Privacy Policy

Effective date: September 28, 2026

1. Who We Are

Cannaid ("Cannaid", "we", "us") is a plant-care web application available at cannaid.ai. It helps growers diagnose plant health problems, keep a grow journal, ask an AI assistant about their plants, and learn from our plant library.

Cannaid is operated by an individual based in the European Union, who acts as the data controller for the personal data described in this policy.

For anything privacy-related, contact us at contact@cannaid.ai.

2. The Short Version

We built Cannaid to need as little of your data as possible:

Your grow journal stays on your device. Grows, journal entries, notes, and photos you add to the journal are stored only in your own browser, and we cannot see them. The one exception is your choice: a grow you share with the AI assistant is sent with your questions — its journal, never its photos — so the assistant can answer, and we don't keep it.
Diagnosis submissions are anonymous. Photos and survey answers you submit for diagnosis are kept to train our diagnostic AI — stored without your name, account, or any other link to you.
Diagnosis and the assistant use Google's AI. When you add a photo to a diagnosis, the photo and your survey answers — and whatever you ask the assistant — are sent from our server to Google's Gemini AI models to produce the answer. Google does not use them to train its own models, and we don't store your conversations.
An account is optional. You need one for the community features, and it raises your daily limits for the photo diagnosis and the AI assistant.
A few ads keep Cannaid free — personalized only if you consent. Browsing pages (articles, health library, strains) show ads from the Mantis ad network; whether those ads may use cookies to be tailored to you is a separate cookie-banner choice, just like Google Analytics. We never sell your data.

The rest of this policy explains the details.

3. Data We Collect

3.1 Account Data (optional)

If you create an account, our authentication provider (Google Firebase) processes:

Your email address and a password (stored by Firebase in hashed form — we never see your password), or
If you sign in with Google: your name, email address, and profile photo as provided by your Google account.
If you use the photo diagnosis or the AI assistant while signed in: how many you used today, so we can apply your account's daily limits and any launch bonus. We keep only the latest day's counts and your account's creation date — never the photos or questions themselves.

You can use the diagnosis tool, the AI assistant, the libraries, and the grow journal without any account. Without one, the photo diagnosis and the AI assistant have smaller daily limits.

3.2 Diagnosis Data

When you use the Diagnose tool, we process:

Your survey answers (growing medium, growth stage, symptom descriptions, pH, environment). These describe your plant, not you.
Optionally, a photo of your plant, and whether it shows a single leaf or the whole plant.

When you add a photo, the photo and your survey answers are sent together, from our server, to Google's Gemini AI model, which reads them and returns the diagnosis you see (see section 5). If the model can't be reached or can't read the photo, your diagnosis is worked out from your survey answers instead. Without a photo, your diagnosis is worked out from your survey answers alone, on our servers, and nothing is stored.

When you add a photo, we also keep the submission as training data to improve our diagnostic AI. Stored submissions are anonymous: they contain the photo, what it shows, your survey answers, the diagnosis result, and the AI model's written reading of your photo and answers — never your name, email, account, or any other identifier. Your pH reading is used for the diagnosis but never stored: it is removed from your survey answers, and from the AI model's written reading, before the submission is kept. Training data is used only to improve our models and is never published or sold.

Because plant photos are stored, please avoid including people, faces, or personal belongings in the frame — photograph the plant, not the room.

If you rate a diagnosis result (helpful / not helpful), your rating is stored with that submission — still without any link to you.

3.3 Community Content (Forum)

If you post in the forum, we store the content you create: questions, answers, comments, and votes, together with your display name, profile photo (if any), and posting time. Forum posts are public — anyone on the internet can read them. Please don't include personal information you wouldn't want public.

If you report a post, we store your report and the reason you give.

3.4 Data That Stays on Your Device

The following is kept only in your own browser — we hold no copy of it. It leaves your device only when a feature you use needs it, as described here:

Your grow journal: grows, journal entries, measurements, notes, reminders, and photos you attach to entries.
Your preferences: language and measurement units (metric/imperial).
Your conversations with the AI assistant: the chat in your current tab (until you close it) and, for each grow you have shared with the assistant, that grow's latest 30 messages (until you start a new chat or delete the grow). Your messages were sent to be answered (see 3.7); the saved copy exists only in your browser.
How many free AI answers you used today: the photo diagnoses and assistant questions this browser used today, so the daily limit for visitors without an account works. It resets each day.

Sharing a grow with the assistant. Nothing from your journal is sent unless you choose Share this grow — the assistant asks separately for each grow you pick, and remembers your answer for that grow until you close the tab. While a shared grow is selected in the assistant's chat list, it is sent with each of your messages so the assistant can answer from it: the grow's settings and results (such as its name, strain, dates, growing medium, environment, plant names, and harvest weights), its journal entries and notes, its open reminders, the alerts the app raised from your readings, which grow tips you dismissed, and your measurement units. Photos are never sent — only how many there are. We do not keep any of it (see 3.7). To stop sharing, choose "General questions" in the chat list, or close the tab.

You can export your journal as a file, import it on another device, and erase it at any time by deleting it in the app or clearing your browser's site data. Because we never keep this data, we cannot recover it for you — please use the built-in Export feature for backups.

3.5 Data Collected Automatically

Server logs. Our hosting provider (Vercel) processes technical data such as your IP address, browser type, and requested pages to deliver the site and protect it from abuse. These logs are kept short-term.
Abuse limits. To stop automated abuse, the services behind photo diagnosis and diagnosis ratings, the AI assistant, the support form, and the newsletter sign-up count requests per IP address. The count is held in our server's memory for a short window (at most about ten minutes) and is never written to disk or logged.
Bot protection. To keep automated abuse away from sign-ups and community features, the site runs Google reCAPTCHA v3 (via Firebase App Check) invisibly in the background. It processes technical signals — your IP address, browser characteristics, and how you interact with the page — to score whether a visitor is human, and sets one security cookie. It never shows puzzles. This is a security measure and does not depend on your analytics choice; see our Cookie Policy.
Analytics. We use Google Analytics to understand how the site is used (pages visited, approximate location, device type). Analytics runs only after you accept it in the cookie banner. See our Cookie Policy for details and how to change your choice at any time.
Visit counts and page speed (no cookies). To see how many people reach the site at all, and how fast it actually loads for them, we use Vercel Web Analytics and Vercel Speed Insights, both provided by our hosting provider. They set no cookies and store nothing on your device, so they do not depend on your cookie-banner choice and there is nothing to clear. They produce aggregate page-view totals and page-loading-speed measurements only — your IP address and browser type are used momentarily to tell one visit from another, and are never used to identify you, build a profile, or track you across other websites.
Advertising. Once you have made your cookie-banner choice, a few pages (the home page, articles, the health library, the strain library, and the diagnosis results page) show ads served by Mantis Ad Network. Serving an ad processes technical data — your IP address, browser characteristics, and the page you are on. Only if you allow "Ad personalization" may Mantis additionally use cookies and similar identifiers to tailor and measure ads; decline, and ads are served without them. The grow journal and the diagnosis survey never show ads. Details and withdrawal: Cookie Policy.

3.6 Newsletter (optional)

If you sign up for our newsletter, we process your email address, the date and time you gave consent, and the page you signed up from (so we can show, if asked, when and where consent was given).

Sign-up is double opt-in: after you submit the form we email you a confirmation link, and you are added to the list only if you click it. If you never click, the address is not added. Every newsletter we send carries an unsubscribe link, and you can unsubscribe at any time.

3.7 AI Assistant (optional)

If you use the AI assistant (the chat button), we process:

What you write — your question, together with the last few exchanges of the same conversation (at most six), so the assistant can follow it. Anything you type is sent as written, so please don't include personal details such as your name, address, phone number, or health information.
Your interface language — used for the reply only when the assistant can't tell which language you wrote in.
If you choose to share one, a grow's journal, as described in 3.4.

Your messages go from our server to Google's Gemini AI model, which writes the answer — from Cannaid's plant library first and, where the library has nothing, from the model's own general knowledge (see section 5). Because the request comes from our server and not from your browser, Google does not receive your IP address, cookies, or account details with it. We do not store your conversations on our servers, and we do not use them to train any AI model. The conversation is kept only in your browser (see 3.4).

The assistant may suggest adding a reading you mentioned to your journal. Nothing is written to your journal unless you tap to save it, and the entry is saved on your device only.

4. Why We Process Your Data (Legal Bases)

Under the GDPR, we rely on:

Performance of a contract (Art. 6(1)(b)) — providing the service you signed up for: your account, publishing your forum posts, and applying your account's daily AI limits.
Legitimate interests (Art. 6(1)(f)) — running the diagnosis you request (including having your photo and survey answers read by our AI provider), answering the questions you put to the AI assistant (including from a grow you choose to share with it), improving our diagnostic AI with anonymized submissions, keeping the site secure (including the invisible reCAPTCHA bot check and per-address abuse limits), serving non-personalized ads, maintaining short-term server logs, and counting visits and measuring page speed with our hosting provider's cookieless analytics.
Consent (Art. 6(1)(a)) — Google Analytics, ad personalization (Mantis advertising cookies), and the newsletter. Each is a separate choice, and you can withdraw any of them at any time without affecting the service.

5. Who We Share Data With

We never sell your data. We share it only with the service providers needed to run Cannaid:

Google Firebase (Google Ireland Ltd. / Google LLC) — authentication and community-content database.
Google Cloud — Gemini AI models (Google Cloud EMEA Ltd. / Google LLC) — reads the photo and survey answers you submit for a diagnosis and returns the result, and writes the AI assistant's answers from your messages and, if you share one, your grow's journal. We send this data from our own server, so Google does not receive your IP address or account details with it. Google processes it to provide these answers and to protect its service against abuse, does not use it to train its own models, and may process it in any country where it operates.
Vercel Inc. — website hosting (including the servers that run the diagnosis and pass your questions to the AI assistant), server logs, and cookieless visit counts and page-speed measurements (Vercel Web Analytics and Speed Insights).
Google Analytics (Google Ireland Ltd. / Google LLC) — traffic statistics, only with your consent.
Google reCAPTCHA (Google Ireland Ltd. / Google LLC) — invisible bot and abuse protection for sign-ups and community features.
Mantis Ad Network (US) — serves the ads on the site; uses advertising cookies only with your ad-personalization consent.
Cloudflare, Inc. — network infrastructure in front of our own server that stores diagnosis submissions; a submission (the photo, survey answers, and result) passes through it on the way there.
Google Workspace (Google Ireland Ltd. / Google LLC) — hosts our email; messages you send us from the support page (bug reports, feature requests, and general contact messages including privacy and data-request enquiries, together with the reply email address you provide) are delivered to our inbox through it.
Brevo (Sendinblue SAS, France) — runs our newsletter: it stores your email address and consent record, sends the confirmation email and the newsletter itself, and handles unsubscribes. Only used if you sign up.

Some of these providers process data outside the European Economic Area — in the United States and, for Google's AI models, in any country where Google operates. Where they do, transfers are safeguarded under the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Images that forum members link in their posts, and the profile photos of members who sign in with Google, are loaded from third-party hosts. Your browser requests those images directly, which reveals your IP address to that host, as with any image on the web.

6. How Long We Keep Data

Account data — until you delete your account.
Daily AI usage counts (signed-in users) — only the latest day's count; replaced on your next use and deleted with your account.
Forum content — until you delete the post or your account. Note that deleted content may persist briefly in backups.
Diagnosis submissions (photo + survey answers except pH, with the diagnosis result and the AI model's written reading, anonymized — see 3.2) — retained as model-training data for as long as they remain useful for improving our models.
Server logs — retained short-term by our hosting provider.
Analytics data — retained per our Google Analytics configuration, then deleted or aggregated.
Newsletter data (email address + consent record) — until you unsubscribe, after which we keep only the record needed to honour that unsubscribe.
AI assistant conversations and shared grows — not stored by us. The copies kept in your browser are described in 3.4.
What Google's AI models receive (diagnosis photos and survey answers, assistant messages, shared grows) — Google holds it in short-lived memory for up to 24 hours to speed up its service and, only if its automated abuse checks flag a request, may keep that request for up to 90 days to investigate. It is not used to train Google's models.
Your device data (journal, preferences, assistant conversations) — under your control; it exists until you delete it.

7. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you;
Correct inaccurate data;
Delete your data ("right to be forgotten");
Receive a copy of your data in a portable format;
Restrict or object to certain processing;
Withdraw consent at any time (e.g. for analytics);
Complain to your local data protection supervisory authority.

You can delete your account yourself at any time: sign in, open your account page, and use "Delete account" — it removes your account and profile and anonymizes your forum posts, no email needed. For anything else — or if you prefer we handle the deletion — email us at support@cannaid.ai. We respond within 30 days. Remember that your grow journal — and your conversations with the AI assistant, including any grow you shared with it — are kept only on your device: we could not hand them over or delete them even if asked, because we never keep them.

Diagnosis submissions are stored without any identifier, so we cannot look up which ones are yours. If you accidentally uploaded a photo containing personal information, email us the approximate date and a description of the image and we will find and delete it.

8. Security

All traffic between your browser and Cannaid is encrypted (HTTPS). Authentication is handled by Google Firebase with industry-standard protections. Keep in mind that your grow journal and your assistant conversations live in your browser: on a shared or public computer, anyone using the same browser profile can see them — use your own device or clear the site data when done.

9. Age Requirement

Cannaid is intended for adults. You must be 18 years or older to use this service. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

10. A Note on Cannabis Laws

Cannabis cultivation laws differ drastically between countries and regions. Cannaid provides horticultural information only and is intended for use where cultivation is legal. You are responsible for knowing and following your local laws. See our Disclaimer.

11. Changes to This Policy

We may update this policy as the service evolves. The "Effective date" above always shows the current version. For significant changes, we will post a notice on the site.

12. Contact

Privacy questions: contact@cannaid.ai
Data requests (access, deletion, export): support@cannaid.ai