Who we are
GenetixBay is operated by [ENTITY NAME], [GB_POSTAL_ADDRESS] (“GenetixBay”, “we”, “us”). We decide why and how your personal information is used, so we are responsible for it (in GDPR terms, the controller).
Person in charge of privacy. Our privacy officer is [PRIVACY OFFICER NAME AND TITLE]. In Quebec this is the person in charge of the protection of personal information. Reach them at privacy@genetixbay.com. Until that address is switched on, hello@genetixbay.com reaches the same inbox.
What we collect and why
Here is everything, grouped by where it comes from. If something isn't listed, we don't collect it.
When you join the waitlist
- Your email address (required), so we can tell you about the launch.
- Your state or province, the interests you tick and an optional note (for example, a line you'd like us to preserve), so we can plan what to build and where.
- Referral codes: your own code, and the code of whoever sent you, so referrals move people up the list.
- How you found us: the campaign tags in the link you followed (such as
utm_source), the website and page that linked to us (without the part after the “?”) and the first page you landed on. - Your language (English or French) and the date and time you signed up, which is also our record of your consent.
- A connection fingerprint: a one-way, salted hash of your IP address. We use it only to stop one connection from faking dozens of referrals. We don't store the IP address itself.
You must also confirm your age and that we may email you. We check those boxes before we store anything.
When you reserve a reward on Fund the Bay
- Your email, the reward you picked, the amount and currency, the price you were shown, which site you used (.com or .ca), your language, your state or province (so we know what we can ship), referral and campaign tags, and the time.
- A display name for the public backer wall, unless you choose Anonymous. This is the only part that is ever public.
- A reservation also adds you to the waitlist if you weren't on it.
We don't take card details today. Nothing is charged until checkout opens. When it does, [PAYMENT PROCESSOR] will collect your card details directly; we will receive a confirmation and the details needed for your order (such as your shipping address for hardware), never your full card number.
When you email us
We keep what you send and our replies, so we can help you. Our mail system also keeps a short log of the messages it sends (recipient address, type of message, delivery status and time) and a suppression list of addresses that unsubscribed or bounced, so we never email them again.
When you browse
Our own analytics count visits without cookies. For each page view we record the page, the time, a visitor ID that changes every day, your country (looked up by our network provider; we don't keep the IP), a device type (phone, tablet or desktop), your screen width, the referring site and page (without the part after the “?”), any campaign tags, time on page, how far you scrolled, the address of any outbound link you click, the names of buttons you press, and whether a sign-up or reservation happened.
The visitor ID is a one-way hash of your IP address, your browser's user-agent string, the date and a secret key. Because the date is part of it, the same browser gets a new ID every day, and we can't turn the ID back into your IP address. Because the secret key doesn't change, we treat these records as personal information and protect them that way. Automated visitors (search crawlers, link previews, monitors) are skipped. Details: Cookies and analytics.
Our server also holds your IP address in memory for up to an hour to enforce rate limits (for example, eight sign-ups per connection per hour). It is never written to disk by us.
When accounts open (planned for 2027)
The GenetixBay app isn't open to the public yet. When it is, it will store:
- Your sign-in email, kept separate from your public profile and never shown to other members.
- Your date of birth and state or province, to apply the legal-age rules where you live. Your date of birth is never shown.
- Your profile: handle, display name, bio, experience level, growing methods, badges, levels and points.
- What you post: journals, photos, posts, comments, genetics records and lineage claims. Photos are re-encoded with their metadata (including GPS location) removed.
- Pearls and activity points, as a ledger of what you earned, bought and spent.
- Sign-in and security records: a hashed session token, a description of your browser, sign-in times, and a security log of sign-ins and account changes with a salted hash of your IP address.
- Two-step sign-in: your authenticator secret (encrypted), one-time recovery codes (stored only as hashes) and passkey public keys.
- Questions you ask Professor Greenleaf, with his answer, the sources he cited and any rating you give, so we can check and improve answer quality.
What we don't collect
No precise location (never finer than state or province), no contacts, no social-media logins, nothing bought from data brokers, and no card numbers. Please don't send us health or medical information; we don't need it, and our forms don't ask for it.
Professor Greenleaf and voice
Professor Greenleaf's written answers are produced by a language model working from our knowledge base. When you ask a question, the question and the knowledge-base passages it relates to are sent to our model provider, [AI MODEL PROVIDER NAME] (United States), which returns the answer. We don't send your email address or your name. Please don't include personal details in questions. [COUNSEL: confirm the provider's terms on retention and that API data isn't used to train its models.]
Greenleaf's spoken narration is made with ElevenLabs (United States). Today we send only our own scripts, never visitor data. If spoken replies are added to the app, the text of Greenleaf's reply would be sent to create the audio, and we will update this policy first.
Legal basis and consent
We rely on your consent to collect and use personal information, as Canadian law expects, and we only use it for the purposes listed here.
- Express consent for marketing email (the waitlist and launch news). You give it by ticking an unticked box, and you can withdraw it at any time with the unsubscribe link in every email.
- To provide what you asked for (in GDPR terms, a contract): managing your reservation, sending its confirmation, running your account.
- Legitimate interests that don't override your rights: keeping the service secure, stopping fraud and spam, and counting visits in the minimal, cookieless way described above.
- Legal obligations: tax records, answering lawful requests, honouring unsubscribes.
Withdrawing consent doesn't affect what we did before. If you withdraw consent we need to provide a service (for example, your sign-in email), we'll explain what that means before we act.
Automated decisions. The age gate is automatic: if the date of birth you enter is under the legal age where you live, an account can't be created, and repeated failed attempts lock the sign-up. You can ask a person to review it at privacy@genetixbay.com. We make no other automated decisions about you, and we don't build advertising profiles.
How we use it
- To tell you about the launch, your place in line and Fund the Bay (if you agreed).
- To manage reservations, and later to take payment and ship rewards.
- To run accounts, journals, the archive and the community.
- To answer your emails and support requests.
- To keep the service secure and stop fraud, spam and referral abuse.
- To understand which pages help people, in aggregate.
- To meet legal obligations.
We don't use your information for anything else without asking you first.
What other people can see
- Your backer-wall name, unless you chose Anonymous. Totals show only amounts and counts, never emails.
- When accounts open: your handle, level, badges, and anything you post with public visibility. Journals default to members-only, and you can set each entry to public, members, followers or private.
- Genetics records and provenance. The archive keeps a permanent, tamper-evident history of each record. If you delete your account, the personal content in your entries is removed and your name is replaced with “deleted member”; the bare entry (what kind of event, when) stays so the history still adds up.
Where your data is stored
Our servers are in [SERVER LOCATION]. Some of our service providers are in the United States or run global networks, so your information may be processed outside your province, state or country, where it is subject to local law, including access by courts and authorities there.
Before we send personal information outside Quebec, we aim to assess whether it will be adequately protected, as Quebec law requires. [COUNSEL: privacy impact assessment for transfers outside Quebec; GDPR transfer mechanism for any EU visitors.]
How long we keep it
We keep information only as long as we need it for the purposes above, then delete it or make it anonymous.
Waitlist sign-ups
Until you unsubscribe or ask us to delete them, or [24 MONTHS] after launch if you never create an account.
Unsubscribes and bounces
The address stays on our suppression list for as long as we send email, so we never contact you again.
Reservations
While active. Cancelled or lapsed reservations: [12 MONTHS]. Paid orders: as long as tax and consumer law require, [COUNSEL: usually 6 to 7 years].
Analytics events
[13 MONTHS], then only totals are kept.
Our sent-mail log
[12 MONTHS].
Emails you send us
As long as needed to help you, then [24 MONTHS]. Copies held in transit by Cloudflare are deleted within 30 days.
Accounts (when they open)
Until you delete your account. Deletion removes your personal data within [30 DAYS], and backups roll over within [35 DAYS].
Security log and Greenleaf questions
[12 MONTHS], then removed or made anonymous.
Some of these deletions aren't automatic yet. Until they are, we delete on schedule by hand. [OWNER: automate each retention period.]
How we protect it
- Every page is served over an encrypted connection.
- Our data files are never served to the web, and only the founder [AND NAMED STAFF] can reach them.
- Sign-in links expire in 15 minutes and work once. Session tokens, recovery codes and sign-in links are stored only as hashes, and authenticator secrets are encrypted.
- We keep backups, and we aim to encrypt every copy. [OWNER: confirm backup encryption.]
No system is perfectly secure. If you find a weakness, please tell us: Security and disclosure.
If something goes wrong
If a breach puts your personal information at risk, we aim to:
- contain it and work out what happened, straight away;
- tell you without undue delay if there is a real risk of significant harm, as Canadian law (PIPEDA) requires, or a risk of serious injury, as Quebec law requires, with what happened, what it means for you and what you can do;
- report it to the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information and any other authority the law requires, including US state regulators and, for the GDPR, within 72 hours;
- keep a record of every incident, even small ones, for at least 24 months.
Questions about an incident: privacy@genetixbay.com.
Your rights and how to use them
We give these rights to everyone, wherever you live:
- Know and access: see what we hold about you and how we use it.
- Correct anything that's wrong.
- Delete your data (we keep only what the law makes us keep, and we'll tell you what that is).
- Take it with you: a copy in a common, machine-readable format, free.
- Withdraw consent and stop marketing email: one click in any email.
- Object or restrict how we use your data, where the GDPR applies.
- De-indexing: ask us to stop spreading information about you or to de-index a link to it, as Quebec law allows.
- Opt out of sale, sharing and targeted advertising: we don't do any of these. We also treat a Global Privacy Control signal from your browser as an opt-out.
- No discrimination for using any of these rights.
How to ask
Email privacy@genetixbay.com from the address we know you by. If you write from another address, we'll ask a simple question to confirm it's you, and we never ask for more than we need. Someone you authorise can ask for you with your signed permission. When accounts open, you'll also be able to delete your account from your settings.
We aim to answer within 30 days (the limit under Canadian and Quebec law), or sooner where another law sets a shorter limit. If we need more time, as the law allows, we'll tell you why. It's free.
If you disagree with our answer
Reply with “appeal” and our privacy officer will review it within 45 days. You can also complain to a regulator at any time:
- Canada: the Office of the Privacy Commissioner of Canada, or your provincial commissioner (for example in British Columbia or Alberta).
- Quebec: the Commission d'accès à l'information.
- United States: your state attorney general or privacy agency (in California, the California Privacy Protection Agency).
- European Union and United Kingdom: your local data-protection authority.
Adults only
GenetixBay is for adults of legal age where they live: 21+ in the US; 18+ in Alberta, 21+ in Quebec and 19+ in the rest of Canada. We don't knowingly collect information from anyone younger, and our forms ask you to confirm your age. If we learn that someone under age has given us information, we delete it. If you think that has happened, tell us at privacy@genetixbay.com.
Why we're extra careful
Information about growing cannabis can be sensitive: laws differ from place to place and change over time. So we design for privacy by default: pseudonymous handles, no location finer than state or province, photo metadata stripped, journals members-only by default, and your email never shown. Please don't post anything that could reveal where you live or grow.
Extra notes for US residents
Some US state privacy laws, such as California's, may not apply to us yet because of our size. We follow their main rules anyway. In their terms, in the last 12 months we collected:
- Identifiers: email address, display name, referral code and a hashed connection fingerprint.
- Commercial information: the rewards you reserved.
- Internet activity: the cookieless page-view records described above.
- Approximate location: the state you tell us, and the country of your connection.
We collected them from you and your browser, for the purposes in this policy, and disclosed them only to the service providers listed. We sold or shared none, and we don't use sensitive personal information to infer anything about you. When accounts open, sign-in details count as sensitive personal information; we use them only to sign you in and keep your account secure.
We don't intend to collect “consumer health data” as Washington and Nevada define it. Please don't send us any. [COUNSEL: confirm whether any planned feature falls under those laws.]
Changes to this policy
We'll date every version. If we make a meaningful change, we'll email people on our list and show a notice on the site at least [30 DAYS] before it takes effect, and we'll ask for your consent again if the change needs it. Earlier versions are available on request at privacy@genetixbay.com.
Contact
Privacy officer: [PRIVACY OFFICER NAME AND TITLE], [ENTITY NAME], [GB_POSTAL_ADDRESS]. Email: privacy@genetixbay.com (or hello@genetixbay.com). We read every message.