Privacy policy
Effective October 25, 2026
Where’s The Weed At (wherestheweedat.ca) is an information directory of licensed cannabis stores in Canada. This policy explains, in plain language, what personal information we handle, why, and what you can do about it. We collect as little as we can: you can browse the whole directory without an account.
Store information is public regulatory information
Store listings are built from official provincial and territorial licensing registries. Details such as a store’s name, address, licence information, licence holder, phone number and website are public regulatory information published by those regulators. We republish it so people can find licensed stores. If you think something is wrong, see your choices and rights below.
If you visit the site
- Age check. You enter your date of birth in your own browser, which checks it there. Your date of birth is not sent to us or stored anywhere. We only store a small cookie in your browser (
age_ok) saying you passed, for 30 days. - “Near me”. If you choose to use your location, your browser uses it on your device to sort nearby stores. Your location is not sent to us or stored.
- Searches. What you type in search is sent to our server to find matching stores and places. We don’t save your searches.
- Page-view counts. We count how many times each page is viewed per day, as a single total per page. The counter uses no cookies and doesn’t store your IP address or any identifier.
- Map. When an interactive map loads, your browser fetches map images directly from OpenFreeMap, a third-party map service. Like any website, their servers receive your IP address and basic browser information to deliver those images.
- No trackers. We don’t use analytics services, advertising networks, tracking pixels or social media widgets. Our fonts are served from our own server.
If you claim or manage a store listing
- Verification. When you claim a listing, we record the email address the one-time code is sent to (the registry email, an address at the store’s website domain, or the address you give for a manual review), when it was sent and how many tries were made. We store only a scrambled (hashed) form of the code, not the code itself.
- Manual review requests. If you ask for a manual review, we keep what you submit: your name, role, email, phone number (optional) and message, along with our decision, when we made it, and our internal notes. To check a request we usually call the store at the phone number on its licence record.
- Signing in. Once verified, we store a random sign-in token with your email address, your store and an expiry date, and put it in a cookie (
owner_session) for 14 days. - Your listing content. The description, hours, phone number, delivery details, photos and menu you add are published on your public listing. Your email address is never shown on the listing.
- Payments. Paid features are not available. If they are offered later, we would keep a record of each payment request (reference, amount and status) and update this policy first.
We send only transactional emails: verification and sign-in codes, and messages about a listing or request you made. We never send marketing email and never use your address for anything else. For each email we send, we keep a short record of the recipient and subject (with any code hidden). If you email us, we keep your message (sender, subject and text) so we can reply and keep a record of the request.
How we use information
- to run the directory and show accurate, licensed listings
- to confirm that a person claiming a listing is authorized to manage it, and to prevent false claims
- to keep verified owners signed in and let them manage their listing
- to reply to you and handle corrections, removals and privacy requests
- to keep the site secure and fix problems
We do not sell, rent or trade personal information. We don’t share it with anyone except the service providers below, who handle it only to provide their service to us, or where the law requires it.
Service providers and where data is stored
- DigitalOcean hosts our website and database on a server in its Toronto, Canada data centre.
- Resend delivers the emails we send and receives email sent to our addresses. It processes the email addresses and message content involved, and may do so outside Canada, including in the United States.
- OpenFreeMap serves the map images your browser loads, as described above.
Server logs
Our web server is not set up to keep visitor access logs. Our application keeps basic technical logs of errors and email delivery problems; these can include the email address a message was sent to. They are stored on our server and cleared when we update the application. Our hosting provider may keep its own infrastructure logs.
How long we keep information
We don’t currently delete records automatically on a schedule. Claim, review, sign-in and email records are kept until you ask us to delete them. Sign-ins stop working after 14 days even though the record remains. If you remove your listing from the owner dashboard, it stops being shown publicly right away, and the content you added is kept so you can restore it later, unless you ask us to delete it. We may keep backup copies of our database, made before maintenance, on our own systems. When we delete information on request, we remove it from the live database. We’ll delete it on request whenever the law allows.
Your choices and rights
You can ask to see the personal information we hold about you, to correct it, or to delete it, and you can withdraw your consent to us using it. Email hello@wherestheweedat.ca from the address involved, or tell us how to confirm it’s you. We’ll respond within 30 days. Verified owners can also edit or remove their listing at any time from the owner dashboard.
Store details that come from official registries are public regulatory information. We can correct our copy to match the registry, or remove a listing at the store’s request, but changes to the registry itself have to go through the regulator.
If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.
Cookies
We use only the cookies below. They are all set by us, and none are used for advertising or tracking.
| Name | Purpose | Lasts | Who gets it |
|---|---|---|---|
| age_ok | Remembers that you passed the age check, so you aren’t asked on every page. Contains only the value “1”, never your date of birth. | 30 days | Everyone who passes the age check |
| owner_session | Keeps a verified store owner signed in to the owner dashboard. A random token; can’t be read by page scripts. | 14 days | Verified store owners only |
| wtwa_admin | Keeps our own administrator signed in to the internal admin area. | 12 hours | Our administrator only |
You can delete cookies in your browser settings at any time. You’ll then see the age check again, and owners will need to sign in again.
Security
The site is served only over encrypted HTTPS. Verification codes are stored in hashed form and expire after 30 minutes, and sign-in cookies can’t be read by page scripts. No system is perfectly secure, but we limit what we collect and who can access it.
Adults only
This site is for adults of legal age where they live (see our age policy). We don’t knowingly collect personal information from anyone under the legal age. If you believe a minor has sent us information, contact us and we’ll delete it.
Changes to this policy
If we change how we handle personal information, we’ll update this page and the effective date at the top before the change takes effect.
Contact
Questions or requests about privacy: hello@wherestheweedat.ca. See also our legal notice and how listings work for store owners.