Privacy Policy for the CannaRewards mobile app.

Scope and contact

This policy covers the CannaRewards mobile app, app backends, app legal pages, and app account-deletion flow. The marketing website has separate website-scoped legal pages.

Operated by Canna Suite LLC. Canna Suite LLC operates the CannaRewards mobile app in the United States. The current app launch scope is New York, starting in Northern New York.

Users can contact Canna Suite LLC at hello@cannarewards.app for privacy questions, support requests, and account-deletion help.

The app is not directed to children or teenagers. Users must be at least 21 years old to use the app.

Information collected

The app collects information needed for accounts, eligibility, scans, rewards, support, and security. The exact data collected depends on how a user uses the app, which permissions the user grants, and which app features are enabled in the build.

Identity and sign-in data.

The app may process Firebase Authentication identifiers, sign-in provider information, email address, display name, photo URL, Apple or Google sign-in state, account status, profile state, preferences, support requests, and deletion request records.

Age, demographics, and market eligibility.

The app may process birth date or age-gate results, age bucket, gender selection, location permission status, latitude, longitude, accuracy, timestamp, city, state, market code, and market eligibility results. The current app geogate is for New York, with initial launch operations focused on Northern New York.

Eligibility, reward, and fraud-prevention signals.

The app may generate derived records such as eligibility-ready status, market-allowed status, primary sign-in provider, saved-profile flags, duplicate-scan indicators, scan result categories, reward status, support-safe IDs, and fraud-prevention signals from account, scan, location, device, and backend data.

Package, product, points, and reward records.

The app may process package scan inputs, claim-link or QR metadata, support IDs, brand identifiers, product identifiers, scan attempts, scan outcomes, point balances, reward redemptions, discount codes, and external reward URLs.

Support, deletion, and event/demo submissions.

The app may process email support messages, deletion requests, and the content of messages sent to Canna Suite LLC. Event or demo features, when enabled outside the ordinary store-submission app, may collect name, phone number, email address, and selected brand for lead follow-up.

Operator/admin image selection where enabled.

Consumer scan flows use the camera. Operator or admin features, where enabled, may process catalog or brand images selected from a device photo library for app content workflows.

Store-submission builds may include read-only Products.

App Store and Google Play submission builds may include product and brand browsing in a read-only Products catalog. The store-submission app does not provide cannabis purchase, checkout, reservation, pickup, delivery, or dispensary discovery. If future builds enable dispensary discovery, this policy will be updated before that feature is used.

Analytics and crash data.

The app may process device, app version, operating system, screen, event, performance, crash, App Check, fraud-prevention, security, request, response, support ID, user ID, user-property, and error metadata through Firebase, Cloud Run backends, and related service logs. Analytics is designed not to include raw scan codes or raw search text.

Use and collection sources

Canna Suite LLC uses app data to create and authenticate accounts, verify age and market eligibility, validate package scans, award and redeem points, show product and reward context, prevent fraud, protect codes from misuse, provide support, maintain security, debug crashes, measure app performance, and comply with legal obligations.

• Users provide data directly when signing in, setting profile or eligibility information, scanning codes, redeeming rewards, contacting support, or requesting deletion.
• The app collects device, permission, scan, location, diagnostics, and security data through the user's device, Firebase, and CannaRewards backends.
• By using scan, reward, eligibility, support, or event/demo features, users consent to the processing needed to operate those requested features; users can stop using those features, disable optional permissions, or request deletion.
• Apple and Google may provide account, sign-in, app distribution, crash, diagnostics, App Check, or platform-level data depending on the device and user settings.
• Participating brands, rewards partners, and external destinations may provide or receive data needed to operate rewards, product context, support, fraud-prevention, or compliance workflows.

No cannabis sale flow

The store-submission app does not provide cannabis purchase, reservation, pickup, or delivery through reward links or external destinations.

Sharing

App data is shared only for app operations, support, legal, security, and reward workflows. Canna Suite LLC does not sell personal information in the ordinary meaning of selling data for money. Canna Suite LLC does not knowingly share app data for cross-context behavioral advertising. If that changes, this policy will be updated and required consent controls will be used.

Firebase, Google, Apple, Cloud Run, and app infrastructure.

App data may be processed by service providers that host accounts, databases, analytics, crash reports, App Check, backend services, security logs, app distribution, and support workflows. These providers are expected to protect app data consistent with their contracts and applicable law.

Brands, reward partners, and external destinations.

Participating brands, reward partners, and external destinations may receive limited account, scan, product, support, redemption, or reward context needed to operate rewards, verify eligibility, troubleshoot issues, prevent fraud, or honor a user-requested reward action.

Compliance, safety, and business transfers.

App data may be used or disclosed when Canna Suite LLC believes it is necessary to comply with law, protect users, protect codes and rewards, investigate fraud or abuse, enforce terms, respond to legal requests, or transfer the app as part of a merger, financing, reorganization, asset sale, or similar business transaction.

De-identified or aggregated reporting.

Canna Suite LLC may use and share aggregated or de-identified app data for analytics, product improvement, fraud-prevention, brand reporting, reward performance, and business planning, and will not try to re-identify de-identified data except where allowed or required by law.

Retention and deletion

Indefinite while active

Active account records may be retained indefinitely unless deletion is requested or law requires a different period. Account, scan, rewards, redemption, location, eligibility, analytics, crash, fraud-prevention, security, and support records may be retained indefinitely while the account remains active because those records support loyalty balances, duplicate-scan prevention, code integrity, support, audit, compliance, and security.

• When an authenticated account deletion request is accepted, Canna Suite LLC starts deletion immediately and removes or de-identifies account-linked app records without a waiting period.
• Some records may be retained when needed for legal, security, fraud-prevention, audit, tax, compliance, dispute, backup, or operational reasons.
• Backup copies may remain until overwritten or deleted through ordinary backup cycles.
• Users who cannot access the app can request deletion help through hello@cannarewards.app.

Choices, security, and updates

Some permissions and data uses are necessary for core app functionality. For example, location is used for market eligibility, and account data is used for points and rewards.

Permission and account controls.

Users can adjust device permissions such as location and camera through device settings. Users can manage sign-in provider access through Apple, Google, or device account settings where available. Users can contact support to ask privacy questions or request deletion.

Reasonable safeguards are used.

Canna Suite LLC uses administrative, technical, and operational safeguards designed to protect app data, including Firebase security controls, App Check, authentication, backend validation, access controls, logging, and fraud-prevention checks. No internet service can guarantee perfect security.

The app is not for users under 21.

CannaRewards is not directed to children under 13 or to anyone under 21. If Canna Suite LLC learns that an underage user created an account, it may delete or restrict that account.

Access, correction, deletion, and opt-out requests.

Depending on where a user lives and which laws apply to Canna Suite LLC, users may have rights to request access, correction, deletion, portability, or limits on certain uses of personal information. Users can contact hello@cannarewards.app to make a request, and Canna Suite LLC may ask for information needed to verify the request.

No SMS or push marketing in the ordinary store-submission app.

The ordinary store-submission app does not use SMS marketing or push-notification marketing. If Canna Suite LLC later enables those communication channels, it will update this policy and provide any required consent or opt-out controls.

This policy may change.

Canna Suite LLC may update this policy as the app, law, store requirements, vendors, or launch markets change. Material updates will be reflected by changing the effective date and, when appropriate, by providing app or website notice.

Related app pages

The app terms and account-deletion page explain app rules, eligibility, rewards, deletion, and support in more detail.