Privacy Policy

• Account info — email, password (hashed), role (grower / breeder / admin), join date, and a public handle (3-30 characters; unique). Your handle is your public @-identifier — comment bylines, journal authorship, your profile URL. Your email is never displayed publicly.
• User content — journal entries with weekly notes, structured grow setup, environmental measurements (temperature, humidity, pH, PPM, lighting), and photos. Comments — including replies, "Helpful" reactions, journal-owner pins, breeder endorsements, @-mentions, and photo attachments. Strain corrections, favorites, follows, and breeder profile fields.
• Usage data — first-party analytics we collect ourselves: page views, strain views, lineage navigation, signup funnel steps, outbound clicks (which breeder buy links you visited), follows, comments, journal activity. Stored in our own database. Never sent to a third-party analytics service.
• Notifications — in-app notifications about your content or identity (entries on journals you follow, comments, pins, endorsements, replies, @-mentions, a verified breeder commenting on your journal, new followers, and reminders when one of your active grows is due for an update or looks ready to harvest). They live in your account and aren't shared.
• Payment data — handled entirely by Stripe. We store a Stripe customer ID and subscription status; we never see card numbers.
• Cookies & local storage — a session auth cookie (HttpOnly) when you're signed in, plus a short-lived cookie during two-factor login. Where bot protection is enabled, the Cloudflare Turnstile bot check (loaded on sign-up and a few other forms) may set its own cookie. In your browser's localStorage we keep your 21+ age confirmation and your cookie-consent choice. We don't use third-party tracking cookies, pixels, or advertising/analytics scripts; the only third-party script we load is Cloudflare Turnstile, and only on the forms that use it.

• We don't use third-party analytics. No Google Analytics, no Meta Pixel, no Mixpanel, no Plausible, no anything. All usage data lives in our own database.
• We don't track your location.
• We don't profile you for advertising.
• We don't sell your data to third parties. Ever.
• Uploaded photos are stripped of EXIF metadata (including GPS coordinates) before being stored. Your phone's location data does not survive the upload.

• Run the site — auth, content rendering, notifications.
• Understand how the site is used — traffic patterns, signup completion, which strains and lineages get explored, which features get attention. Used to improve the product.
• Display anonymized public aggregates — things like "trending strains this week," strain view counts, "growers tracking this strain." Counts only; never reveals who did what.
• Show breeders aggregate analytics on their own content — total clicks on their buy links, impressions on their strain pages, signup attribution if a grower came in via their profile. Aggregate counts only; never individual user identities or browsing history.
• Send transactional email — verification, password reset, admin moderation alerts. No marketing emails without explicit opt-in.
• Comply with legal requests where required.

We use the following processors:

• Stripe — payments, subscription management.
• Resend — transactional email delivery.
• Microsoft Azure — hosting, database, blob storage for photos.
• Cloudflare — CDN / edge network in front of the site (so it processes requests in transit) and, where enabled, the Turnstile bot check on sign-up and similar forms.

We don't share data with anyone else unless legally required.

Aggregate analytics for content owners. Breeders can see counts of how people interact with their own content — clicks on their buy links, impressions on their strain pages, signup attribution. These are aggregate numbers only; they never include who did what, IP addresses, or any other identifying information.

• Access — email us and we'll send you everything we have associated with your account.
• Deletion — your account settings have a "Delete account" button. Cascade-deletes your journals, hunts, comments, follows, favorites, and notifications. Strain corrections you submitted are anonymized (kept for admin record, identity removed). Note: re-encoded copies of photos you uploaded may persist in our blob storage and CDN cache for a period after the content that referenced them is deleted.
• Correction — most fields you can change from your profile or breeder edit pages. For anything else, email us.
• Portability — email us; we'll send you a JSON export.

We don't allow accounts for anyone under 21 (or the legal age in your jurisdiction). If we learn an account belongs to a minor, we'll delete it.

Passwords are hashed (we never see them in plaintext). Cookies are HttpOnly and Secure. Photos go through re-encoding which strips embedded metadata. We rate-limit public POST endpoints to make abuse expensive. We're a small team and we won't pretend we've solved security — but we take it seriously.

Privacy questions or requests? support@growandtell.net