Privacy Policy

Last updated: September 17, 2026

Grown Like A PRO LLC ("we", "us") builds Canna GLAP, a private, end-to-end encrypted grow journal for adults growing cannabis where it is legal. This policy explains what we collect, what we deliberately cannot read, who else handles data to make the app work, and your choices. The app is for adults 21+ (or the legal age in your region).

The short version: Your grow — plants, rooms, strains, feed logs, harvests, stock, photos, and your chats with Cannie — is encrypted on your device before it reaches our servers. We store it but hold no key that can open it. Some things are not encrypted so the app can work, such as your email, subscription status, sensor readings and your farm's town; those are listed below. We don't sell your data.

1. What is end-to-end encrypted

This content is encrypted on your device with AES-256-GCM before upload. We store only unreadable ciphertext:

Grow records: rooms, fields, plants, strains, phases, feed logs, harvests and notes.
Stock and inventory records, including batches, curing stages and "best used by" dates.
Plant photos. Location data is removed from a photo when you add it, before it is encrypted.
Your saved Cannie conversation history.
Backups you export (an encrypted .cannabackup file that stays wherever you save it).

How your key works

One random key encrypts your grow. We store three locked copies of it, and none of them can be opened by us:

Passphrase copy — locked with a key derived from your passphrase using Argon2id. This is how you unlock on a new device.
Recovery copy — locked with your 24-word recovery phrase, for when you forget your passphrase.
Trusted device copy — after you unlock once on a phone, a copy is kept in that phone's secure keychain so signing in to your account on that phone opens your grow without retyping your passphrase. It never leaves the device.

If you turn on Face ID or fingerprint sign-in, your account email and password are stored in your phone's secure keychain so the app can sign you in after the biometric check. If you lose both your passphrase and your recovery phrase, your encrypted grow cannot be recovered — by you or by us.

2. What is not end-to-end encrypted

We can read the following, because the app needs it to run, bill, or keep your account safe:

Account details — email address, name, date of birth and the location (country, state, city) you enter at sign-up, plus your sign-in method (email, Apple or Google). Passwords are salted and hashed by our authentication provider; we never see them.
Subscription status — whether your intro period or subscription is active, when it renews or ends, and whether a payment failed. We never receive your full card number.
Sensor data — readings from connected sensors (temperature, humidity, battery) and the sensor's name and ID.
Farm details — farm name and the address or town you enter, used for weather.
Team membership — who belongs to your grow and their role.
Security records — IP address when you sign up and sign in; sign-in attempts (email, time, success or failure, IP address and device type); security events such as two-step verification and password resets; and device name and operating system for your active sessions. We use these to protect accounts, alert you to failed sign-ins, and stop abuse, including automated checks that can flag suspicious sign-ups.
Notification tokens — so we can send the reminders and alerts you turn on.
Support messages and feedback you send us.
Usage counts — how many Cannie requests your account makes, to keep the service fair.

3. Cannie, the AI assistant

When you ask Cannie something, the following is sent to our AI provider, OpenAI, to produce an answer:

your message and any photo you attach;
your recent conversation with Cannie;
the strain and stage of the plant you're asking about;
a summary of your recent room temperature and humidity and local weather, so answers fit your conditions;
a summary of your feed history — only if you switch that on.

This is the one place grow information leaves your device in readable form, and only when you ask Cannie a question. Cannie's answers are guidance, not professional advice.

4. Who else handles data

We don't sell your personal information. We use these service providers to run the app:

Supabase — hosting, authentication and data storage (including the encrypted grow data).
Stripe — payments made on our website. Stripe receives your email and payment details under its own privacy policy.
Apple App Store and Google Play — in-app subscriptions. We receive a purchase confirmation, not your payment details.
Apple and Google sign-in — if you choose to sign in with them.
OpenAI — Cannie's answers, as described above.
Resend — account and security emails, such as sign-in codes and failed sign-in alerts (which include the time, device type and IP address of the attempt).
WeatherAPI.com — your farm's town or city, to fetch weather and severe-weather alerts. We don't send your exact coordinates.
Expo — delivering push notifications to your phone.
Sentry — crash and error reports, where enabled. We filter these to exclude grow content, but reports can include device details and sensor connection information.

We may disclose the readable information above if we are legally required to. Your end-to-end encrypted grow stays unreadable to us, and so to anyone we could be compelled to hand it to.

5. How we use information

To provide the app, sync your data, and run your subscription.
To keep accounts secure, alert you to failed sign-ins, and prevent abuse and fraud.
To answer Cannie questions and fetch weather for your farm.
To send the notifications and emails you've asked for or that concern your account.
To respond to support requests.

6. Keeping and deleting your data

We keep your account data while your account is active. To delete your account and its data, email privacy@growcannabiseasily.com from the address on your account and we will confirm once it is done. Some records may be kept where the law requires it or to prevent fraud (for example, payment records held by Stripe, Apple or Google). Encrypted grow data cannot be read without your keys, so once your keys are gone it is permanently unreadable.

7. Your choices and rights

You can ask for a copy of, correction of, or deletion of the readable personal information we hold about you by emailing us.
You control Cannie: don't send what you don't want sent, and keep feed-history sharing off if you prefer.
You can turn notifications, Face ID / fingerprint sign-in and trusted-device unlock on or off in the app.
Depending on where you live, you may have additional rights under local law; contact us to use them.

8. Age

The app is only for adults 21+ (or the legal age for cannabis cultivation in your region). It is not directed to anyone under that age.

9. Changes

We may update this policy. The "Last updated" date shows the current version, and we'll tell you in the app or by email about material changes.

10. Contact

Questions about privacy: privacy@growcannabiseasily.com.