New customer accounts use a username and password, without collecting an email address or requiring an identity-provider login. We store your username, optional bio, account status, salted password hash and a hash of your recovery code. Administrators cannot see passwords or recovery codes. Save your recovery code privately: it is needed to reset a forgotten password, and is replaced when you change or reset your password. Older PIN accounts retain their previously verified email and identity until removed; they can sign in with their existing PIN and upgrade to a password. Only older PIN accounts can use their original verified identity to recover access. The owner continues to use a separate identity login and authenticator.
Age check and essential cookies
Your date of birth is checked to confirm 18+ and then discarded. A signed age-confirmation cookie lasts for 30 days. Customer sign-in lasts 12 hours, or up to 30 days if you select Keep me signed in. Signing out clears that session. The admin uses a separate session and authenticator.
A basket cookie remembers a guest selection for up to 30 days. Signed-in baskets are linked to your account. Checkout and payments are disabled; no payment details are collected and no orders are submitted.
Community contributions
Published posts, replies, usernames and attached photographs can be seen by site visitors. Avoid posting personal details. Reports and account-management information are available to the owner. The owner can edit, hide or delete contributions and suspend or ban accounts. Deleted content may remain in moderation records and backups until permanently removed.
Polls and analytics
Voting sets an essential browser cookie for up to 90 days. A poll-specific hash prevents repeat votes from that cookie. Public results are aggregate totals. Page analytics store daily page counts for a rolling 90 days; they do not store raw IP addresses, browsing profiles or referrer URLs. Owner visits and browsers sending Do Not Track or Global Privacy Control are excluded.
Security and hosting
Short-lived, keyed hashes of network addresses help rate-limit sign-in and posting. Security events, content revisions and moderation actions are logged. Account details and contributions remain until removed; temporary baskets expire after 30 days. Backups may retain earlier content.
The current hosting and identity services also process requests under their own terms. Google Fonts receives font requests. No advertising or optional tracking cookies are added by this site.
The site owner handles privacy requests and can export account and community content and administer removals. Use the privacy-request contact below; you do not need to be signed in to email us.
Account security and measurement
For abuse prevention we keep account activity, success or failure and a keyed, daily-changing network identifier for up to 30 days. We do not store the raw IP address in this account-security log. Only the owner can view it. Product journey measurement uses a first-party random browser identifier for up to 90 days or your signed-in account; it is not a count of identifiable people. Do Not Track and Global Privacy Control disable this measurement. A session is approximated using a 30-minute window. Full backups may contain earlier records until the backup is retired; a restore is followed by retention cleanup.
Profile photographs
Profile photos are optional. They appear beside community posts and on approved vendor profiles. Treat them as public images: anyone with the image link can view a current photo. You can replace or remove yours in My account. The site owner can remove unsuitable photos.
Private customer support
Messages are stored with your account so you and the product’s assigned vendor (or CannaMart support) can read and reply across devices. Other customers cannot see your conversations. Messages expire after one week by default. The support recipient can change a conversation’s timer to 24 hours, two weeks, three weeks or 30 days. Both sides see its current timer. Expired messages are removed on message access and during normal site activity. Earlier downloaded backups are not changed by this timer. The owner’s private export includes unexpired support records. Please avoid sending sensitive medical, identity or payment details in messages. Contact CannaMart through Messages for account and privacy requests.
Online visitor map
The owner can see an approximate map of browsers active in the last five minutes. We reuse the first-party visitor cookie to avoid counting the same browser more than once, with a separate hashed identifier. Hosting location estimates are reduced to broad areas before being saved; Jersey and Guernsey use island-level markers. This map does not store IP addresses, names, account identifiers or exact visitor coordinates. Entries stop counting after five minutes and are removed on the next activity update or map refresh. These temporary records are excluded from website content backups. Do Not Track and Global Privacy Control signals disable this measurement.
Make a privacy request
Email Admin.CannaMartJE@gmail.com. You can request access, correction or deletion of your personal information, or ask about other data-protection rights. Include your username and explain your request if you can; no special form is required. Never send your password or recovery code. We may ask for proportionate information to confirm identity when necessary.
We respond without undue delay and normally within four weeks. If a lawful extension is needed for a complex or numerous request, we explain the reason within the initial four weeks. Some information may need to be retained for legal reasons or to protect others; we explain any applicable limits. You can also complain to the Jersey Office of the Information Commissioner.