Privacy

This is a site about cannabis. What someone reads here, and what they say they felt, is sensitive in a way a film rating is not — and in much of the world the underlying act is still a crime. So this page is specific rather than reassuring.

Effect reports carry no identifier at all

When you send a report from a strain page, what is stored is: the date, the strain, which boxes you ticked, and the product form if you chose one. That is the whole row.

There is deliberately no account, no username, no email, and:

• No IP address, and no hash of one either.
• No timestamp — the date only. The minute you submitted is a correlation handle and is of no analytical use.
• No random identifier tying your reports together.

That has a real cost. It means reports cannot be edited or withdrawn, because there is nothing to find them by, and it makes abuse harder to detect than an account system would. It is the right trade on this subject, and it had to be made at the start: once rows carry identifiers, every later decision gets made in their presence.

How repeat submissions are limited without identifying anyone

One report per strain per day is enforced using a salted hash that includes the date, held in a separate store that expires it within a day. The salt changes daily, so yesterday's value cannot be recomputed and these cannot be used to follow anyone across days. They are never written alongside a report, so there is nothing to join them on afterwards.

Analytics

This site uses two, and they are not equivalent.

Cloudflare Web Analytics

Counts page loads. No cookies, no fingerprinting, and no identifier that could follow you to another site or back here tomorrow. It cannot tell that two visits came from the same person. It is not switched off for a Do Not Track signal, because it does not do the thing Do Not Track asks it to stop doing — suppressing it would cost an accurate count of how many people the site reached and buy nothing back. You are reading the reasoning so you can disagree with it rather than discover it.

Google Analytics

Records the pages you view — which includes which strains you looked at — along with coarse location, referrer, and the kind of device and browser. This one does build a picture of a visit.

Google Analytics 4 uses your IP address to derive approximate location and then discards it before anything is logged; there is no setting for that because it is the only behaviour available. It does not receive the contents of an effect report, which is posted straight to this site's own endpoint.

If your browser sends a Do Not Track signal, Google Analytics storage is switched off for you. That is legally optional almost everywhere. On a site about which strain someone is reading, ignoring an explicit request not to be tracked is not a defensible call. You can also block either script outright and the site works normally.

What this site never does

• No advertising, and no advertising trackers.
• No selling or sharing of anything a visitor submits.
• No third-party scripts beyond the two analytics tags above.
• No cross-site tracking pixels.

Hosting

The site runs on Cloudflare, which sees requests as any host does and keeps its own operational logs. The strain database is a static file; the only thing written anywhere is an effect report.

If any of this stops being accurate, this page is wrong and should be fixed before the behaviour ships. That is the order these things belong in.