Privacy Policy

1. Introduction

Welcome to Leafprint ("we," "our," or "us"). Leafprint is a cannabis strain tracking journal application with AI-powered recommendations, designed for adult consumers and medical patients in jurisdictions where cannabis use is lawful.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Leafprint mobile application, web application, and related services (collectively, the "Service"). We are committed to protecting your privacy, especially given the sensitive nature of cannabis usage data.

By using Leafprint, you agree to the collection and use of information in accordance with this policy. Please also review our Terms of Service.

2. Information We Collect

2.1 Account Data

Leafprint is designed to be anonymous by default. You are not required to create an account to use the core features of the app. If you choose to create an account for cloud sync or social features, we may collect:

• Email address (optional, used for authentication and account recovery)
• Password (stored as a cryptographic hash; we never store or have access to your plaintext password)
• Display name (optional, chosen by you)
• Authentication tokens from third-party sign-in providers (e.g., Google, Apple) if you choose social login

2.2 Journal Entries

The core of Leafprint is your personal cannabis journal. When you log a session, the following data may be recorded based on your input:

• Session data: date, time, duration, and consumption method
• Strain information: strain name, type (Indica, Sativa, Hybrid), THC/CBD content
• Ratings: your personal rating of each session (1-5 stars)
• Moods: pre-session and post-session mood tracking
• Effects: perceived effects such as relaxation, creativity, pain relief, etc.
• Personal notes: freeform text entries about your experience

2.3 Device Information

We collect limited device information necessary for app functionality and compatibility:

• Device type and model (e.g., iPhone 15, Pixel 8)
• Operating system and version (e.g., iOS 18, Android 15)
• App version
• Screen resolution (for responsive UI rendering)
• Language and locale settings

We do not collect GPS location, contacts, photos, or any other sensitive device permissions unless explicitly requested for a specific feature and approved by you.

2.4 Usage Analytics

We collect anonymized, aggregated usage analytics to understand how our app is used and to improve the experience. This includes:

• Feature usage frequency (e.g., which screens are visited most)
• App performance metrics (load times, crash reports)
• Session duration and frequency of app use
• General engagement patterns

Analytics data is anonymized and aggregated. We do not tie analytics data to your personal identity or your cannabis journal entries.

3. How We Use Your Information

3.1 Providing the Service

We use your information to deliver the core Leafprint experience:

• Storing and displaying your journal entries, strain ratings, and session history
• Synchronizing your data across devices (if cloud sync is enabled)
• Managing your account and authentication
• Enabling data export (PDF and CSV) for your personal records or healthcare provider

3.2 AI Recommendations

Leafprint uses AI to provide personalized strain recommendations based on your journal data. Here is how this works:

• When you request AI recommendations, your journal data (strain names, ratings, effects, moods, and notes) is sent to OpenAI's API for analysis
• Data is transmitted securely over encrypted connections (TLS 1.2+)
• We send only the minimum data necessary to generate meaningful recommendations
• OpenAI processes this data according to their Privacy Policy and API data usage policies
• As of the effective date of this policy, OpenAI does not use API data to train their models
• AI recommendations are generated on-demand and are not permanently stored by OpenAI

3.3 Improving the App

We use anonymized, aggregated data to:

• Identify and fix bugs, crashes, and performance issues
• Understand which features are most valued by our users
• Prioritize new feature development
• Improve the accuracy and relevance of strain data and recommendations

3.4 Advertising

Leafprint is a free application and is partially supported by advertising. We are committed to a non-intrusive advertising experience that respects your privacy:

• We partner with cannabis-industry-appropriate ad networks, including Mantis Ads and MediaJel
• Ads are contextually targeted based on general app content (e.g., cannabis-related products and services), not based on your personal journal entries or usage patterns
• We do not sell your personal data or journal entries to advertisers
• We do not share your cannabis usage data with ad networks
• Ad partners may collect anonymized device identifiers for frequency capping and basic campaign measurement
• You may opt out of personalized advertising (see Your Rights)

4. Data Storage and Security

4.1 Offline-First Architecture

Leafprint is built with a local-first, offline-first architecture. This means:

• All journal data is stored on your device by default using local databases
• The app functions fully without an internet connection
• Your data never leaves your device unless you explicitly enable cloud sync
• If you uninstall the app without cloud sync enabled, your local data is permanently deleted

4.2 Optional Cloud Sync

If you choose to enable cloud sync, your data is stored on Firebase/Firestore, a service provided by Google Cloud Platform:

• Data is stored in Google Cloud data centers with enterprise-grade physical security
• Data is replicated across multiple data centers for reliability
• Firebase security rules ensure that only you can access your data
• You can disable cloud sync at any time and request deletion of cloud-stored data

4.3 Encryption

We employ industry-standard encryption to protect your data:

• In transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• At rest: Cloud-stored data is encrypted at rest using AES-256 encryption via Google Cloud's default encryption
• Authentication credentials: Passwords are cryptographically hashed using bcrypt and are never stored in plaintext

5. Third-Party Services

Leafprint integrates with the following third-party services. Each service has its own privacy policy governing how they handle data:

5.1 Firebase (Google)

• Purpose: Authentication, cloud database (Firestore), crash reporting
• Data shared: Account credentials (email), synced journal data (if cloud sync is enabled), crash logs
• Privacy policy: Firebase Privacy and Security

5.2 OpenAI

• Purpose: AI-powered strain recommendations and journal analysis
• Data shared: Journal entries (strain names, ratings, effects, moods, notes) when you request AI recommendations
• Data not shared: Account credentials, device information, personal identifiers
• Retention: Data is processed in real-time and not retained by OpenAI for model training per their API data usage policy
• Privacy policy: OpenAI Privacy Policy

5.3 Analytics Providers

• Purpose: Understanding app usage, performance monitoring, crash reporting
• Data shared: Anonymized usage metrics, device type, OS version, app version, crash logs
• Data not shared: Journal entries, personal notes, cannabis usage data

5.4 Ad Networks

• Mantis Ads: A cannabis-industry advertising network providing contextual, compliant ad placements. Mantis Privacy Policy
• MediaJel: A programmatic advertising platform specialized for the cannabis industry. MediaJel Privacy Policy
• Data shared with ad networks: Anonymized device identifiers, general location (country/region level), ad interaction data (impressions, clicks)
• Data not shared with ad networks: Journal entries, strain usage data, personal notes, mood data, or any cannabis consumption details

6. Your Rights

6.1 CCPA Rights (California Consumers)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to Know: You may request that we disclose what personal information we have collected, used, disclosed, and sold about you
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

6.2 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with the following rights:

• Right of Access: You have the right to request a copy of the personal data we hold about you
• Right to Rectification: You have the right to request correction of inaccurate personal data
• Right to Erasure: You have the right to request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: You have the right to request that we limit how we use your data
• Right to Data Portability: You have the right to receive your data in a structured, machine-readable format
• Right to Object: You have the right to object to our processing of your personal data
• Right to Withdraw Consent: Where we process data based on your consent, you may withdraw that consent at any time

Our legal basis for processing personal data under GDPR includes: consent (for optional features like cloud sync and AI recommendations), contract performance (providing the Service), and legitimate interests (analytics and app improvement).

6.3 Access, Delete, and Export Your Data

Regardless of your location, Leafprint provides you with the ability to:

• Access your data: View all of your journal entries, ratings, and preferences directly within the app
• Delete your data: Delete individual journal entries, or delete your entire account and all associated data from within the app settings
• Export your data: Export your complete journal history as a PDF report or CSV file at any time from the app. This supports data portability and allows you to share your cannabis usage records with a healthcare provider if desired

6.4 Opt-Out of Advertising

You can manage your advertising preferences:

• Opt out of personalized advertising through your device settings (iOS: Settings > Privacy > Tracking; Android: Settings > Privacy > Ads)
• Leafprint Premium (if available) may offer an ad-free experience
• Contact us to request removal from ad-based data collection

7. Cannabis-Specific Privacy Protections

We understand the unique privacy concerns associated with cannabis usage data. Leafprint takes the following strong positions to protect our users:

• No sale of personal data: We do not sell your personal information, cannabis usage data, or journal entries to any third party, period
• No data sharing with employers or insurers: We do not share your data with employers, insurance companies, or background check services
• Health data handling: While Leafprint is not a medical device, we recognize that some users track cannabis use for health-related purposes (e.g., pain management, anxiety relief). We treat all mood, effect, and health-related entries with the same sensitivity as protected health information, even where not legally required to do so
• Anonymous usage: You can use Leafprint with a fully anonymous account. No email, no name, no identifying information required
• Local-first by design: Your most sensitive data (journal entries) never leaves your device unless you choose otherwise

8. Children's Privacy

Leafprint is not intended for use by anyone under the age of 18. In jurisdictions where the legal age for cannabis use is 21, Leafprint is not intended for anyone under the age of 21.

We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a person under the applicable minimum age, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at the information provided in the Contact section below.

9. Data Retention

We retain your data according to the following principles:

• Local data: Data stored on your device persists until you delete it within the app or uninstall the application
• Cloud-synced data: If cloud sync is enabled, your data is retained in Firebase/Firestore until you delete your account or request data deletion. Upon account deletion, all associated data is permanently removed within 30 days
• Account data: If you create an account but do not use the Service for 24 consecutive months, we may send a notification and subsequently delete inactive accounts and their associated data
• Analytics data: Anonymized analytics data may be retained indefinitely as it cannot be tied to an individual user
• Backup data: Cloud backups may persist in encrypted backup systems for up to 90 days after deletion before being permanently purged

10. Cookies and Tracking

This section applies to the Leafprint web application and website (leafprint.app).

10.1 Cookies We Use

• Essential cookies: Required for authentication, session management, and core functionality. These cannot be disabled
• Analytics cookies: Used to collect anonymized usage data to understand how visitors interact with our website. These can be opted out of
• Advertising cookies: Used by our ad partners (Mantis Ads, MediaJel) for contextual ad delivery and campaign measurement. These can be opted out of

10.2 Managing Cookies

You can manage cookies through:

• Your browser settings (blocking or deleting cookies)
• Our cookie consent banner (displayed on first visit)
• Specific opt-out mechanisms provided by our analytics and advertising partners

10.3 Do Not Track

Leafprint respects the "Do Not Track" (DNT) browser signal. When we detect a DNT signal, we disable non-essential analytics and advertising cookies.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Effective Date" at the top of this page
• For material changes, we will provide prominent notice within the app (e.g., an in-app notification or banner)
• If you have an account with an email address, we will send an email notification for significant changes
• Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: privacy@leafprint.app
• General Support: support@leafprint.app

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@leafprint.app.

We will respond to all privacy-related requests within 30 days (or sooner where required by applicable law).