Privacy Policy
Last updated October 30, 2026
Short version: price comparison works without an account and without tracking. If you keep a diary, it stays on your device until you sign in. Once you sign in, your ratings and reviews are public unless you mark them private. Dose, method, effects, conditions, notes, what you paid, where you bought (unless you choose to share it), and anything from a scanned pack are always private. We don't sell data or run ads. We use product analytics (PostHog) to see which features get used, with no cookies and no screen/session recording; see "Product analytics" below. If you ask the AI picker a question, that question is processed by AI model providers (see "AI picker" below); it is not stored by us and your diary is only included if you turn that on.
Who we are
rosinplug.me is operated by Western Engineering LLC. It is an independent price-comparison site and consumption diary for adults 21 and older. Contact: support@rosinplug.me.
Using the site without an account
Browsing prices needs no account. We don't use cookies or advertising trackers. We do use product analytics (see "Product analytics" below). Your selected market and service area are saved in your browser's local storage. The map loads tiles from OpenStreetMap's servers, which see your IP address like any website you visit.
If you use the diary without signing in, your entries are stored only in your browser. They are not sent to us. Scanned pack QR codes are saved as text and are never looked up or fetched.
If you create an account
| What | Why | Who can see it |
|---|---|---|
| Email address (from the magic link or Google) | Sign-in | Only you and us |
| Name and profile picture from Google, if you use Google sign-in | Provided by Google during sign-in; we don't display them | Only you and us |
| Username | Your public identity on the site | Public |
| Confirmation that you are 21+, with the time you confirmed | Age requirement | Only you and us |
| Products you log: brand, strain, category, technique, texture | Your diary and, later, community ratings | Public |
| Rating, like, review, tags, "tried before", date | Your diary | Public by default; you can mark any entry private |
| Where you bought it | Your diary; comparing what you paid to current prices | Private unless you turn on sharing for that check-in. Shared venues appear an hour after posting, with the date only, never the time |
| Method, dose, effects, side effects, conditions, setting, notes, price paid, weight, purchase date | Your diary | Always private: only you |
| Your two AI settings (use my diary for recommendations; help improve recommendations for everyone) and the time you turned each on | To honor your choices | Only you and us |
| How many AI picker asks you made each day, and how many tokens (units of text size) they used. Not what you asked or what was answered | The daily limit and cost control | Only you and us |
| From scanned packs: QR contents, lab report link, batch, package tag | Your diary | Always private: only you |
"Private" means other users and the public can't see it. It is stored on our database provider's servers and is not end-to-end encrypted, so it could be disclosed if we are legally required to do so (see below).
Social features
| What | Why | Who can see it |
|---|---|---|
| Display name (optional, if you set one) | Shown instead of your username on your profile and entries | Public. You type it yourself; it's never taken from Google or any other sign-in provider |
| Bio (optional) | Shown on your profile | Public |
| Who you follow and who follows you | Building your feed, and your follower/following counts | Counts are public; the lists themselves are visible only to you |
| Toasts (likes) you give | Letting an entry's author know you liked it | Toast counts on an entry are public; who gave them is visible only to that entry's author, in notifications |
| Comments you post | Discussion on entries | Public, unless removed or hidden after reports |
| Content you report, or reports made against your content | Moderation | Only us. We don't tell a reported user who reported them, or tell a reporter what we did about it |
| A username you change away from or release | Reserved for 90 days so someone else can't immediately claim it and impersonate you | Not shown to anyone; it just blocks reuse of that name for 90 days |
| Products on your wishlist | Showing your saved list and emailing you when one drops in price | Private: only you |
Health-related information
Effects, side effects and conditions you choose to log may be considered health data under laws such as Washington's My Health My Data Act. These fields are optional, always private, never sold, and deleted when you delete them or your account. They are used to show you your own diary and, only if you turn on "Use my diary for recommendations" and confirm, to build the on-device taste summary described under "AI picker" above; the raw fields themselves are never sent. You can use the diary without filling them in.
AI picker ("Ask rosinplug")
The AI picker is for signed-in accounts (21+). You type what you are after; the picker looks through the current menu data on this site and suggests products, with reasons and links.
| What is sent when you ask | Where |
|---|---|
| The text of your ask and the last 8 messages of the conversation, including the picker's earlier replies | Our server function on Supabase, then AI model providers routed through OpenRouter |
| The market you are viewing, and, only if you choose one, a place name or your approximate location (coordinates rounded to roughly 100 meters; your browser asks first, and nothing is sent until you click "Use my location") | Same |
| A taste summary, only while "Use my diary for recommendations" is on (see below) | Same |
We do not send your email, username, user id, or any diary entry, note, review, dose, date, store or product list to the AI. The conversation is kept in your browser tab's memory only and is gone when you close or reload the tab.
Zero retention, no training. We have configured our OpenRouter account to use only model providers that keep no copy of prompts (zero data retention) and do not train on them. OpenRouter may keep basic request metadata, such as timing and size, to run its service. Our function's logs hold token counts and timing, not your ask or the answer.
What we store: per account and day, the number of asks and the token counts, plus your two settings below. We do not store the text of your asks or the answers. All of it is deleted with your account.
Daily limit: currently 20 asks per account per day (the day resets at midnight UTC). We may change the limit.
AI answers can be wrong. They are not medical advice. Suggestions are built from menu data that can be out of date and from strain information that reviewers reported; confirm prices and stock with the dispensary, and ask a medical professional about health questions.
Toggle 1: use my diary for recommendations (consumer health data consent)
This is off until you turn it on, and turning it on takes an explicit confirmation. When it is on, your device builds a taste summary from your diary ratings and the effect and side-effect tags you applied: numbers such as "relaxed +0.4, limonene +0.2" and a count of entries used. Only that summary is sent with each ask. It is never your notes, reviews, doses, dates, stores or product list. The summary is used to rank suggestions toward what you have liked, and is not stored by us.
Effect tags can be consumer health data under laws such as Washington's My Health My Data Act. By confirming, you consent to us collecting this summary from your diary on your device and sharing it with our AI processors (OpenRouter and the model providers it routes to) for the sole purpose of answering your asks. We do not sell it. You can withdraw your consent any time in AI settings (your @username menu, or the settings button on the picker page); the summary stops being sent immediately. While it is off, the picker does not receive any diary information. You can also email support@rosinplug.me to ask for deletion of your account and its stored settings.
Toggle 2: help improve recommendations for everyone
This is off by default. It only records your choice, and nothing is collected or used for it yet. It is meant for future community recommendations. Before we use any data for that, we will update this policy and tell signed-in users in the app.
Cookies and local storage
rosinplug.me does not set any cookies. It stores the following in your browser's local storage, all of it needed to make features you use work, and none of it used for tracking or advertising:
| Key | What it holds | When |
|---|---|---|
rosinplug_market | Your selected market | When you pick a market |
rosinplug_service_area | The service-area polygon you drew on the map | When you draw one |
rosinplug_diary_v1, rosinplug_diary_v1_pre_upload_backup, rosinplug_diary_v1_unreadable_backup | Your diary on this device, and safety copies made before uploading it to an account or if it can't be read | When you use the diary |
rosinplug_diary_last_export | When you last exported your diary, for the backup reminder | When you export |
rosinplug_diary_upload_dismissed_* | That you dismissed the "upload this device's diary" prompt | When you dismiss it |
rosinplug_ai_consent_prompted | That you have already been shown the "use my diary for recommendations" explanation, so it isn't repeated. It does not record your answer | When you first open the AI picker |
sb-…-auth-token | Your Supabase sign-in session (access and refresh tokens) | While signed in; removed when you sign out |
ph_…_posthog | An anonymous id for our product analytics (PostHog); see "Product analytics" below | While analytics is active |
Because nothing non-essential is stored, there is no cookie banner. You can clear all of this at any time in your browser's site settings.
Product analytics
We use PostHog to see which pages and features people actually use, so we know what's worth improving. We don't enable session or screen recording, and we don't use cookies for it (it's stored in local storage like the items above).
| What | Why | Who can see it |
|---|---|---|
| Pages you view and buttons or links you click, your browser, device type, and your approximate location from your IP address, like any website you visit | Seeing which features are used | Only us |
| For a few specific actions (wishlist, lists, follow, block, toast, comment, AI picker asks, sign-in), an event naming the action plus minimal context such as market or category | Seeing which features are used | Only us |
| If you're signed in, your account id (the same one used elsewhere in the app), so your activity can be grouped across visits | Seeing how the same account uses the site over time | Only us |
We never send your email, username, diary entries, notes, reviews, or AI picker questions to PostHog. It isn't used for ads, and we don't sell or share it.
Error tracking
We use Sentry to catch crashes and bugs. When the app errors, it sends the error message, a stack trace, and your browser and OS. We configure Sentry not to infer your location from your IP address or collect local variable values from the stack trace, and we don't attach diary entries, notes, reviews, AI picker questions, or sign-in tokens to error reports.
Service providers
We use a small number of providers to run the site. They process data only to provide their service:
- Supabase: account sign-in, database and the server function that handles AI asks (United States). Your browser contacts it only when you sign in or are signed in.
- OpenRouter and the AI model providers it routes to: process AI picker asks, only when you send one, under zero data retention and no training (see "AI picker"). Your browser never contacts them directly.
- Google: sign-in, only if you choose "Continue with Google"; you are then sent to Google's sign-in page.
- Resend: sends sign-in emails and, if you add anything to your wishlist, price-drop emails for those items. We send only these transactional emails, never marketing. Your browser never contacts it.
- GitHub Pages: hosts the website, so it sees your IP address when you load a page. Fonts and scripts come from rosinplug.me itself.
- PostHog: product analytics (see "Product analytics"). Your browser contacts it when you use the site.
- Sentry: error tracking (see "Error tracking"). Your browser contacts it only when the app errors.
- OpenStreetMap: map tiles, loaded only when you open the service-area map.
Open-source notices are on the licenses page.
We don't sell or rent personal information, and we don't share it for advertising.
Legal requests
Cannabis remains illegal under U.S. federal law. We will only disclose account data when legally compelled to do so. Where the law allows, we will tell the affected user before disclosing. We keep as little as we can: there are no access logs of our own beyond what our providers keep to operate their services.
Keeping and deleting your data
Your data stays until you delete it. You can delete any entry or product from your diary at any time. To delete your account and everything in it, open the account menu (your @username at the top of the page), choose "Delete account" and type your username to confirm. This immediately and permanently deletes your profile, products, entries and private notes from our database. You can tick "keep a copy on this device" to keep the diary stored in your browser; otherwise that is erased too. If you can't use the button, email support@rosinplug.me from the address you signed in with and we'll delete it within 30 days and confirm. A local, signed-out diary is removed by clearing your browser's site data.
You can also export your diary as a file at any time from the Diary page.
Your rights
Depending on where you live (for example California or Washington), you may have the right to know what we hold about you, get a copy, correct it, delete it, and withdraw consent. Email support@rosinplug.me. We won't treat you differently for using these rights.
Age
The site is for adults 21 and older. We don't knowingly collect data from anyone younger. If you believe a minor has an account, tell us and we will delete it.
Changes
If we change this policy in a way that affects what's public or how your data is used, we'll update the date above and tell signed-in users in the app before the change applies.