Privacy Policy

Introduction

John Egan, an individual doing business as High AI Labs operates the website thisiswhyimhigh.com (the "Website"), the High IQ iOS application (the "App"), and the High IQ web app at app.highiq.app (the "Web App") under the name This Is Why I'm High ("we," "us," or "our"). We are committed to protecting your privacy and being transparent about how we collect, use, and protect your information.

This Privacy Policy explains:

• What information we collect and why
• How we use and share your information
• Your privacy rights and choices
• How we protect your data
• How to contact us with questions

This Privacy Policy applies to the Website (thisiswhyimhigh.com), the iOS App, and the High IQ web app at app.highiq.app. Where practices differ, we specify which service is affected.

🔞 Age Requirement

Our services are intended for adults 21 years of age or older. We do not knowingly collect information from anyone under 21.

1. Information We Collect

1.1 Website (thisiswhyimhigh.com)

The Website is a public cannabis strain encyclopedia. We collect minimal information:

Automatically Collected Information:

• Device type and browser information
• IP address and general location (city/state level)
• Pages visited and time spent
• Referral source
• Cookie identifiers (see Cookie Policy below)

Optional Information:

• Email address if you subscribe to our newsletter
• Feedback or questions you submit via contact forms

We do NOT require account creation or collect personal data to browse strain information.

1.2 High IQ App

The App is a personal cannabis research tool that requires an account. We collect:

Account Information (via Clerk):

Clerk manages authentication for High IQ. The App Store build offers Sign in with Apple and Sign in with Google. The Website does not have account sign-in. Newsletter and contact-form emails are covered in Section 1.1.

• Your email address, provided by you or your sign-in provider, including an Apple private relay address if you choose to hide your real address
• Your name, if your provider shares it
• An account identifier that links your sign-in to your High IQ account
• Session records, managed by Clerk, our authentication provider

Subscription Information (via Apple and RevenueCat):

• Your Pro entitlement status and its renewal or expiration date
• The subscription product you bought, and purchase, renewal, restore, and cancellation events

Apple processes the payment. We never see or store your card details. Section 5 covers this in full.

Cannabis Research Data:

• Purchase receipts you upload (processed via AI)
• Dispensary information
• Cannabis strain purchases and consumption data
• Personal stash inventory
• Consumption patterns and preferences
• Favorites and ratings
• Notes and personal insights

Usage Information:

• App features used and interaction patterns
• Device information (type, OS version, app version)
• Session data and timestamps
• Error logs and crash reports (via Sentry)

Crash and diagnostic reports go to Sentry. We configure Sentry so it does not attach default personal data: it does not infer your IP address and it does not attach cookies or profile context. A report carries the error, a stack trace, the app and device version, and a pseudonymous identifier that lets us tell one person's repeated crash from many people's single crashes. Every event passes through a sanitizer on your device before it is sent.

Product Analytics (via PostHog):

High IQ uses PostHog to understand how people use the App. An event records an action, such as a screen you open, a feature you use, or a save or purchase that completes. An event carries your account identifier, the app and device version, the strain or record identifiers involved, and counts or amounts where the feature needs them. AI features also record the model, the token counts and the cost of each request, never the prompt or the reply. Events never include what you type, your photos, receipt images, your name or your email address. PostHog receives your IP address and uses it to estimate a general location (city or region). We do not record your screen or sessions. Product analytics is on by default. To turn it off, open Settings, then Privacy, and turn off Share usage analytics. Your device then stops sending events at once and, when you are signed in, our servers also stop sending events for your account. Deleting your account also deletes your PostHog profile and its events.

Gmail Data (only if you connect Gmail):

• Dispensary receipt details extracted from matching messages. Section 7 covers what we read, what we keep, and how to disconnect

AI-Generated Content:

• Personalized reports and insights we generate for you
• Recommendations based on your preferences
• Receipt parsing results

2. How We Use Your Information

2.1 Website

We use Website information to:

• Provide and improve strain encyclopedia content
• Understand which strains and information are most valuable
• Optimize website performance and user experience
• Send occasional newsletters (if you opt in)
• Respond to your inquiries

2.2 High IQ App

We use App information for:

Core Service Delivery:

• Authenticate your account and maintain secure access
• Store and organize your cannabis purchase and consumption data
• Parse receipts and extract strain information
• Generate personalized insights and reports
• Provide strain recommendations based on your preferences
• Track your stash inventory and consumption patterns
• Predict restock timing and cost optimization opportunities

Service Improvement:

• Analyze usage patterns to improve app features
• Debug errors and crashes to ensure reliability
• Develop new features based on user needs

Communication:

• Send important service updates and security alerts
• Notify you about new features (if you opt in)
• Respond to support requests

Automated Decision-Making:

We use automated decision-making technology (AI) to:

• Parse receipt images and extract product information (product names, prices, quantities)
• Generate personalized strain recommendations based on your stated preferences
• Create consumption insights and reports from data you provide

These automated processes:

• Help improve your experience
• Do NOT make decisions that produce legal or similarly significant effects on you
• Do NOT profile you for advertising or marketing purposes
• Do NOT share your data with third parties for their own purposes

The data we collect is limited to what you voluntarily provide (receipts you upload, preferences you set, consumption you log). We do not collect data from external sources or purchase consumer data.

🔒 We Do NOT:

• Sell your personal information to third parties
• Share your cannabis consumption data with employers, insurers, or law enforcement (except as legally required)
• Use your data for advertising purposes
• Share your data with cannabis retailers or dispensaries

3. How We Share Your Information

3.1 Third-Party Service Providers

We work with trusted service providers who help us operate our services. These providers are contractually required to protect your data and use it only for specified purposes:

3.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice before your information becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal process (subpoena, court order)
• Lawful requests by public authorities
• Protection of our rights, privacy, safety, or property
• Emergency situations involving danger of death or serious physical injury

We will notify you of legal requests unless prohibited by law.

3.4 Aggregated or De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you. For example: "30% of users prefer indica strains" or "Average stash size is 5 products."

4. Data Security

We take data security seriously and implement industry-standard security measures:

Technical Safeguards:

• Encryption in transit (TLS/SSL for all connections)
• Encryption at rest (database encryption)
• Secure authentication via Clerk, using the sign-in options described in Section 1.2
• Regular security audits and updates
• Access controls and logging

Organizational Safeguards:

• Limited employee access to personal data (solo founder operation)
• Service provider agreements requiring data protection
• Regular review of security practices
• Incident response procedures

App-Specific Security:

• Local app preferences may be stored on your device. The web app uses browser localStorage, which is not application-level encrypted storage
• Session management and automatic logout
• Secure API communications

While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security, but we promptly address any identified vulnerabilities and will notify you of any data breach as required by law.

5. Subscriptions and Purchases

High IQ Pro is a paid subscription. You buy it through Apple's In-App Purchase system, and we manage entitlements with RevenueCat.

5.1 What Apple Handles

• Apple processes the payment and holds your payment method. We never see or store your card number, billing address, or Apple ID password
• Apple manages renewals, cancellations, and refunds. Payment is charged to your Apple ID at confirmation. The subscription renews unless you cancel at least 24 hours before the end of the current period. Manage or cancel it in your Apple ID settings. Refunds follow Apple's policies at reportaproblem.apple.com
• Apple gives us aggregated sales and subscription reports through App Store Connect

5.2 What RevenueCat Receives

RevenueCat is our subscription infrastructure provider. It receives:

• An app user identifier that we generate and map to your High IQ account
• Your email address and the name on your account, so that we can find your subscription when you contact support
• A few facts about your account that help us support you: whether you signed in with Apple or Google, the date you created your account, the invite wave you joined through, and which version of the App you use
• The Apple receipt for your purchase, which Apple issues and validates
• Product identifiers, purchase and expiration dates, and renewal, restore, or cancellation events
• Device and platform information such as app version, operating system version, and country

RevenueCat returns the resulting entitlement state, which tells the App whether your Pro access is active. RevenueCat processes this information on our behalf and does not use it for advertising. RevenueCat does not receive your stash, orders, receipts, or notebooks, or anything else about what you consume.

5.3 What We Store

• Your entitlement status: active, expired, or in a billing grace period
• The product you bought and its renewal or expiration date
• Purchase and restore events, so support can resolve access problems

We keep a copy of your subscription status with your account record at Clerk, our authentication provider: whether you have Pro, your plan, when it ends or renews, and whether a payment failed. It lets us see your account and your subscription in one place when you contact support. It is stored where only we can read it, and the App does not use it to decide your access.

The same purchase terms are in the Terms of Use, under Subscriptions, Auto-Renewal and Refunds. Prices are shown in the App at purchase. There is no free trial. Cancel at any time in your Apple account settings. Cancellation takes effect at the end of the period you already paid for.

6. AI Processing of Your Content

Several High IQ features use language and vision models to turn what you log into something readable: receipt parsing, label scanning, strain insights, and notebooks. To do that, we send your content to a model provider and get a result back.

6.1 What We Send

Each feature sends only the content that feature needs:

• Receipt parsing: the receipt image or receipt text you supply
• Gmail receipt import: candidate sender, subject and preview text for classification, and selected message content for receipt extraction
• Label scanner: selected product-label photos, the original video you choose for video scanning, and selected still views extracted from that video
• Notebooks and insights: your stash, order, and consumption records, plus public strain research from our own database
• Chat and search features: the text of your request

The content needed for these features can contain names, email addresses or other identifying information, including information present in a receipt or email preview.

6.2 Which Providers

AI processing uses the Vercel AI Gateway and direct Google Gemini requests. Product-label video discovery sends the original selected video directly to Google’s Gemini Files API; selected label views are also verified through direct Gemini requests. The providers we use today are Anthropic (Claude), OpenAI, Google (Gemini), and TypeSafe AI. If we add a provider, we will update this section.

TypeSafe AI is used differently from the others. Its model does not write anything: it answers yes or no questions about a piece of text and returns a probability. We use it for small decisions around the larger models: whether something is worth sending to one at all (for example, whether an email looks like a dispensary receipt), whether a product name on a receipt or a menu is a strain we already know, and how well a menu item fits the preferences you have saved. Where a short explanation appears alongside one of those decisions, we wrote that wording ourselves. It receives the same text the larger model would have received, and nothing more.

6.3 Training

🔒 Your content is not training data

We use these providers under their commercial API terms, which state that content submitted through the API is not used to train their models. We do not train models on your data ourselves, and we do not sell or license your content to anyone for that purpose.

6.4 Retention at the Provider

Providers may hold API requests for a limited period to monitor abuse, as their own terms describe. The output we generate for you, such as a notebook or a parsed receipt, is stored with the rest of your account data and follows the retention rules in Section 8.

6.5 Human Review

We do not read your content as a matter of routine. We look at a specific record only when you ask us to, for example when you report a parsing error, or when we must investigate abuse or a security incident.

7. Gmail Access (Optional)

High IQ can import dispensary receipts from your Gmail inbox so you do not have to photograph them. This feature is off by default. It never runs unless you connect your Google account and grant access yourself, and you can revoke that access at any time.

7.1 What We Request

• One scope: https://www.googleapis.com/auth/gmail.readonly
• That scope is read-only. We cannot send, delete, or modify mail, and we cannot change any Google account setting

7.2 What We Read

We use the shops or senders and date range you select to search for receipt and order candidates. Discovery reads candidate sender, subject and preview information; some candidates may not be receipts. Selected messages are processed to extract dispensary and order details for your review:

• Dispensary name and order date
• Product names, quantities, prices, and totals
• Order and confirmation numbers

We do not use Gmail data for advertising.

For the messages that do match, we hold the sender, the subject line, and Gmail's short preview snippet alongside the import job, so you can review what we matched before you accept it. A daily job purges that metadata within seven days of the import finishing. The orders you accept stay as ordinary order records, without the email metadata.

🔒 Google API Services Limited Use disclosure

High IQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail data only to provide the receipt import feature you turned on. We do not transfer Gmail data to others except as needed to provide that feature, to comply with applicable law, or as part of a merger or acquisition. We do not use Gmail data for advertising. We do not allow humans to read Gmail data except with your explicit consent for a support request, to investigate a security incident or abuse, or where the law requires it.

7.3 AI and Gmail Data

Candidate sender, subject and preview text can be sent through Vercel AI Gateway to the configured OpenAI classifier before you select full messages for extraction. If the optional TypeSafe filtering step is enabled, candidate metadata can also be sent to TypeSafe AI. Selected receipt content is processed by the configured receipt-parsing providers described in Section 6. These steps support the receipt import feature. It is not used to train any model.

The same Limited Use terms above apply: this is part of providing the import feature you turned on, the data is not used for advertising, and it is not used to train any model.

7.4 How to Disconnect

• In Gmail Import settings, select Disconnect to stop imports and revoke access. If revocation cannot be confirmed, the app asks you to retry. Disconnect cleanup removes temporary import data; saved orders remain until you delete them
• In your Google account, open third-party access settings and remove High IQ
• Receipts already imported stay in your account as ordinary order records. Delete them individually, or delete your account to remove everything

7.5 Availability and Consent

Everything in this section applies only if you connect Gmail. Gmail import is a High IQ Pro feature, it stays inactive until you grant the read-only scope on Google's own consent screen, and nothing is read before you do.

Gmail receipt import is an optional feature that is rolling out gradually and may not be available to all users yet. If you do not see it, nothing described in this section is happening to your mail. When it is available to you, you choose whether to connect it.

8. Data Retention

8.1 Website

• Analytics data: Retained for 26 months
• Newsletter subscribers: Until you unsubscribe
• Contact form submissions: Retained for 2 years

8.2 High IQ App

We keep your High IQ data until you delete it. History is what makes the App useful, so we do not expire your records on a timer.

While Your Account Exists:

• Account information: Retained until you delete your account
• Cannabis research data: Retained until you delete the record or delete your account
• Receipt images: Retained with the order they belong to, until you delete that order or your account
• Product label photos and videos: For video scanning, the original selected video is uploaded directly to Google's Gemini Files API for temporary analysis. We attempt to delete the provider copy after processing or cancellation and retry pending cleanup when the session is accessed. Google's Files API currently deletes uploaded files automatically after 48 hours. We do not retain the original media or extracted frames in Convex or Supabase. Optional copies remain on your device until you clear them or uninstall the App. Extracted label text, measurements and provenance are retained until you delete the record or your account. Selected still images are also sent for AI extraction; AI providers process those images under their published policies and our configured retention controls
• Notebooks and other AI output: Retained until you delete them or delete your account
• Subscription records: Retained while the subscription is active and afterward as required for tax and accounting
• Crash and error reports: Retained for 90 days by Sentry
• Product analytics events: Retained until you delete your account; deletion also deletes your PostHog profile and its events

We do not run an automatic inactivity purge today. If we add one, we will describe it here and tell account holders before it takes effect.

Deleting Your Account:

• Delete your account in the App: open Edit Profile, then Danger zone, then Permanently delete. You can disconnect Gmail first in Gmail Import settings, or in your Google account's third-party access settings. Deletion also asks Google to revoke Gmail access. If that revocation cannot be confirmed, follow the prompt in the App. If you cannot open the App, email hello@highailabs.com with "Account Deletion" in the subject
• Requesting deletion starts a background deletion workflow. Removal from live systems completes as that workflow processes the account's records
• Encrypted backups age out on their own schedule, within 30 days
• Aggregated or de-identified data that cannot reasonably identify you may be retained
• Records we must keep by law, such as transaction records, are retained for as long as the law requires

⚠️ Deleting your account does not cancel your subscription

Apple owns the billing relationship. Cancel High IQ Pro in your Apple account settings before or after you delete your account, or it will keep renewing.

9. Your Privacy Rights

You have the following rights regarding your personal information:

9.1 Access and Portability

• Right to Know: Request what personal information we have about you
• Right to Access: Obtain a copy of your personal information
• Right to Portability: Receive your data in a structured, machine-readable format by sending a Data Request to hello@highailabs.com

9.2 Correction and Deletion

• Right to Correct: Update inaccurate or incomplete information (available in App settings)
• Right to Delete: Request deletion of your personal information

9.3 Control and Consent

• Right to Opt-Out: Opt out of marketing communications, and turn off product analytics in Settings, then Privacy, then Share usage analytics
• Right to Withdraw Consent: Withdraw consent for data processing (where consent is the legal basis)
• Right to Limit Use: Request limitations on how we process sensitive data

9.4 Non-Discrimination

We will not discriminate against you for exercising your privacy rights. You will not receive different pricing or service levels for making privacy requests.

9.5 How to Exercise Your Rights

📱 Data Requests:

• Export your data: email hello@highailabs.com with "Data Request" in the subject
• Delete your account in the App: Edit Profile, then Danger zone, then Permanently delete. You can disconnect Gmail first. If you cannot open the App, email hello@highailabs.com with "Account Deletion" in the subject
• Include the email or phone number used for your High IQ account so we can verify the request

📧 By Email:

• Send requests to: hello@highailabs.com
• Include: Your name, email/phone used for account, specific request
• We will verify your identity and respond within 45 days

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

10.1 Categories of Personal Information Collected

10.2 Sale and Sharing of Personal Information

• Sale: We do NOT sell your personal information
• Sharing for Advertising: We do NOT share your personal information for targeted advertising
• Sensitive Personal Information: We do NOT use or disclose sensitive personal information beyond what is necessary to provide our services

10.2.1 Opt-Out Preference Signals

We honor opt-out preference signals such as the Global Privacy Control (GPC). When we detect a GPC signal from your browser, we treat it as a valid request to opt out of any sale or sharing of your personal information.

10.2.2 Data Broker Status

We are NOT a data broker as defined under California Civil Code Section 1798.99.80. We do not collect personal information about consumers with whom we do not have a direct relationship for the purpose of selling that information.

10.3 California Consumer Rights

You have the right to:

1. Know what personal information we collect, use, and share
2. Request deletion of your personal information
3. Correct inaccurate personal information
4. Opt out of the sale/sharing of personal information (not applicable - we don't sell/share)
5. Limit use of sensitive personal information
6. Non-discrimination for exercising your rights

10.4 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. Authorized agents must provide:

• Signed written authorization from you
• Proof of identity for both you and the agent

We may deny requests from agents that cannot verify proper authorization.

10.5 Contact for California Requests

Email: hello@highailabs.com
Subject: "California Privacy Rights Request"

We will respond within 45 days as required by California law.

11. Other State Privacy Rights

We comply with state privacy laws where applicable. Below are additional rights for residents of specific states:

Washington State (My Health My Data Act)

If you are a Washington State resident, your cannabis consumption data may be considered "consumer health data" under the My Health My Data Act. You have additional rights including:

• Right to explicit consent before collection of health data
• Right to know what consumer health data we collect and why
• Right to withdraw consent and request deletion
• Right to data portability

Colorado (Colorado Privacy Act)

Colorado residents have enhanced privacy protections for cannabis purchases including:

• Right to opt out of targeted advertising
• Right to access, correct, and delete personal data
• Right to data portability

Virginia, Connecticut, Utah, and Other States

Residents of states with comprehensive privacy laws (Virginia VCDPA, Connecticut CTDPA, Utah UCPA, Oregon, Texas, Montana, Delaware, Iowa, New Hampshire, New Jersey, and others) have similar rights to access, delete, correct, and port their data. Contact us at hello@highailabs.com to exercise these rights.

🔒 Our Commitment

We do NOT sell or share your consumer health data or cannabis consumption information without your explicit consent. This applies regardless of your state of residence.

12. Cookie Policy

12.1 What Are Cookies?

Cookies are small text files stored on your device when you visit websites. They help websites remember your preferences and understand how you use the site.

12.2 Cookies We Use (Website Only)

12.3 App Local Preferences

The web app uses browser localStorage for local preferences. This is not application-level encrypted storage.

12.4 Cookie Management

Most browsers allow you to control cookies via settings. You can block all cookies, but some site features may not work. We will ask for cookie consent on your first visit (EU/UK visitors).

12.5 Do Not Track Signals

Some browsers send "Do Not Track" (DNT) signals. Due to the lack of a common industry standard for interpreting DNT signals, we do not specifically respond to DNT signals at this time. However, we do honor Global Privacy Control (GPC) signals as described in Section 10.2.1 above.

13. Children's Privacy

Our services are intended exclusively for adults 21 years of age or older, in compliance with cannabis-related age restrictions. The App asks you to confirm that you are 21 or older before you use it, and the App Store rates High IQ for mature audiences.

We do NOT knowingly collect information from anyone under 21 years of age. If we discover that we have collected information from someone under 21, we will delete it immediately.

If you believe we have collected information from someone under 21, please contact us immediately at hello@highailabs.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our practices
• New legal requirements
• Service improvements or new features

How we notify you:

• Material Changes: We will notify you via email (if you have an App account) and/or prominent notice at least 30 days before changes take effect
• Minor Changes: We will update the "Last Updated" date and post the new policy

Your continued use of our services after changes take effect constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices:

Email: hello@highailabs.com

Subject Line Suggestions:
"Privacy Question" (general inquiries)
"Data Request" (access, deletion, correction)
"California Privacy Rights Request" (CCPA requests)

Operator: John Egan, an individual doing business as High AI Labs

Location: Chicago, Illinois

Response Time: We aim to respond within 2 business days for general inquiries and within 45 days (or sooner as required by law) for formal data requests.