Your library.
Your information.

1. About Highly

Highly is an independent Ontario cannabis discovery and review service for adults 19+. It does not sell cannabis, provide medical recommendations, sell personal information, use third-party advertising networks, or provide sponsored rankings.

This policy covers the Highly app and this launch website. Browsing the catalogue does not require a community account. Account and community features use a cloud backend; not all app information stays only on your device.

2. Your local device library

Highly uses a local SQLite database for its catalogue and device library. Your Tried, Favourite and Want to Try lists, local reviews, product photos, and taste/preferences derived from your activity support tracking and recommendations on your device.

Local photos and personal backups remain on your device or wherever you save a backup until you remove them. Signing out or deleting a cloud account does not erase independent device copies or backups.

Publishing a review/photo or explicitly linking/importing your device library sends the selected information to the cloud. Library import is a deliberate copy operation; it is not automatic two-way sync or a promise of cross-device restoration. Private tracking is not a public community rating.

3. Account & community information

If you create an account, we process your email address, password through Supabase Auth, chosen display name, account identifiers, and adult/guideline acknowledgement. We do not require your real name, birth date, phone number or address.

Public reviews and photos display your chosen name, contribution and contribution/account identifiers. Product and rotation associations help show which release you tried. Do not publish sensitive personal information or photos you do not have the right to share.

When you explicitly link/import your library, private cloud records can include tracking, recent activity and local contributions selected for import. These private records are separate from public reviews and ratings.

We also process reports, block relationships, rotation suggestions and moderation records to enforce community rules. Authorized moderators can inspect eligible content and reports; report details and block relationships are not a public directory.

4. Why information is used

Information supports account access, verification and recovery; your library and taste insights; publishing and displaying community contributions; product/rotation corrections; support; and abuse prevention and moderation. Technical information such as request/security logs, network information and authentication events can be processed to operate, troubleshoot and protect the service.

5. Service providers & storage

Supabase provides authentication, the community database, private imported library records and private photo storage. Photo files are not held in an unrestricted public bucket: access is authorized by the backend. Photos you choose to publish can be viewed through the service subject to visibility, blocking and moderation rules.

Resend delivers automated account verification and password recovery emails. Apple provides iPhone, TestFlight and App Store platform services; Apple’s own privacy terms apply to information it processes.

The current founder backend is hosted in the United States (US East). Information may be processed outside Ontario and Canada by these providers. Provider backups and technical logs follow the applicable provider settings and retention practices.

This static website has no analytics, tracking scripts, forms or cookies that it requires to work. The hosting provider may process ordinary web requests and security logs to deliver and protect the site. Emailing us sends the information you include through email providers.

6. Retention & account deletion

Account and contribution information is retained only as long as reasonably necessary to provide the service and address safety/support matters. You can edit or delete eligible public contributions and request cloud account deletion in the app’s Account screen. Account deletion requires password confirmation.

Deletion first hides account content, removes uploaded files, then deletes account-linked data, including private imported library copies and blocks. Interrupted deletion may require a retry or maintenance. It does not erase your independent iPhone library or backups.

Approved rotation facts may remain in the canonical catalogue after personal attribution is removed. Minimal de-identified moderation outcomes and record identifiers may remain for safety and to prevent removed content from reappearing.

Removed content and resolved reports are subject to maintenance cleanup. Moderation and security records may be retained where reasonably necessary to protect the community, investigate abuse or meet applicable obligations. Cleanup can require retries or maintenance processing; no fixed completion period is guaranteed. Provider backups and security logs have separate retention and may not be immediately erased.

7. Safeguards

Highly uses authenticated access, server-side ownership checks, row-level database security, restricted moderation access and private photo storage. These measures reduce unauthorized access; no storage or transmission system can guarantee absolute security. Never send your password, verification code or recovery code to support.

8. Your choices

You can browse without a community account, choose whether to publish, manage local copies and backups, block contributors, report content, and request account deletion. You can manage photo/camera permission in iPhone Settings. Requests for access, correction or deletion can also be sent to our privacy contact; we may need to verify ownership before acting.

Highly is intended only for adults 19+. If you believe an underage person has provided account information, contact us. We may update this policy as the service changes and will update the date above.