Maryjane

Privacy Policy

Last updated July 18, 2026

1. Introduction

Maryjane ("the Platform," "we," "us," or "our") is a personal cannabis intelligence platform. Because you're trusting us with sensitive data about your consumption habits and experiences, we take privacy seriously — not as a compliance checkbox, but as a foundational part of how this product works. This policy explains exactly what we collect, how we use it, and what control you have over it.

By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Platform.

2. What We Collect

We collect only what's necessary to provide the service:

  • Account Data: Your email address, used for authentication and transactional communications (account verification, password reset). We do not collect your name unless you choose to add it to your profile.
  • Session Data: Cannabis sessions you log, including product used, consumption method, dosage, effects experienced, side effects, mood, time of day, and any notes you add. This data is entered voluntarily by you.
  • Product & Stash Data: Products you add to your collection, including product type, terpene and cannabinoid profiles, potency, and purchase information you choose to record.
  • Usage Analytics: Basic app usage data (pages visited, features used) to help us understand how the product is being used. This is collected only if you have analytics tracking enabled in your Privacy Settings.
  • Authentication Tokens: Secure session tokens to keep you logged in. These are stored in your browser and expire after inactivity.

We do not collect: your location (unless you explicitly enable it), payment information, biometric data, or any data from your device beyond what is listed above. Date of birth is used only at signup to confirm you are 21 or older and is not stored.

3. Cookies & Tracking Technologies

The Platform uses essential cookies and browser local storage to maintain your authenticated session and store your preferences. These are strictly necessary for the Platform to function and cannot be disabled.

If you enable usage analytics in your Privacy Settings, we may use lightweight analytics tools to understand feature usage. We do not use advertising cookies, tracking pixels, or any cross-site tracking technologies. We do not participate in ad networks or retargeting programs.

4. Authentication

You sign in with email and password. Authentication is handled by Supabase Auth. We store your email and a securely hashed credential representation — never your password in plain text.

If we add third-party sign-in options in the future, we will update this policy and only receive the minimum account identifiers needed (typically email and a unique provider ID). Your use of any third-party provider remains subject to that provider's privacy policy.

5. How We Use Your Data

  • To power your insights:Your session and product data is analyzed for your account to generate correlations, patterns, and recommendations. Personal insights are never pooled with other users' identifiable data.
  • To operate your account: Your email is used to authenticate you, send account-related transactional emails (verification, password reset), and notify you of important changes to the platform.
  • To improve the product: Anonymized, aggregated usage analytics (never session or consumption data) may be used to understand how features are being used. You can disable this in Privacy Settings.
  • We do not use your data for advertising, sell it to third parties, or share it with any external party except as described in this policy.

6. Research Program (Opt-In Only)

Maryjane operates a voluntary research initiative aimed at contributing real-world cannabis experience data to clinical and scientific research. Cannabis research has been severely limited for decades. Longitudinal, self-reported data from real users is exactly what the field is missing.

Participation in this program is entirely optional and requires your explicit, affirmative consent. You will never be enrolled automatically. Research opt-in defaults to off. If you choose to opt in:

  • What is shared: Anonymized session data — effects, terpene correlations, consumption methods, and timing. Personal identifiers (email, profile data) are never included.
  • How it's anonymized: Data is stripped of all personal identifiers and only appears in aggregates that meet a minimum k-anonymity threshold (at least 25 distinct users per aggregate row). Individual users cannot be identified or re-identified from contributed data.
  • Your dashboard is unaffected: Research participation does not change what you see in your own account. Your insights remain personal to you.
  • You can opt out at any time from your Privacy Settings. Opting out immediately stops any future data contribution. Anonymized data already contributed to published research datasets cannot be retroactively removed, as it is no longer identifiable or attributable to any individual.

7. Data Storage & Security

  • Storage: All data is stored securely using Supabase, which provides encryption at rest and in transit (TLS).
  • Access Controls: Row-level security policies ensure that your data is only accessible to your authenticated account. No other user can access your sessions, products, or insights.
  • Authentication Security: Passwords are never stored in plain text. Authentication is handled through Supabase Auth with industry-standard hashing and security practices.
  • Data Minimization: We only collect and retain data that is necessary for the service to function as described in this policy.
  • No Absolute Guarantee: While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

8. Data Retention

  • Active Accounts: Your personal data, session history, and product data are retained for as long as your account remains active.
  • Account Deletion: Upon account deletion, your personal data and session history are permanently removed from our active systems within 30 days. Residual copies in encrypted backups may persist for up to 90 days before being purged through normal backup rotation.
  • Research Data: Anonymized data contributed to the research program prior to account deletion or opt-out cannot be removed, as it is no longer identifiable.
  • Legal Obligations: We may retain certain data as required by applicable law, even after account deletion.

9. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal data, we will:

  • Investigate the scope and impact of the breach promptly.
  • Notify affected users via email within 72 hours of confirming the breach, or as required by applicable law, whichever is sooner.
  • Notify applicable regulatory authorities as required by law.
  • Take reasonable steps to mitigate the effects of the breach and prevent recurrence.

10. Your Rights & Controls

  • Access: You can view all data associated with your account at any time through the app.
  • Correction: You can edit or delete individual sessions, products, and profile information directly in the app.
  • Data Export: You can request a portable export of your data through Account Settings.
  • Account Deletion: You can delete your account through Account Settings. See Section 8 for retention details.
  • Analytics Opt-Out: You can disable usage analytics tracking in Privacy Settings at any time.
  • Research Opt-Out: If you have opted into the research program, you can withdraw at any time from Privacy Settings.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
  • Right to Opt Out of Sale: We do not sell your personal information. We have never sold personal information and have no plans to do so.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
  • Sensitive Personal Information: Cannabis consumption data may be considered sensitive personal information under California law. We use this data only to provide the services you have requested and do not use it for any secondary purposes without your explicit consent.

To exercise these rights, contact us at privacy@maryjane.dev. We will respond to verified requests within 45 days.

12. Children's Privacy

The Platform is not intended for use by anyone under the age of 21. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a user under 21, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@maryjane.dev.

13. International Users

The Platform is operated from the United States. If you access the Platform from outside the United States, you acknowledge that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Platform, you consent to this transfer.

14. Legal Disclosure

We do not voluntarily share your data with law enforcement or government agencies. We will only disclose your personal information where required by a valid legal obligation (e.g., a court order, subpoena, or other binding legal process). In such cases, we will notify you to the extent permitted by law. We will challenge overly broad or unjustified requests where reasonably possible.

15. Policy Updates

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and/or email, and update the date at the top of this page. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

16. Contact

For privacy-related questions, data requests, or concerns, contact us at privacy@maryjane.dev. We aim to respond to all inquiries within 30 days.