Privacy policy
Last updated: 2026-05-08
Plain-English summary
- We store your email, password (hashed), display name, ratings, and any photos you upload.
- We use that data to train a model that predicts your future preferences. We do not sell it.
- We share aggregated, anonymized demand data with partnered dispensaries and shops. They never see who you are.
- You can export everything we have on you, or delete your account, from the in-app profile screen.
- Geofence region monitoring runs on your device. Your location is never sent to our servers.
What we collect
Account information you provide (email, password, optional display name). Behavioral data you generate (ratings, effect tags, notes, photos, identifications). Service telemetry (IP address, user-agent — used for rate limiting and abuse prevention). Optional location permissions used only by your device's region-monitoring system; region crossings trigger local notifications without sending coordinates to our servers.
How we use it
Your ratings train a personal model that produces predictions for you. Aggregated and anonymized rating distributions are shown to partner dispensaries (e.g. "users in your area predicted ≥4.5 on this product"). We never share individual ratings, identifying info, or location with partners.
Sharing
We use sub-processors for hosting (cloud infrastructure), email delivery (Resend), error monitoring, and analytics. Each receives only the minimum data needed to perform its function. We do not run advertising networks; we do not sell or rent personal data.
Your rights
- Export — every rating, prediction, and event in machine-readable JSON: Profile → Export my data.
- Delete — full cascade-delete of your account from the same screen.
- Correct — edit any rating from the My ratings screen.
- Object — opt out of cross-brand sharing or aggregated demand reporting in Profile → Settings.
Retention
Active accounts: indefinitely. Deleted accounts: data is purged within 30 days. Aggregated analytics derived before deletion remain anonymized and are not reversible.
Contact
privacy@xbrain.dev. Operated by BudBrain LLC.