Saltar al contenido

Privacy

Last updated: May 10, 2026

Introduction

Cannafriend is an app for tracking cannabis cultivation, consumption, and related routines. This policy is drafted primarily with reference to Argentine law and explains what data we process, why we use it, and what rights you have.

Information we collect

We collect the data we need to provide the app and the information you choose to add voluntarily. This may include:

  • Account data: email, authentication identifiers (via Firebase Authentication).
  • Profile preferences such as language and timezone, together with configuration options you choose inside the app.
  • Content you add: plants, journals, nutrients, reminders, stash items and related notes.
  • Images you upload (stored in Firebase Storage).
  • Technical data: device/browser type and usage needed to operate and secure the app.
  • Push notification tokens and preferences if you choose to enable them.
  • Technical events and aggregated or pseudonymized usage data used to measure performance, errors, and app or website usage.
  • Subscription metadata handled by payment processors (Stripe/MercadoPago). We do not store full payment details.
  • Local storage/PWA caches on your device for offline functionality.

Sensitive data and use caution

We do not request sensitive data as a condition of using the service. However, some information you choose to upload, such as consumption habits, personal notes, images, or references to health or treatments, may be considered sensitive or especially private. We recommend sharing only what is strictly necessary.

How we use information

We use your information to:

  • Provide and maintain the service (sync, storage, login).
  • Improve features and app performance.
  • Provide support and respond to requests.
  • Protect against fraud, abuse, and technical issues.
  • Send service-related communications (e.g., subscription or critical notices).
  • Manage sign-ups, renewals, cancellations, and premium status verification.
  • Record consent and, if you allow it, load advertising or ad measurement on the public website.
  • Comply with legal obligations.

Basis for processing and consent

We process your data mainly to deliver the service you request, with your consent where appropriate, for legitimate interests related to security and product improvement, and to comply with legal obligations. If GDPR, UK GDPR, or similar rules also apply to you, these categories may function as legal bases under those regimes as well.

  • Providing the service, managing your account, and syncing the information you choose to store.
  • Consent for push notifications, non-essential cookies or technologies, and optional features.
  • Security, fraud prevention, technical diagnostics, stability improvements, and complaint handling.
  • Limited retention or disclosure when required by law or a valid legal request.

Sharing of information

We do not sell your personal data. We share limited information with providers that help us operate the app or website:

  • Firebase (Authentication, Firestore, Storage) to sign in, store your data, and host content.
  • Google, including Google Sign-In and other Google services integrated into the app or website.
  • Payment processors (Stripe, MercadoPago) for subscriptions, charges, validation, and payment status management. Their own policies apply.
  • AI providers (currently Google Gemini and OpenAI) when you use assistant features.
  • Measurement and analytics services, such as @vercel/analytics and Firebase Analytics, to understand performance and usage.
  • Google AdSense and related technologies on the public site, only if you provide the applicable consent.

International transfers

Some of the infrastructure we use may process or store data outside Argentina, including in countries with different data protection standards. When that happens, we rely on the contractual, technical, and organizational measures offered by those providers and limit the scope of shared information to what is necessary for the relevant purpose.

Data security

We apply reasonable technical and organizational security measures, including access controls, authentication, Firebase infrastructure rules, and error review practices. Even so, no system is completely invulnerable and we cannot guarantee absolute security.

Cookies and storage

We use cookies, browser local storage, and PWA caches to keep you signed in, remember preferences, record consent choices, and enable technical app and site functionality.

  • Authentication tokens to maintain your session.
  • Preferences such as language, theme, and other in-app configuration choices.
  • Local record of your choice about cookies, measurement, or advertising on the public site.
  • Measurement or advertising tools that are activated only when appropriate based on your consent.
  • Offline caches for faster loading and limited offline functionality.

Push notifications

If you enable them, we may send reminders, alerts, or service notices. You can disable them in your device or browser settings.

AI features

When you use the assistant, your prompts, messages, and some context needed to answer may be sent to AI providers such as Google Gemini or OpenAI. Those responses may be inaccurate or outdated. Avoid sharing sensitive personal, medical, legal, or financial data.

Data retention

We retain your data while your account remains active or while it is needed for the purpose for which it was collected. Some technical logs, backups, security events, or records linked to payments may be retained for additional periods when required for audit, fraud prevention, or legal compliance.

Advertising

The public website may load Google AdSense and related technologies only after you accept the relevant consent choice. If you do not accept it, that advertising script should not be activated from the landing page.

Your rights

If you are in Argentina, Law 25,326 and the competent supervisory authority recognize, among others, the following rights. If other privacy laws also apply to you, you may have additional rights:

  • Be informed about what data we process, for what purpose, and who is responsible for that processing.
  • Access the data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Request updates or deletion where appropriate.
  • Ask for deletion when there is no legal duty to keep the data.
  • Withdraw consent given for optional processing, without retroactive effect.
  • File a complaint with the Agencia de Acceso a la Información Pública (AAIP) or bring a habeas data action if you believe your rights were infringed.

Argentine legal framework

This policy primarily relies on Argentine Personal Data Protection Law 25,326, its implementing rules, and guidance from the Agencia de Acceso a la Información Pública (AAIP). As a general rule, an access request should be answered within 10 calendar days, and a rectification, update, or deletion request within 5 business days. If our response is insufficient or absent, you may file a complaint with the AAIP or pursue a judicial habeas data action.

Children and age limits

This app is intended only for individuals who are legally old enough to consume or cultivate cannabis under their jurisdiction. We do not knowingly seek to collect data from children.

Changes to this policy

We may update this policy to reflect legal, operational, or product changes. If the change is material, we will publish the new effective date and, where appropriate, notify you through reasonable in-app or site methods.

Contact

For questions or to request access, rectification, deletion, or withdrawal of consent, email nachthelad.dev@gmail.com