Privacy for members, reviewers, and operator teams.

Data Collected

Canopy Trove may collect and process:

• account information such as email address, display name, and profile id
• saved storefronts, recent storefront activity, favorites, and badge progress
• storefront reviews, helpful votes, storefront reports, and review GIFs
• member-submitted media when photo uploads are enabled in the app experience
• scanned product codes (anonymous), including batch and brand identifiers parsed from Certificate of Analysis links
• owner-portal business details, claim submissions, verification records, subscription records, and billing customer identifiers
• foreground location used to show nearby storefronts and arrival-based prompts
• notification tokens used to deliver storefront alerts or visit follow-ups

How Canopy Trove Uses Data

Canopy Trove uses this information to:

• personalize the storefront experience
• save profile state across devices when authenticated
• power reviews, ratings, reports, and moderation
• operate owner verification, owner billing, and billing-portal access
• deliver optional notifications when users allow them
• improve platform quality and diagnose operational issues

Location Use

Canopy Trove currently requests foreground-only location access. Location is used to:

• surface nearby licensed dispensaries
• help continue from discovery into an in-person storefront visit
• trigger the in-app follow-up prompt after a storefront visit

Canopy Trove does not rely on background location in the current product experience.

The current rollout is New York-first and designed for adults using the app in lawful jurisdictions, so location helps keep discovery and visit context tied to the markets where Canopy Trove is intended to operate.

User-Generated Content

Reviews, helpful votes, reports, GIFs, and any related community media are stored to support community features and moderation when those inputs are enabled. Canopy Trove may remove or suppress content that violates policy, appears abusive, or is otherwise unsafe or unlawful.

Photo Uploads

When member photo uploads are enabled, Canopy Trove may collect the image itself together with basic metadata needed to store, display, and moderate the upload. Those uploads may appear on storefront pages or related community surfaces inside the app.

Uploaded media may be reviewed for policy, privacy, copyright, trademark, or safety issues. Canopy Trove may retain moderation records tied to a removal decision and may store or process uploaded media through infrastructure vendors acting on behalf of the service.

Product Scans

When users scan a product's QR code or barcode using the camera in the Verify tab, Canopy Trove records an anonymous scan event identified only by an app-install identifier, never by personal information.

Each scan record includes the code that was scanned, whether it resolved to a licensed shop or a product, an optional approximate location (only when the user grants location permission during a scan), and the brand or batch identifier if the scan resolved to a Certificate of Analysis from a state-licensed testing lab.

The purpose of scan logging is to aggregate brand and product signal across the platform to power features like "trending near you," operator dashboards showing brand performance, and user-facing product quality context from lab testing results. Scan data is never linked to user identity.

Scanning is anonymous by default and never requires sign-in. A scan-logging opt-out toggle is planned for an upcoming release under Profile → Privacy controls; until that ships, scans are logged anonymously (install ID only, never linked to user identity) and users can email support to request deletion of their install's scan history at any time.

Product information pulled from QR codes (such as THC percentage, terpene profiles, and contaminant test results) comes from public data hosted by New York-licensed testing laboratories. Canopy Trove surfaces this lab-issued information to users but does not certify, issue, or modify any lab record.

Notifications

If the user opts in, Canopy Trove may send:

• favorite-store storefront alerts
• visit follow-up prompts

Users can disable notifications in system settings at any time.

Account Deletion

Users can delete their account in-app from the Profile area. Deletion clears local Canopy Trove data on the device and removes the linked backend profile path used by the app. If the underlying authentication provider requires a fresh sign-in before login removal, the app will prompt the user accordingly.

Children's Privacy (COPPA)

Canopy Trove is intended exclusively for adults 21 years of age or older in lawful jurisdictions. The service does not knowingly collect personal information from children under 13 years of age. Users must confirm they are 21 or older at entry to use the service. If we become aware that a child under 13 has provided personal information, we will promptly delete such information from our systems.

Owner Portal Data

Owner accounts may upload business-verification and identity-verification documents. These records, along with owner subscription and billing status, are used for manual review and access control inside the owner portal.

Data Sharing

Canopy Trove may use infrastructure providers that process data on behalf of the service, including hosting, authentication, storage, mapping, notifications, analytics, and billing vendors including Apple (in-app subscriptions on iOS) and Stripe (web and owner-portal billing). Canopy Trove does not present itself as a direct cannabis sales or ordering platform.

Subscription purchases made inside the iOS app are processed by Apple’s In-App Purchase system. Apple handles the payment itself; Canopy Trove receives subscription status updates (such as renewals, cancellations, refunds, and grace periods) through Apple’s App Store Server Notifications and uses Apple’s transaction and subscription identifiers to keep owner-portal access in sync. Canopy Trove does not receive your payment card information from Apple. Subscriptions started in the iOS app can be cancelled at any time in iPhone Settings → Apple ID → Subscriptions.

Canopy Trove reads the New York Office of Cannabis Management’s public dispensary license dataset (published on data.ny.gov) to power the “Verified licensed” badge on storefront listings and the Verify tab. This dataset is already public. Canopy Trove caches it for performance and surfaces match results to users. Canopy Trove does not issue, modify, or revoke any license, and is not affiliated with or endorsed by the Office of Cannabis Management or New York State.

Canopy Trove may also resolve publicly accessible Certificate of Analysis URLs from NY-licensed testing laboratories to surface lab results (including potency, terpenes, and contaminant testing) to users when they scan a product code. This data is public and hosted by the labs themselves. Canopy Trove does not issue, certify, or modify any lab record.