What we collect, and what we don't

Waitlist signups

If you submit the waitlist form, we store the email address you enter, plus the business name, license type and notes if you choose to provide them. We use this only to contact you about the service you signed up for. We do not sell it, share it, or send unrelated marketing.

Recommendations you send us

If you use the recommendations form, we store what you wrote, the category you picked, the page you were on when you wrote it, and your email address if you chose to leave one. If you happen to be signed in, your account is recorded alongside it so we can follow up. Your note is what you typed — the analyzer attaches nothing to it, and your inventory file is not included.

A hashed form of your IP address

When you submit a form or use the assistant, we store a salted one-way hash of your IP address — never the address itself. It exists to rate-limit abuse. It cannot be reversed back into an IP.

A notification that someone visited

We run this site ourselves and want to know when it's being used, so the first page you open in a browsing session sends a short message to a private team chat channel: the page path, the city and state our host reports for your connection, whether you're on mobile or desktop, and the website that linked you here if any. It does not include your IP address, your name, your email, or anything from the analyzer — and it fires once per session, not once per page.

Page views

We use Vercel Web Analytics, which is served from this domain rather than a third-party tracker. It records page views and referrers. It sets no cookies, does not follow you across other websites, and never receives anything from the analyzer.

Ask about the migration

The question you type is sent to our server, which forwards it to Anthropic's Claude API to generate an answer. That means the text of your question leaves your browser — so do not paste inventory records, license numbers, or anything confidential into it. The assistant has no access to your uploaded files and never will. Conversations are not stored on our servers.

Explain my findings

This is opt-in and off by default. When you use it, we send aggregate counts only — how many findings of each type and severity, your license type, and your score. No batch or tag numbers, no strain or product names, no quantities, no room names, no facility name. The page shows you the exact payload before you send it, and our server rejects any request containing more than that.

How the data we hold is protected

Waitlist entries, recommendations and saved summaries live in a Postgres database with row-level security enabled and no public access policies — they are unreachable except through our own server-side code. Secrets are held as environment variables on the server and are never sent to the browser. The site is served over HTTPS only, with HSTS.

Removing your data

Ask and we will delete your waitlist entry or a recommendation you sent. Email the address on your signup confirmation, or reach us through the contact route you used.