Privacy Policy

Last updated: June 24, 2026

This Privacy Notice for Hashery LLC ("we," "us," or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services") including when you:

• Visit our website at hasherynj.com or any website of ours that links to this Privacy Notice
• Download, install, or use the Hashery iOS or Android mobile application (each, the "App") from the Apple App Store or Google Play
• Use Hashery's online platform offering a curated selection of cannabis products for adult use (21+) including flower, edibles, concentrates, vaporizers, and accessories
• Engage with us in other related ways, including any sales, marketing, or events

Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Questions or concerns? Contact us at info@hasherynj.com.

Summary of Key Points

• What personal information do we process? We may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
• Do we process sensitive personal information? No, we do not process biometric, health, or other sensitive information beyond age verification (which is required by NJ law for cannabis sales).
• Do we collect information from third parties? Limited cases — we receive order and loyalty data from Dutchie (our checkout/POS provider) and Alpine IQ (our loyalty program).
• How do we process your information? To deliver your orders, run our loyalty program, comply with NJ Cannabis Regulatory Commission requirements, communicate with you, and improve our Services.
• With whom do we share information? Only with service providers strictly necessary to operate the business (see list below) and with regulators when required by law.
• What are your rights? Depending on your state, you may have rights to access, correct, or delete your data. Contact us at info@hasherynj.com.

What Information We Collect

We collect personal information you voluntarily provide when you express interest in our products, participate in activities on the Site, or contact us. This includes:

• Names
• Phone numbers
• Email addresses
• Mailing and delivery addresses
• Date of birth (for legally required age verification)
• Government-issued ID (presented at checkout/delivery; we do not store ID images beyond the verification event)
• Payment information (handled by Dutchie; we do not store card numbers)
• Communication preferences

We also automatically collect:

• IP address
• Browser and device information
• Operating system and language settings
• Referrer URLs
• Approximate location (city-level) and usage data

We collect this to ensure security, improve performance, and support analytics.

Additional information collected by the Hashery mobile App

When you use the iOS or Android App we may additionally collect, with your permission:

• Approximate device location — used solely to confirm you are physically located in New Jersey, as required by NJ Cannabis Regulatory Commission rules and Apple App Store / Google Play policies. We do not store your coordinates beyond the verification check, and you can revoke this permission at any time in your device's system settings.
• Push notification device token — an Apple Push Notification Service (APNs) token on iOS or a Firebase Cloud Messaging (FCM) token on Android, used to deliver order updates, HASH CASH milestones, and (with your opt-in) marketing messages. You can disable notifications in the device's system settings or from within the App at Profile → Notifications.
• Device diagnostics — crash logs, performance traces, and similar diagnostics so we can fix bugs and improve the App. We use the same Sentry pipeline as the website with PII fields stripped before transmission.
• App usage events — page views and tap events within the App so we can measure feature engagement. We do not link this data to any third-party advertising identifier; the App's privacy nutrition label in the App Store reflects this (no "Tracking" category).

The App never collects: biometric data (Face ID / Touch ID happens entirely on-device and is never transmitted to us), contacts, photos, microphone, camera, calendar, or health data.

Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Ensure the website functions properly (essential cookies)
• Analyze traffic and site usage (Google Analytics 4)
• Remember your age verification, location selection, and cart contents

You can control cookies through your browser settings. By continuing to use our site, you consent to our use of cookies as described in this policy.

We also set two first-party measurement cookies to understand how our own website and advertising perform. They contain no name, email, or account information:

• hsh_ssn — a random, anonymous session identifier (no identity attached), stored hashed on our side and kept up to 180 days, used to measure on-site engagement such as add-to-cart.
• hsh_src — the campaign tags (for example utm_source) from the link you arrived through, so we can measure which of our campaigns brought you to the site.

We use these only for our own first-party measurement and to report aggregate, de-identified results (such as total orders or revenue by campaign or brand) to the brands we feature. We do not sell them and do not use them for third-party cross-context behavioral advertising.

Third-Party Service Providers

We share data only with providers strictly necessary to operate the business:

• Dutchie — checkout, payments, order management, age verification, and POS
• Alpine IQ — HASH CASH loyalty program, member identification, and opt-in marketing communications
• Onfleet — delivery dispatch and driver routing (we share name, address, and phone for active deliveries only)
• Resend — transactional email delivery (order confirmations, account magic links, deletion-request acknowledgments)
• Blackleaf - cannabis-compliant text messaging used to deliver transactional order and delivery status updates and one-time login codes; we share the recipient phone number and the message content only
• Apple Push Notification Service (APNs) — iOS push delivery only; we never share your identity with Apple, just the encrypted notification payload addressed by your device token
• Firebase Cloud Messaging (FCM, Google) — Android push delivery, same shape as APNs (token-addressed payloads only)
• Google — Analytics 4 on the website only (anonymized analytics; the App does not include GA4 or any third-party tracking SDK), Google Business Profile (reviews), and Maps embeds
• Microsoft Clarity - privacy-friendly website analytics (heatmaps, aggregate session replay, and page-level metrics) used only to improve the site; web only, not in the App; Clarity masks text and inputs by default and we do not use it for advertising
• Vercel — website + API hosting infrastructure (receives standard server logs)
• Sentry — error monitoring for both the website and the App (we strip personally identifiable fields before transmission)
• Supabase — database hosting (US region)
• Anthropic — powers the AI Budtender assistant. Your typed questions are sent to Anthropic's API to generate a reply; Anthropic does not train its models on this data and does not retain it for its own purposes under our API terms
• OpenAI — generates the search index that matches your AI Budtender question to products on our menu (your text is sent to create a numeric search vector; not used to train models under our API terms)
• NJ Cannabis Regulatory Commission and METRC — sales records as required by N.J.A.C. 17:30 (cannabis track-and-trace)
• Slack: internal staff notifications. When you submit a contact, careers, loyalty-signup, feedback, or kiosk-help form, its contents (which can include your name, email, phone, and message) are posted to our private staff workspace so a team member can respond
• Google Tag Manager: loads and manages our website analytics and Google Ads conversion measurement (it orchestrates Google Analytics 4 and Ads conversion tags); it does not build cross-site advertising audiences
• Vercel Analytics & Speed Insights: privacy-friendly, aggregate website traffic and performance metrics (page views and Web Vitals), with no cross-site identifiers
• Embedded content and maps: some pages embed third-party content that loads from its own servers and therefore receives your IP address and browser type. This includes map tiles (OpenStreetMap / CartoDB) on delivery tracking, video players (YouTube in privacy-enhanced mode, Vimeo), QR-code images (api.qrserver.com, used for referral links), and profile-avatar images (Gravatar / Google)
• Apple Wallet (PassKit): when you add your HASH CASH pass to Apple Wallet, the pass encodes your member email so the in-store scanner can identify your account

We do not sell personal information. We do not participate in cross-context behavioral advertising. The App does not include any third-party advertising or tracking SDK.

How We Use Your Information

We process your information to:

• Process and deliver your orders
• Run the HASH CASH loyalty program
• Comply with New Jersey cannabis regulations (age verification, sales reporting, METRC)
• Communicate with you about orders, account changes, and (with your opt-in) marketing
• Identify usage trends and improve our Services
• Measure how our own website and advertising campaigns perform, and report aggregate, de-identified results to the brands we feature
• Detect and prevent fraud or abuse

AI Budtender

The AI Budtender is an optional chat assistant that answers product questions using our live menu. To use it on our website or app you must be signed in to a Hashery account and be 21 or older; on our in-store kiosk it runs as a staff-assisted demo without a personal login. Because it is an automated communication about cannabis products, we keep an auditable record:

• What we save. Your questions, the assistant's replies, the date, and the account they belong to. We save these to your account so you can review your own history under My Account → Budtender chats.
• Why. Quality, accuracy, safety, and compliance with New Jersey cannabis advertising rules (N.J.A.C. 17:30). Staff may review conversations for those purposes.
• Not medical advice. The assistant provides product information only and declines medical questions. It has no internet access and only references products on our menu.
• We never sell these conversations and do not use them for cross-context behavioral advertising.
• Retention. Budtender conversations are retained for up to two years for compliance, then deleted or anonymized. If you delete your account, we remove your identity from these records (the conversation text may be kept in anonymized form as a compliance audit record).

Text Messages (SMS)

If you provide your mobile number (at checkout, in your HASH CASH account, or when you sign in by phone), we may send you transactional service texts: order and delivery status updates and one-time login codes. These are service messages, not marketing. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help; if you opt out we will continue to reach you by email where possible. Marketing or promotional texts, where offered, require your separate opt-in and are handled through our loyalty provider. Transactional texts are delivered through Blackleaf, a cannabis-compliant messaging provider; we share only your phone number and the message content needed to deliver them.

How We Protect Your Information

We use industry-standard safeguards to protect your data: encryption in transit (HTTPS) and at rest, role-based access controls so only authorized staff can reach personal data, hashed or tokenized identifiers in our analytics, and reputable processors (listed above) bound by data-protection terms. No method of transmission or storage is completely secure, but we work to protect your information and, where a breach affecting your personal data occurs, we will notify you and the appropriate authorities as required by law.

How Long We Keep Your Information

We retain personal data only as long as necessary for the purposes described above, unless a longer period is required by law. In summary:

• Transaction and sales records: retained for at least four years, as required by New Jersey cannabis retailer recordkeeping rules (N.J.A.C. 17:30-14.5).
• Account, loyalty (HASH CASH), and order history: kept while your account is active and removed on account deletion, subject to the transaction-record requirement above.
• AI Budtender conversations: up to two years for compliance, then deleted or anonymized.
• Analytics and first-party measurement cookies: up to 180 days.
• Push notification tokens: until you disable notifications or delete the app.

When data is no longer needed, it is deleted, anonymized, or securely stored until deletion is possible.

Information from Minors

Our Services are intended for adults aged 21 and older. We do not knowingly collect, market to, or sell to anyone under 21. If you become aware that someone under 21 has provided us with personal information, please contact us at info@hasherynj.com and we will delete it.

Your Privacy Rights

Depending on your state of residence, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements above)
• Opt out of marketing communications at any time
• Opt out of non-essential analytics and measurement on our website (we also honor your browser's Global Privacy Control signal automatically): see Your Privacy Choices
• Withdraw consent for processing not required by law

To exercise any of these rights, contact us at:

• Email: privacy@hasherynj.com
• Phone: +1 (201) 606-0002 (local) or 877-HASHERY / 877-427-4379 (toll-free)
• Web: /contact-us/

To request deletion of your account, your HASH CASH balance, your order history, and your saved items, visit hasherynj.com/account/delete/ at any time. The same path is reachable from inside the Hashery mobile App at Profile → Delete my account. Requests are confirmed within 5 business days and completed within 30 days.

We will respond within 30 days. If we cannot verify your identity, we may ask for additional information limited to what we need to confirm who you are.

Authorized agents. You may use an authorized agent to submit a privacy request on your behalf. The agent must provide written, signed permission from you, and we may still ask you to verify your own identity directly with us before we act on the request.

Right to appeal. If we deny a request, you may appeal that decision by replying to our response or contacting us again at the address above within 60 days. We will explain the reason for any denial and, where required by your state's privacy law, inform you how to contact your state's attorney general if you remain dissatisfied with our final decision.

Mobile App Privacy (Apple Privacy Nutrition Label and Google Data Safety)

The Hashery iOS App's Privacy Nutrition Label on the App Store (and, where the Android app is available, its Data Safety form on Google Play) describes the data we collect, link to you, and use, aligned with this Privacy Notice. In summary:

• Data linked to you: contact info (email, phone, name), user identifier (your Alpine IQ contact id), approximate location (NJ geo-gate only), purchase history (your orders and HASH CASH activity), product interactions inside the App, and the push notification token for your device.
• Data not linked to you: crash logs and performance traces (Sentry, with PII scrubbed before send).
• Tracking: none. The App does not use any third-party advertising identifier and does not share data for cross-context behavioral advertising.

If the in-store privacy labels appear to differ from the description above, this Privacy Notice is the authoritative document.

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act. The categories of personal information we collect, in CCPA terms:

• A. Identifiers (name, address, phone, email): Yes
• D. Commercial Information (purchase history, payment metadata): Yes
• F. Internet Activity (browsing on hasherynj.com): Yes
• G. Geolocation Data (city-level only): Yes
• K. Inferences (loyalty preferences): Yes
• All other CCPA categories (biometric, sensitive PI, education, employment, sensory): No

We do not sell personal information. We do not use personal information for cross-context behavioral advertising. To exercise CCPA rights, contact us at info@hasherynj.com.

Other State Privacy Laws

If you reside in a state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, Texas), you may have similar rights to access, correct, delete, and opt out of certain processing. Use the contact information above to exercise these rights.

Specific state-level rights you may also have:

• California: right to limit the use and disclosure of sensitive personal information; right to know the specific third parties with whom we have shared your data.
• Minnesota: right to question and obtain an explanation of any profiling that produces legal or similarly significant effects.
• Florida: right to opt out of the collection of personal data through voice or facial recognition technologies.
• Delaware, Maryland, Oregon: right to access the categories of personal data we hold and the specific third parties with whom we have shared it.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. The "Last updated" date at the top reflects the most recent change. Continued use after changes are posted constitutes acceptance.

Contact Us

If you have questions or concerns about this Privacy Notice or your data:

Hashery LLC
409 NJ-17
Hackensack, NJ 07601
Email: info@hasherynj.com
Phone: +1 (201) 606-0002 (local) · 877-HASHERY / 877-427-4379 (toll-free)