestyle journal. We are not a healthcare provider, we are not a HIPAA-covered entity, and we make no medical, diagnostic or treatment claims.
Your check-in content can still say something about you, so we treat it as sensitive whatever it is called. We do not sell it. We do not share it with advertisers, data brokers or any third party for their own purposes. It stays in Google Cloud, and the only category that leaves is the crash and performance diagnostics described in section 1. Inside Google Cloud, the one place a generative model reads it is Cannabi Helpful, and only when you open that feature: see the corresponding row in section 1.
We ask for your consent twice, and separately. When you create your account, you are asked to consent to us storing the check-ins you create: that is its own switch, alongside the 21+ confirmation and the licence terms, and the app records the moment you give it. Then, the first time you save a check-in, we ask a second and different question before anything is written: whether that check-in is visible to other WeedCentral users or only to you. Neither answer is pre-selected.
You stay in control after that. Every check-in has its own visibility setting you can change at any time, individual photos and the price you paid have their own controls, and deleting your account removes all of it. See section 8 for how to delete or export your data.
7. How we protect your data
- All traffic between the app and Firebase is encrypted with HTTPS / TLS.
- Firestore Security Rules enforce that only the owner of a document can write or delete it. Cloud Functions running with the Admin SDK are limited to specific moderation and account-deletion paths.
- Photos uploaded with check-ins are scanned by Google Cloud Vision SafeSearch to enforce content guidelines.
- We do not have access to your Apple or Google account password. We rely on Sign in with Apple / Google OAuth.
8. Your rights
Delete your account
In the app, open the Account tab and tap Delete Account, or use the web account-deletion form. We delete your User document, all your check-ins, your photos in Firebase Storage, your push token, your reports, any blocks you've submitted, and the record of who invited you. Account deletion is irreversible.
Three invite records stay because they are not only yours: if you invited friends, their accounts still name your account (by its email) as the one that invited them; any free Premium months we already gave for those invites stay on record; and if a friend invited you, we keep a one-way fingerprint of your email (a hash, never the email itself) so the same email can't be counted as a new invite twice. Your invite code is retired and no longer points to you.
Export your data
Email support@weed-central.com from the email associated with your account and we will send you a JSON export of all your check-ins within 30 days, in compliance with GDPR Article 15 and CCPA §1798.110.
Opt out of analytics
Usage events are essential to running the service and cannot be disabled separately. They contain no free-text content. If you delete your account, all linked events are removed, along with your Smart Scan diagnostic logs and your outbound booking taps.
Crash and performance diagnostics likewise cannot be disabled separately: an app that cannot report its own crashes cannot be kept working. They expire on their own within 90 days. If you want a specific diagnostic report removed sooner, email privacy@weed-central.com and we will delete it.
9. Children
WeedCentral is for adults 21+ in jurisdictions where adult-use cannabis is legal. We do not knowingly collect data from anyone under 18. If you believe a minor has registered an account, email us and we will delete it.
10. Changes
Material changes to this policy will be reflected in the "Last updated" date at the top of this page and, where significant, surfaced in-app the next time you sign in.
11. Contact
Email: support@weed-central.com