Privacy policy

• You can read this whole site without giving us any personal information.
• If you subscribe to our newsletter, we keep your email address and a record of your consent.
• Our analytics don’t use cookies and don’t identify you.
• We don’t sell or rent personal information, and we don’t share it for others’ marketing.
• We don’t receive customer data from any cannabis business, and we don’t give any data to one.
• We don’t take reports or health information through this site.

This policy covers the website at cannabishealthandsafety.org and our email newsletter, The Safety Brief. Both are run by the Cannabis Health & Safety Alliance (“CHSA,” “we”), a California nonprofit public benefit corporation. Other websites we link to, including government agencies, have their own privacy policies.

To match addresses and stop abuse without reading them, we also keep scrambled codes (keyed hashes) of email addresses and IP addresses. A hash can’t be turned back into the address.

We don’t collect: reports about stores or products, health information, payment card details, precise location, or accounts and passwords. If you choose a state or location on our site, that choice is stored only in your own browser.

• To send the newsletter you asked for, and to prove you asked for it
• To answer your messages
• To keep the site running and protect it from abuse, such as bots and repeated sign-ups
• To count visits in total, so we know which pages help people

We don’t use your information for advertising, and we don’t build profiles of visitors.

We share personal information only with service providers who help us run the site and send email:

The newsletter has not started yet. The email providers above are the ones we use when we send email.

We may also disclose information if the law requires it, for example under a valid court order. We don’t sell or rent personal information, and we don’t share it with others for their own marketing.

We have no data-sharing arrangement with any cannabis business. No store or brand gives us its customers’ information, and we give none to them.

• We don’t use advertising cookies, tracking pixels or social media trackers.
• Our analytics (Cloudflare Web Analytics) don’t use cookies or browser storage, and don’t fingerprint visitors. They report totals, not individuals.
• We don’t load marketing or advertising scripts. The only outside scripts on our pages come from Cloudflare: the bot check (Turnstile), only on forms that send us information, and Web Analytics.
• If you pick your state on our site, your choice is saved in your browser’s local storage. It never leaves your device.

Some browsers send a “Do Not Track” or “Global Privacy Control” signal. We don’t track visitors across other websites, and we don’t sell or share personal information for advertising, so the site works the same whether or not your browser sends these signals. If we ever add something these signals apply to, we will honor them.

• Unsubscribe from the newsletter with the link in any email. We act on it within 10 business days. When you unsubscribe, we erase your email address and keep only a scrambled code, so we don’t email you again.
• To see, correct or delete the information we hold about you, email privacy@cannabishealthandsafety.org. We may need to confirm it’s you before we act. We will answer within 45 days.
• CHSA is a nonprofit. California’s main consumer privacy law, the California Consumer Privacy Act (CCPA), generally doesn’t apply to nonprofits, so it may not cover us. We still give everyone its core rights, wherever you live: to know what we hold about you, to have it deleted, to have it corrected, and to opt out of its sale. We never sell personal information, so there is nothing to opt out of.
• We won’t treat you differently for using any of these rights.

This site is written for adults, including parents and caregivers. It is not directed to children under 13, and we don’t knowingly collect personal information from them. If you think a child has given us information, contact us and we will delete it.

We use reasonable security measures to protect the information we hold, including encryption in transit, limited staff access, and strong sign-in for anyone who can publish or see personal data.

If a security breach exposes your personal information, we will tell you within 30 calendar days of finding out, as California law requires (Civil Code section 1798.82). The law allows a delay only if law enforcement needs one, or if we need time to find out how big the breach is and secure our systems. If we have to notify more than 500 California residents about one breach, we will also send a sample copy of the notice to the California Attorney General within 15 days of notifying them.

Our service providers may store and process information in the United States and in other countries where they operate.

When we change this policy, we post the new version here with a new effective date. If a change affects how we use your email address, we will tell newsletter subscribers by email before it takes effect.

Questions or requests: email privacy@cannabishealthandsafety.org. We don’t have a postal address yet. We will add one here when we have one.