Privacy Policy

1. Information We Collect

We collect personal information when you create an account, make a purchase, subscribe to our newsletter, submit a product review, use the Watch Later feature, or contact us. This includes your name, email address, shipping address, and payment details.

We also automatically collect technical data such as your IP address, browser type, device information, usage patterns, and approximate location through cookies and similar technologies.

Account Registration

You may create an account using your email and password or by signing in with Google OAuth. When you use Google sign-in, we receive your name, email address, and profile picture from Google. We do not access any other Google account data.

Product Reviews

When you submit a product review, we collect your name, email address, rating, and review text. Your email is used for verification only and is never displayed publicly. Reviews are moderated before being published.

Watch Later & Preferences

If you save videos or articles to your Watch Later list, this data is stored locally in your browser (localStorage). If you are signed in, your Watch Later list is synced to your account so it is available across devices. We also store your currency preference and learning progress locally in your browser.

Strain Database & Tools

When you browse the strain database, use the Strain Finder quiz, or use the Dosage Calculator, no personal data is collected or stored on our servers. Quiz answers are used only to generate results in your browser and are not retained. The Sesh Timer stores your playlist selection, volume preference, and timer-music link state in localStorage.

Stash Run Game

Stash Run is a free in-browser arcade game with an optional public leaderboard. When you submit a score, we store the display name you choose, your best score, and an internal member identifier. We do not store IP addresses, gameplay recordings, device fingerprints, or any other technical data alongside leaderboard entries.

If you are signed in, your leaderboard entry uses your account handle (falling back to your account name, then to the name you typed). Signed-in entries are keyed to your account so improving your score updates the same row. If you play without an account, your entry is keyed to the name you type; entering the same name on the same device later will update that same row. Display names are limited to 16 characters and are automatically masked for common slurs and profanity before being stored.

Leaderboard entries (display name and score) are publicly visible on the Stash Run leaderboard, in social share cards generated from the game, and in any image links you choose to share. Personal-best scores, mute preferences, character selection, and viewport-fill preferences are stored locally in your browser only and never sent to our servers.

Highbrow Daily Crossword

Highbrow is a free daily cannabis crossword with an optional public leaderboard. You can play, and your progress is saved on your device, without an account. Posting a time to the leaderboard requires you to be signed in.

When you post a time, we store your display name (your account handle, falling back to your account name), your account profile picture if you have one, your solve time, and the dates you have solved, which are used to calculate your streak and lifetime stats. These are keyed to your account so the same numbers appear on every device you sign in on. Your display name, profile picture, and solve time are publicly visible on the leaderboard and in social share cards generated from your result. Display names are automatically masked for common slurs and profanity. We do not store IP addresses, keystrokes, or device fingerprints alongside leaderboard entries.

Your in-progress puzzle, which days you have completed, and your display preferences such as the visual theme are stored locally in your browser. To keep the leaderboard fair, entries that appear invalid or automated are not counted.

Strain Widget (Embedded on Other Sites)

We offer a free strain-card widget that other websites can embed. When you visit a third-party site that displays one of our strain cards, your browser requests the card's data from our servers. As part of that request our servers receive your IP address, which we use only to detect and prevent abusive automated traffic. It is not tied to your identity and is not stored, except briefly when an address is involved in abuse, in which case it is held only long enough to enforce a temporary block and is then removed. We also record the domain of the site displaying the card as an aggregate count of which sites use the widget; this is not linked to individual visitors.

The widget does not set cookies or store anything in your browser, and it shows only public strain reference information. If you are a site owner and you join the white-label waitlist, the email address you submit is handled as described under Newsletter, using Mailchimp.

App & Plugin Purchases

When you buy a software license such as Incognito, the purchase is processed by Lemon Squeezy, our Merchant of Record. Lemon Squeezy collects the information needed to complete the sale, including your name, email address, billing address, payment details, and location data used to calculate applicable tax, and it emails your receipt and license key. Herbistry LLC receives order and license records, such as your email address and the product purchased, but does not receive your full payment-card details. The free trial installer is delivered as a direct download from our content-delivery provider, Bunny, which receives standard technical request data such as your IP address.

When you activate a license inside the plugin, the plugin contacts Lemon Squeezy's licensing service to verify your key, sending your license key and a device name you provide. Your license key and an activation identifier are then stored locally on your own computer so that you only activate once. Incognito processes your audio entirely on your device; it does not listen to, record, or upload your audio.

2. How We Use Your Information

Your information is used to process orders and payments, send order confirmations and shipping updates, deliver marketing communications (with your consent), improve our website and services, prevent fraud and abuse, and comply with legal obligations.

3. Legal Basis for Processing (GDPR)

We process your data based on: your consent (e.g., newsletter sign-up, cookie preferences), contractual necessity (e.g., fulfilling orders), legitimate interest (e.g., improving our services, fraud prevention), and legal compliance (e.g., tax records).

4. Cookies & Local Storage

We use the following cookies and browser storage:

Cookies

• herbistry420_age_verified — records age verification status (30 days)
• Authentication session — maintains your signed-in status

Local Storage

• Watch Later list — saved videos and articles (persists until cleared)
• Shopping cart — items in your cart (persists until cleared)
• Learning progress — course and lesson completion (persists until cleared)
• Currency and exchange rates — cached for approximately 24 hours
• Sesh Timer preferences — playlist selection, volume level, timer-music link state (persists until cleared)
• Tool help overlays — whether you have dismissed help modals on the Strain Finder, Dosage Calculator, and Sesh Timer (persists until cleared)
• Stash Run preferences — personal best score, mute state, character selection, and viewport-fill toggle (persists until cleared)
• Highbrow preferences — your in-progress puzzle, completed days, and visual theme (persists until cleared)

Stash Run does not set any cookies; all of its in-browser data lives in localStorage as listed above.

Analytics

We use Vercel Web Analytics, which is cookieless and does not store identifiers in your browser. It records aggregate page-view counts and approximate geographic region for measuring site usage. No personal data is collected and no banner is required because no terminal-equipment storage takes place.

You can manage browser-stored items (cart, watch later, currency preference) by clearing your browser storage.

5. Third-Party Services

We work with trusted third-party services to operate our platform:

• Stripe — payment processing for the merchandise store (receives payment and shipping details)
• Lemon Squeezy — Merchant of Record for software-license sales such as Incognito (receives your name, email, billing address, payment details, and location for tax; processes payments, refunds, and chargebacks; issues receipts and license keys)
• Printful — print-on-demand fulfillment (receives shipping address and order details)
• Resend — transactional email delivery (sends order confirmations, shipping notifications, welcome emails, and contact form replies)
• Mailchimp — newsletter management (receives your email address when you subscribe)
• Google OAuth — optional sign-in authentication (receives basic profile info)
• Anthropic (Claude API) — AI-assisted content generation from YouTube video transcripts (no user personal data is sent; only publicly available video transcript text is processed)
• Neon — strain database storage (stores strain data only, no user personal data)
• YouTube / YouTube Data API — embedded video playback on blog posts and the Sesh Timer, video metadata retrieval for our content pipeline (no user data is sent to YouTube beyond standard embed behavior)
• Bunny (bunny.net) — content-delivery network for video playback and the Incognito trial-installer download (receives standard technical request data such as IP address)
• Google Search Console — search performance monitoring (uses aggregated, anonymized search data)
• Google Merchant Center — product listing feeds for Google Shopping (receives product data, not user data)
• Sanity — content management and user account data storage
• Vercel — website hosting, serverless infrastructure, and cookieless aggregate page-view analytics
• Upstash — leaderboard storage for Stash Run and Highbrow (display name, score or solve time, profile picture, and internal member ID) and short-lived abuse-prevention counters for the strain widget

Each service provider operates under their own privacy policies and only receives the data necessary to perform their function.

6. Email Communications

Transactional Emails

We send the following transactional emails via Resend:

• Welcome email upon account registration
• Order confirmation after purchase
• Shipping notification with tracking information
• Order updates and customer notes
• Contact form responses to admin

Newsletter

Newsletter subscriptions use double opt-in via Mailchimp. After entering your email, you will receive a confirmation email and must click the confirmation link to activate your subscription. Marketing emails include an unsubscribe link. You can opt out at any time; we will process your request within 10 business days. Opting out of marketing does not affect transactional emails.

7. AI-Generated Content

We use Anthropic's Claude API to assist in generating written articles from publicly available YouTube video transcripts. This process does not involve any user personal data. The transcripts processed are from our own YouTube channel content. No user-submitted content is sent to AI services.

8. Companion Apps

Herbistry420 develops companion applications including VapeHeatLab and DoseCraft. These apps may collect additional usage data as described in their respective privacy notices. Data collected through the apps is not shared with the main Herbistry420 website unless you explicitly link your accounts.

9. Affiliated Websites

Original artwork by Fordee is showcased on Herbistry420 but sold exclusively through CantStopArt.com. When you follow links to CantStopArt, their privacy policy governs your data. We do not share your Herbistry420 account data with CantStopArt.

10. Data Sharing

We do not sell your personal information. We only share data with service providers under confidentiality agreements, when required by law, or in the event of a business transfer (e.g., merger or acquisition).

11. Data Retention

• Account data — retained while your account is active and for 30 days after deletion request
• Order records — kept for 7 years as required by tax law
• Newsletter subscriptions — retained until you unsubscribe
• Product reviews — retained while published; removed upon request
• Watch Later data — retained while your account is active; localStorage data persists until you clear your browser
• Contact form messages — retained for up to 12 months
• Analytics data — aggregate page-view counts retained by Vercel Web Analytics on a rolling 1-month window (no identifiers stored)
• Stash Run leaderboard — display name and best score retained indefinitely so the leaderboard remains continuous; removed upon request via our contact page
• Highbrow leaderboard — display name, profile picture, solve time, and solve dates retained while the leaderboard runs and in archived daily boards; removed upon request
• Strain widget — an IP address involved in abuse is held only long enough to enforce a temporary block, then removed; embedding-site domains are kept as an aggregate usage count

You may request deletion of your data at any time.

12. Your Privacy Rights

GDPR (EEA/UK residents): You have the right to access, correct, delete, restrict processing, and port your data. You may also withdraw consent at any time.

CCPA/CPRA (California residents): You have the right to know what data we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

How to Exercise Your Rights

To make a data access, correction, or deletion request, please contact us through our contact page with the subject line "Data Request." We will verify your identity and respond within 30 days.

13. Age Restrictions

Herbistry420 is intended for users aged 21 and older. Age verification is required before accessing site content. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected data from a minor, we will delete it promptly.

14. Data Security

We use industry-standard measures to protect your information, including encryption of data in transit and PCI-compliant payment processing for purchases. No system is completely secure, but we take reasonable steps to safeguard your data and to detect and prevent abuse.

15. International Data Transfers

Herbistry420 operates from Barcelona, Spain. Our service providers, including Stripe, Lemon Squeezy, Printful, Bunny, Resend, Mailchimp, and Anthropic, may process data in the United States, Europe, or other locations where they maintain infrastructure. For EEA/UK users, international transfers are protected by Standard Contractual Clauses (SCCs) and applicable data protection frameworks.

16. Changes to This Policy

We may update this policy periodically. Changes will be noted with an updated effective date. Significant modifications will be communicated via email to registered users.

17. Contact

For privacy inquiries or data requests, please reach out through our contact page.