WeedCentral
Privacy Policy
WeedCentral ("we", "our", "the app") is built by WeCe LLC. This policy explains what data we collect, why we collect it, how we store it, and the rights you have over it. We collect the minimum data needed to operate the app and we do not sell your personal data to anyone.
1. Data we collect
| Data type | Why we collect it | Where it's stored |
|---|---|---|
| Firebase Authentication user ID | Identifies your account so your check-ins persist across devices. | Firebase Authentication (Google Cloud, US-region) |
| Email address | Provided by Apple or Google when you sign in. Used for account recovery and security alerts only — never marketing. | Firebase Authentication |
| Check-in content (strain ID, rating, notes, mood, photos, optional location) | This is your personal record. We store it so you can read it back and so other signed-in users can see content you've made public via the community feed. | Firebase Firestore + Firebase Storage |
| Push notification token | If you grant notification permission, we use this to send you streak reminders and social activity. Removed when you sign out. | Firestore, on your User document |
| Usage events (e.g. strain_viewed, check_in_saved) | Helps us understand which features matter and which to retire. Events do not include free-text notes or photos. Each event is tagged with the same random account identifier your crash reports use: not your email address and not your name. Deleted after 12 months. | Firestore AnalyticsEvents collection |
| Cannabi Helpful conversations | The questions you ask the guide and the answers it gives, so you can reopen a past conversation instead of starting over. Visible only to you: no one at WeedCentral can read them. Kept until you delete the conversation or delete your account. | Firestore, in your account's CannabiConversations subcollection |
| Reports + blocks (when you submit them) | Required by Apple Guideline 1.2 to enforce the zero-tolerance content policy described in our Terms. | Firestore Reports + Blocks collections |
| Scanned web links (Smart Scan) | When you use Smart Scan and a scanned QR code contains a web link, the app sends that link to our server, which fetches the linked page to extract product details such as strain, brand, and THC/CBD. We only read links that you scan. | Firestore UrlExtraction cache (Google Cloud, US-region), auto-deleted after 7 days |
| Smart Scan diagnostic logs | While you use Smart Scan, the app records a diagnostic log of the scan session: the codes it read (QR links, barcodes, package tags), what each lookup resolved, and basic device/app-version details. We use these logs solely to fix scanning and lab-report parsing problems, including reproducing a scan you report as wrong. They are visible only to WeedCentral administrators. | Firestore ScanSessions collection (Google Cloud, US-region), auto-deleted after 90 days |
| Crash and performance diagnostics | When the app crashes, freezes, or hits an unexpected error, we send a diagnostic report so we can fix it. A report contains the error and its stack trace, the app version, the device model and OS version, and a trail of recent in-app screen names (for example "Navigation to Strain Detail"). Reports are tagged with a random account identifier, so we can tell whether one person hit a bug fifty times or fifty people hit it once, and so we can follow up if you write to support about it. That identifier is not your email address and not your name: only we can match it back to an account, and our error-monitoring provider cannot. We use these reports only to diagnose and fix defects. We do not record your screen and we do not capture session replays or screenshots. | Sentry (Functional Software, Inc.), our error-monitoring provider, US-region. Retained per Sentry's standard retention (90 days). |
| App-open and logged-out browse counts | Tells us how many people open the app at all, and which tabs they look at before deciding whether to sign up. These counts are tied to a random ID the app generates for itself on first launch: it is not your device ID, no other app can read it, and it is gone for good if you delete the app. Once you sign in, we link that ID to your account so we can see the path from first open to first check-in. We record the tab name only (Explore, Learn, Places, Strain), never what you searched for or viewed. | Firestore Installs, InstallOpens, and BrowseEvents collections |
Crash and performance diagnostics are the only category above that is processed outside Google Cloud. Sentry acts as our service provider (a data processor): it may use the data only to provide the error-monitoring service to us, and never for its own purposes. You can read Sentry's privacy policy for details.
How long we keep it
Usage events are deleted after 12 months. Smart Scan diagnostic logs are deleted after 90 days, scanned-link caches after 7 days, and logged-out browse and per-day open records after 6 months. Crash diagnostics expire on Sentry's own 90-day schedule. Deletion is automatic: Firestore removes each record on its expiry date without anyone having to run anything.
Two things have no expiry date, because neither one identifies you. The first is the per-install record that counts how many people opened the app, which we keep so our historical signup numbers stay comparable. The second is your own account and check-ins, which stay until you delete them. Your Cannabi Helpful conversations follow that same rule: they stay until you delete them, and they go with your account if you delete it.
2. Community content shown publicly
When you submit a venue listing to the Discover directory, the business details you provide (name, address, hours, description, category) and the approximate coordinates we derive from that address are shown publicly to every other signed-in WeedCentral user. Photos you attach to a listing are also shown publicly, captioned with your display name. If you do not want this information to be visible to other users, do not submit it. You can request removal of a submission at any time by emailing support@weed-central.com or by using the Report action on the venue page.
Public check-in photos. When you make a check-in public, one of its photos may be featured as a strain "hero" image in our strain catalog (for example on the Explore list and the Strain Detail screen), captioned with your display name. Private check-ins, and any individual photo you mark private, are never featured. You can request removal from strain hero placement at any time by emailing support@weed-central.com or using the Report action on the check-in.
3. Third-party content in the Learn tab
The Learn tab surfaces a curated set of third-party cannabis news and educational articles. For each article we store only the title, a short excerpt (capped at 280 characters) taken from the publisher's own RSS feed or open metadata, the author byline as provided, a hot-linked reference to the publisher's cover image when available, and a canonical link back to the original article on the publisher's site. Reading the full article requires tapping the canonical link, which opens the publisher's own site in your device's browser. WeedCentral does not republish article bodies, mirror images locally, or otherwise reproduce more than is necessary to identify the article and link to it.
WeedCentral is not affiliated with, endorsed by, or sponsored by any of the publishers whose articles appear in the Learn tab. Publisher names and trademarks remain the property of their respective owners and are used solely to identify the source of each excerpt. If you are a copyright owner and believe content reachable through the Learn tab infringes your copyright, see our DMCA policy for how to submit a takedown notice.
4. Affiliate and outbound booking links
Some place listings, such as cannabis-friendly hotels, may include a "Book" link to a third-party travel or lodging partner. When you tap such a link, the app opens the partner's website in your browser and appends a random, single-use click identifier (a "sub id") plus non-personal place details (such as the place name and city) to the URL, so the partner can credit a resulting booking to WeedCentral and pay us an affiliate commission. This click identifier is not your name, email, advertising identifier, or any cross-app tracking id, and we do not share your check-in history, location history, or account profile with booking partners. We log the tap (the click id, the place, and a coarse user reference) in our own systems to reconcile commissions. Any booking, and anything you enter on the partner's site, is governed by that partner's own terms and privacy policy. We never receive your payment details.
5. What we do not collect
- We do not use the iOS IDFA or any cross-app advertising identifier. The app does not track you across other apps or websites.
- We do not collect contacts, calendar entries, microphone audio, or background location.
- We do not sell, rent, or trade your personal data. If we ever offer aggregated, anonymized insights (never identifying you), participation will be strictly opt-in.
- We do not share your check-in content with anyone outside of features you explicitly opt into (e.g. publishing to the community feed), other than with the service providers listed in section 1 who process it on our behalf and only to run the app.
- We do not record your screen, capture screenshots, or use session-replay tooling of any kind.
6. How we protect your data
- All traffic between the app and Firebase is encrypted with HTTPS / TLS.
- Firestore Security Rules enforce that only the owner of a document can write or delete it. Cloud Functions running with the Admin SDK are limited to specific moderation and account-deletion paths.
- Photos uploaded with check-ins are scanned by Google Cloud Vision SafeSearch to enforce content guidelines.
- We do not have access to your Apple or Google account password. We rely on Sign in with Apple / Google OAuth.
7. Your rights
Delete your account
Open the app → Account tab → Delete Account, or use the web account-deletion form. We delete your User document, all your check-ins, your photos in Firebase Storage, your push token, your reports, and any blocks you've submitted. Account deletion is irreversible.
Export your data
Email support@weed-central.com from the email associated with your account and we will send you a JSON export of all your check-ins within 30 days, in compliance with GDPR Article 15 and CCPA §1798.110.
Opt out of analytics
Usage events are essential to running the service and cannot be disabled separately. They contain no free-text content. If you delete your account, all linked events are removed, along with your Smart Scan diagnostic logs.
Crash and performance diagnostics likewise cannot be disabled separately: an app that cannot report its own crashes cannot be kept working. They expire on their own within 90 days. If you want a specific diagnostic report removed sooner, email privacy@weed-central.com and we will delete it.
8. Children
WeedCentral is for adults 21+ in jurisdictions where adult-use cannabis is legal. We do not knowingly collect data from anyone under 18. If you believe a minor has registered an account, email us and we will delete it.
9. Changes
Material changes to this policy will be reflected in the "Last updated" date at the top of this page and, where significant, surfaced in-app the next time you sign in.
10. Contact
Email: support@weed-central.com