Privacy Policy

Updated September 9, 2026

How Cannaid handles your data — what is stored, where it lives, and the choices you have.

Effective date: September 9, 2026

1. Who We Are

Cannaid ("Cannaid", "we", "us") is a plant-care web application available at cannaid.ai. It helps growers diagnose plant health problems, keep a grow journal, and learn from our plant library.

Cannaid is operated by an individual based in the European Union, who acts as the data controller for the personal data described in this policy.

For anything privacy-related, contact us at contact@cannaid.ai.

2. The Short Version

We built Cannaid to need as little of your data as possible:

  • Your grow journal never leaves your device. Grows, journal entries, notes, and photos you add to the journal are stored only in your own browser. We cannot see them.
  • Diagnosis submissions are anonymous. Photos and survey answers you submit for diagnosis are kept to train our diagnostic AI — stored without your name, account, or any other link to you.
  • An account is optional. You only need one for the community features.
  • A few ads keep Cannaid free — personalized only if you consent. Browsing pages (articles, health library, strains) show ads from the Mantis ad network; whether those ads may use cookies to be tailored to you is a separate cookie-banner choice, just like Google Analytics. We never sell your data.

The rest of this policy explains the details.

3. Data We Collect

3.1 Account Data (optional)

If you create an account, our authentication provider (Google Firebase) processes:

  • Your email address and a password (stored by Firebase in hashed form — we never see your password), or
  • If you sign in with Google: your name, email address, and profile photo as provided by your Google account.

You can use the diagnosis tool, the libraries, and the grow journal without any account.

3.2 Diagnosis Data

When you use the Diagnose tool, we process:

  • Your survey answers (growing medium, growth stage, symptom descriptions, pH, environment). These describe your plant, not you.
  • Optionally, a photo of your plant, which our image-analysis service uses in the diagnosis.

Both are used to compute your diagnosis. We also keep the photo and the survey answers as training data to improve our diagnostic AI. Stored submissions are anonymous: they contain the image, the survey answers, and the diagnosis result — never your name, email, account, or any other identifier. Training data is used only to improve our models and is never published or sold.

Because plant photos are stored, please avoid including people, faces, or personal belongings in the frame — photograph the plant, not the room.

If you rate a diagnosis result (helpful / not helpful), your rating is stored with that submission — still without any link to you.

3.3 Community Content (Forum)

If you post in the forum, we store the content you create: questions, answers, comments, and votes, together with your display name, profile photo (if any), and posting time. Forum posts are public — anyone on the internet can read them. Please don't include personal information you wouldn't want public.

If you report a post, we store your report and the reason you give.

3.4 Data That Stays on Your Device

The following is stored only in your own browser (localStorage) and is never transmitted to us:

  • Your grow journal: grows, journal entries, measurements, notes, reminders, and photos you attach to entries.
  • Your preferences: language and measurement units (metric/imperial).

You can export your journal as a file, import it on another device, and erase it at any time by deleting it in the app or clearing your browser's site data. Because this data never reaches us, we cannot recover it for you — please use the built-in Export feature for backups.

3.5 Data Collected Automatically

  • Server logs. Our hosting provider (Vercel) processes technical data such as your IP address, browser type, and requested pages to deliver the site and protect it from abuse. These logs are kept short-term.
  • Bot protection. To keep automated abuse away from sign-ups and community features, the site runs Google reCAPTCHA v3 (via Firebase App Check) invisibly in the background. It processes technical signals — your IP address, browser characteristics, and how you interact with the page — to score whether a visitor is human, and sets one security cookie. It never shows puzzles. This is a security measure and does not depend on your analytics choice; see our Cookie Policy.
  • Analytics. We use Google Analytics to understand how the site is used (pages visited, approximate location, device type). Analytics runs only after you accept it in the cookie banner. See our Cookie Policy for details and how to change your choice at any time.
  • Visit counts and page speed (no cookies). To see how many people reach the site at all, and how fast it actually loads for them, we use Vercel Web Analytics and Vercel Speed Insights, both provided by our hosting provider. They set no cookies and store nothing on your device, so they do not depend on your cookie-banner choice and there is nothing to clear. They produce aggregate page-view totals and page-loading-speed measurements only — your IP address and browser type are used momentarily to tell one visit from another, and are never used to identify you, build a profile, or track you across other websites.
  • Advertising. Once you have made your cookie-banner choice, a few pages (the home page, articles, the health library, the strain library, and the diagnosis results page) show ads served by Mantis Ad Network. Serving an ad processes technical data — your IP address, browser characteristics, and the page you are on. Only if you allow "Ad personalization" may Mantis additionally use cookies and similar identifiers to tailor and measure ads; decline, and ads are served without them. The grow journal and the diagnosis survey never show ads. Details and withdrawal: Cookie Policy.

3.6 Newsletter (optional)

If you sign up for our newsletter, we process your email address, the date and time you gave consent, and the page you signed up from (so we can show, if asked, when and where consent was given).

Sign-up is double opt-in: after you submit the form we email you a confirmation link, and you are added to the list only if you click it. If you never click, the address is not added. Every newsletter we send carries an unsubscribe link, and you can unsubscribe at any time.

4. Why We Process Your Data (Legal Bases)

Under the GDPR, we rely on:

  • Performance of a contract (Art. 6(1)(b)) — providing the service you signed up for: your account, and publishing your forum posts.
  • Legitimate interests (Art. 6(1)(f)) — running the diagnosis you request, improving our diagnostic AI with anonymized submissions, keeping the site secure (including the invisible reCAPTCHA bot check), serving non-personalized ads, maintaining short-term server logs, and counting visits and measuring page speed with our hosting provider's cookieless analytics.
  • Consent (Art. 6(1)(a)) — Google Analytics, ad personalization (Mantis advertising cookies), and the newsletter. Each is a separate choice, and you can withdraw any of them at any time without affecting the service.

5. Who We Share Data With

We never sell your data. We share it only with the service providers needed to run Cannaid:

  • Google Firebase (Google Ireland Ltd. / Google LLC) — authentication and community-content database.
  • Vercel Inc. — website hosting, server logs, and cookieless visit counts and page-speed measurements (Vercel Web Analytics and Speed Insights).
  • Google Analytics (Google Ireland Ltd. / Google LLC) — traffic statistics, only with your consent.
  • Google reCAPTCHA (Google Ireland Ltd. / Google LLC) — invisible bot and abuse protection for sign-ups and community features.
  • Mantis Ad Network (US) — serves the ads on the site; uses advertising cookies only with your ad-personalization consent.
  • Cloudflare, Inc. — network infrastructure in front of our image-analysis service; photos submitted for diagnosis pass through it on the way to our servers.
  • Google Workspace (Google Ireland Ltd. / Google LLC) — hosts our email; messages you send us from the support page (bug reports, feature requests, and general contact messages including privacy and data-request enquiries, together with the reply email address you provide) are delivered to our inbox through it.
  • Brevo (Sendinblue SAS, France) — runs our newsletter: it stores your email address and consent record, sends the confirmation email and the newsletter itself, and handles unsubscribes. Only used if you sign up.

Some of these providers process data in the United States. Where they do, transfers are safeguarded under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses.

Some plant and strain images on the site are currently loaded from third-party image hosts (such as Unsplash). Your browser requests those images directly, which reveals your IP address to that host, as with any image on the web.

6. How Long We Keep Data

  • Account data — until you delete your account.
  • Forum content — until you delete the post or your account. Note that deleted content may persist briefly in backups.
  • Diagnosis submissions (photo + survey answers, anonymized — see 3.2) — retained as model-training data for as long as they remain useful for improving our models.
  • Server logs — retained short-term by our hosting provider.
  • Analytics data — retained per our Google Analytics configuration, then deleted or aggregated.
  • Newsletter data (email address + consent record) — until you unsubscribe, after which we keep only the record needed to honour that unsubscribe.
  • Your device data (journal, preferences) — under your control; it exists until you delete it.

7. Your Rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate data;
  • Delete your data ("right to be forgotten");
  • Receive a copy of your data in a portable format;
  • Restrict or object to certain processing;
  • Withdraw consent at any time (e.g. for analytics);
  • Complain to your local data protection supervisory authority.

You can delete your account yourself at any time: sign in, open your account page, and use "Delete account" — it removes your account and profile and anonymizes your forum posts, no email needed. For anything else — or if you prefer we handle the deletion — email us at support@cannaid.ai. We respond within 30 days. Remember that your grow journal is stored only on your device: we could not hand it over or delete it even if asked, because we never have it.

Diagnosis submissions are stored without any identifier, so we cannot look up which ones are yours. If you accidentally uploaded a photo containing personal information, email us the approximate date and a description of the image and we will find and delete it.

8. Security

All traffic between your browser and Cannaid is encrypted (HTTPS). Authentication is handled by Google Firebase with industry-standard protections. Keep in mind that your grow journal lives in your browser: on a shared or public computer, anyone using the same browser profile can see it — use your own device or clear the site data when done.

9. Age Requirement

Cannaid is intended for adults. You must be 18 years or older to use this service. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

10. A Note on Cannabis Laws

Cannabis cultivation laws differ drastically between countries and regions. Cannaid provides horticultural information only and is intended for use where cultivation is legal. You are responsible for knowing and following your local laws. See our Disclaimer.

11. Changes to This Policy

We may update this policy as the service evolves. The "Effective date" above always shows the current version. For significant changes, we will post a notice on the site.

12. Contact

  • Privacy questions: contact@cannaid.ai
  • Data requests (access, deletion, export): support@cannaid.ai