Privacy policy.

Who we are

CanJar (the app at canjar.app and this site at get.canjar.app) is an independent app based in West Virginia, USA ("CanJar", "we", "us"). We are reachable by email only: CJlegal@xski.me for privacy and legal requests, CJsupport@xski.me for general support. CanJar is a journal and education tool. It does not sell cannabis, take orders, arrange delivery or pickup, show dispensary menus, or carry affiliate links.

What stays on your device

You can use CanJar without an account. Your notebook (sessions, strains, purchases, saved stories, your watchlist and saved chats) is stored in your browser's local database (IndexedDB) on your device. Your display name and settings such as your age confirmation, chosen state, theme and analytics preference are kept in your browser's local storage. If sync is on, your settings sync end-to-end encrypted like your notebook.

Label scanning reads the label with on-device text recognition. The image is not uploaded for scanning. Insights are computed on your device from your own entries.

If you sign in

Signing in is optional and uses Google. We ask Google for the standard openid email profile scopes and keep:

• your email address and your Google account identifier, to recognize you;
• sign-in sessions: a hashed session token, the sign-in method, your browser's user-agent string, and creation and expiry times (sessions last up to 30 days);
• optional two-factor security you set up: passkey public keys and labels, an authenticator-app (TOTP) secret, and hashed recovery codes;
• your plan and feature entitlements, and the Ask CanJar usage counts described below.

Google confirms who you are. It does not receive your notebook.

Encrypted sync (Plus and Pro)

Multi-device sync is optional. When it is on, each entry is encrypted on your device with AES-256-GCM using a key that only your devices hold. The server stores:

• the encrypted entries (ciphertext), plus what it needs to sync them: the record type, a record identifier, timestamps, a content hash and the key version;
• for each linked device, its label, public key and an encrypted ("wrapped") copy of your notebook key.

We cannot read synced entries and have no recovery backdoor. If you lose every device and your recovery key, we cannot restore your notebook. When you delete an entry, the server keeps an encrypted deletion marker so your other devices learn of the deletion.

Photos (Pro)

Before a photo leaves your device it is resized and re-encoded, which strips embedded metadata such as GPS location, and then encrypted. The server stores only the encrypted image, its thumbnail and their sizes. Photos you delete are removed from storage. If your plan no longer includes photos, stored photos are deleted about 7 days later unless photos are included in your plan again before then. Uploads that are never attached to an entry are cleaned up after about 24 hours.

Ask CanJar (AI)

AI features are off until you turn them on. When you ask a question, CanJar's server sends the request to OpenAI's API through Cloudflare AI Gateway. Each request contains:

• your question and up to six recent turns of that conversation;
• the state you selected and your time-zone offset;
• only if you tick Include my stats for that message: a summary of your notebook for the chosen period (30 days, 90 days or a year): session count, average rating and effectiveness, current streak in days, method mix, up to five top strains with their names, types, session counts and averages, goals, common effects and total spend. Your notes are never included.

Requests are sent with OpenAI's response storage turned off and with AI Gateway logging turned off. CanJar does not store your questions or the answers. We do keep usage numbers: message counts, token counts, your weekly budget window and, for Lifetime, a credit ledger.

Under OpenAI's API data policy, data sent through the API is not used to train OpenAI's models and may be retained by OpenAI for up to 30 days for abuse monitoring.

Web search (Pro, off by default). If you turn on web search in Settings, OpenAI may send topic-focused search queries derived from your question to its search providers. The sources it retrieves are shown as links.

Saved chats stay on your device. If you turn on encrypted chat sync, they sync end-to-end encrypted like the rest of your notebook.

Payments

Paid plans are processed by Stripe through Stripe Checkout and the Stripe Customer Portal. Stripe collects your payment details directly. We never see or store card numbers. We keep your Stripe customer identifier, your subscription status, plan, renewal date and whether it will cancel, and records of one-time purchases. We also store the full subscription objects and the complete event notifications Stripe sends us. Those events can include the name, email, billing country and postal code entered at checkout. The stored events are not linked to your account by a user ID; they are kept as billing records, as described under Retention and deletion. Stripe's own privacy policy covers the data it handles.

Email

Account email. If you sign in, we send a small number of service emails through Cloudflare's email service: a welcome message, purchase confirmations, failed-payment notices and cancellation confirmations. We keep a log of which of these were sent and to which address.

Product news (opt-in). We send marketing email only if you turn it on in Settings. Your email address and subscription status are then shared with our email provider, Resend. You can turn it off in Settings or use the unsubscribe link at any time.

Analytics

CanJar sets no tracking cookies and uses no advertising or cross-site trackers. CanJar counts usage in three ways, and none of them include your entries:

• Feature counts. The app can send app_open; page_view with only the app section (home, track, insights, strains, law, news, learn, settings, or "unknown"); and feature_used with only the name of a paid feature. We also count upgrade and checkout steps: an upgrade offer being shown, a plan being picked, returning from checkout, checkout starting or finishing, and the billing portal opening. These carry only coarse values like plan tier, billing interval and where the offer appeared. None of these counts include a user ID, email, payment identifier, amount, cookie, page address or search term. They are stored as counts in Cloudflare Workers Analytics Engine. Turn them off under Anonymous usage analytics in Settings. They are also not sent if your browser sends Do Not Track.
• Subscription counts (always on). When Stripe tells us a subscription has ended or a payment has failed, we always record one count with only the plan tier and billing interval. The Settings switch does not apply to these, because they come from Stripe rather than from your device.
• Page metrics. The app loads Cloudflare Web Analytics, a cookieless page-view counter. It is always on: it loads with the app and is not affected by the Settings switch above.

This site (get.canjar.app) runs no analytics scripts.

Location

CanJar never asks for your device's GPS location. To suggest a starting state, the server reads the approximate region that Cloudflare derives from your connection. It does not store it. You can change your state at any time.

Service providers

Outbound web requests from CanJar's server go through a short, reviewed allowlist of hosts. A few connections are made outside that allowlist: the database connection, Cloudflare's email sending, and error reporting. The services involved are:

• Cloudflare: hosting, connection to the database, encrypted photo storage, service email, AI Gateway and analytics;
• Neon, a hosted PostgreSQL provider, for account records and encrypted sync data;
• Google, for sign-in;
• Stripe, for payments;
• Resend, for opt-in marketing email;
• OpenAI, for Ask CanJar;
• public news indexes (Google News RSS, GNews) and government or health sites, used to gather public law and news content. These requests contain none of your data.

Server errors may be reported to our error-monitoring service (Sentry). Before a report is sent, we remove query strings, request headers, cookies, request bodies and any Ask CanJar content.

The app and this site load fonts from Google Fonts, which receives your IP address as part of serving them.

No selling, no ads

We do not sell or rent personal information. We do not share it for advertising, and we do not show ads. We share data only with the providers above, to run the features you use, or when the law requires it.

Retention and deletion

• Your notebook. Settings → Your data → Delete everything wipes the notebook on this device. If sync is on, the deletion also reaches your linked devices when they next sync.
• Signed-out use. We hold nothing about you on the server.
• Your account. The app does not yet have a self-serve way to delete your server account. To delete it, including your email, sign-in records, security settings, synced ciphertext and photos, email CJlegal@xski.me from the address you sign in with. We complete deletion within 30 days. We delete your account, sync data, photos and subscription records. Billing records we need for tax and accounting, including the stored Stripe event notifications described under Payments, are kept only as long as the law requires and then removed. Backups roll off within 30 days.
• Sessions expire after 30 days. Sign-in handshake data expires within minutes.

Your choices and rights

• Use CanJar without an account, or sign out at any time. Your notebook stays on your device.
• Keep AI features, web search, sync, analytics and marketing email off. Each is off until you turn it on, except feature counts, which are on by default and can be turned off in Settings. Two kinds of counting are always on: Cloudflare Web Analytics page metrics, and the subscription-ended and payment-failed counts described above.
• Export your notebook as PDF, CSV or JSON from Settings (Full export is a Plus feature). It is built on your device.
• Anyone can ask for access to, a copy of, a correction to, or deletion of the personal data we hold about them by emailing CJlegal@xski.me.

If the law where you live gives you additional privacy rights, we will honour them. Email us and tell us what you are requesting.

Age

CanJar is for adults who can legally use cannabis where they live. You must be at least 21, or at least 18 if you are a registered medical cannabis patient and your state's law permits a patient of your age. CanJar is not for anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email CJlegal@xski.me and we will delete it.

Security

Synced entries and photos are encrypted on your device before upload. Account data is protected by row-level access controls in the database, sign-in tokens are stored only as hashes, and you can add passkeys or an authenticator app as a second factor. No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as the law requires.

Changes

If our data practices change, we will update this page and its effective date. For material changes, we will also give notice in the app or by email before they take effect.

Contact

Privacy and data requests: CJlegal@xski.me. General support: CJsupport@xski.me. A person answers. We are reachable by email only.