privacy policy

1.What we collect

Only what an order or an account needs, and a little about how the site is used so we can fix what is broken.

• Account details: name, email, password (stored hashed), phone if you give it, birthday if you give it, and your marketing choices.
• Order details: what you bought, the delivery address, the payment method and its reference, and the shipping tracking number.
• Identification: on a first order we check that you are of legal age. The document is reviewed and the check is recorded; we keep the document only as long as the check needs it.
• Rewards and referrals: your points ledger, your referral link and the orders attributed to it.
• Site use: pages viewed and where on a page people tap or scroll, collected as counts and heat maps without a name attached, plus the usual server logs.
• Messages: what you write to us in the chat, the contact form and support tickets.

2.Why we use it

To take and ship your order, to confirm you are of legal age, to run the rewards and referral programmes, to answer you when you write to us, to send order emails, and, only if you opted in, to send you deals by email or text. We also use the anonymous site-use data to see what works and what does not.

We do not sell personal information and we do not use it for anything you would not expect from a store.

3.Who we share it with

The companies that do a job for us, and only the part of your data that job needs.

• Canada Post, for the shipping label and tracking: your name, address and phone.
• Your bank and ours, for an Interac e-Transfer: the reference code and amount. We never see your banking details.
• BTCPay, if you choose to pay in Bitcoin: the invoice amount and the payment; nothing about you.
• Resend, which sends our order and marketing emails: your email address and the message.
• Our hosting provider, which runs the site and database in a data centre.
• A law-enforcement or regulatory request that we are legally required to answer.

4.How long we keep it

Order records are kept for seven years, as tax law requires. Account details are kept while the account is open and for a short period after it closes. Identification documents are removed once the age check is complete. Chat and support messages are kept for two years. Anonymous site-use data is kept as aggregates.

5.Cookies and the age gate

The site sets a small number of cookies and browser storage entries: to keep you signed in, to remember your bag, to remember that you have passed the age gate, to remember that you dismissed a message, and to measure site use. None of them are advertising cookies and none follow you to other sites.

6.Your rights

Under Canadian privacy law you can ask what we hold about you, ask us to correct it, or ask us to delete it. Write to us through the contact page and we will answer within 30 days. Deleting an account removes the personal details; the order records stay for the retention period above, with the personal details removed where the law allows.

• Marketing email: every message has an unsubscribe link, and the unsubscribe page works without logging in.
• Marketing text messages: reply STOP to any message.

7.Security

The site runs over HTTPS. Passwords are stored hashed, never in plain text. Payment happens bank to bank, so no card numbers pass through us. Access to customer data inside the company is limited to the people who fulfil orders and answer support.

8.Legal age only

This site is for adults of legal age in their province or territory. We do not knowingly collect information from anyone under that age, and we remove it if we find it.

9.Changes and contact

When this policy changes we update the date at the top. Questions about your data: use the contact page. This policy is written for the Personal Information Protection and Electronic Documents Act and British Columbia’s Personal Information Protection Act.