The short version
This table is the whole policy in one place. The sections below give the detail behind each row.
| What | Do we collect it? | Why | How long |
|---|---|---|---|
| Your age-check answer | Yes, in one cookie | So you are asked once, not on every page | 30 days |
| Your email address | Only if you join the newsletter | To send you the newsletter | Until you unsubscribe, or ask us to delete it |
| Request logs | Yes, by our host | Security, and finding errors | 7 days in full; 30 days with the address masked |
| Visit counts | Yes, through Google Analytics | To see which pages are read | Up to 14 months, held by Google |
| Your name, address or phone number | No | We never ask | — |
| Payment details | No | We sell nothing | — |
| An account or a password | No | There are no accounts | — |
We do not sell or rent personal data, and we do not use it for advertising.
Who we are and how to reach us
Hail Mary Jane is an independent cannabis education site at www.hailmaryjane.com. It sells nothing, it has no accounts to sign up for, and it is read, not joined. BudFinders, our sibling site for menus, prices and dispensaries, is a separate site with a privacy policy of its own.
For anything about your data, write to info@hailmaryjane.com. We answer within 30 days, and usually much sooner.
What we collect, and why
The age check
The first time you visit, a screen asks whether you are 21 or over. When you say yes, your browser stores one cookie named hmj_age with the value 1. That is all it holds: no id, no timestamp, nothing that identifies you. It lasts 30 days, it is sent only to this site, and only over an encrypted connection. Search engines are not shown the screen, because it is a reminder for people, not a lock.
The newsletter
If you type your email address into the newsletter box, we store the address, the page you signed up from, the date, a random confirmation code and a status: pending, confirmed or unsubscribed. The address is used for one thing, sending the newsletter. The page and the date are used for one thing, seeing which pages bring readers who want more.
The emails themselves are sent by HighLevel, an email service. When you sign up, we pass it your address, its status, the page and the date, and the confirmation and unsubscribe links, and it sends the confirmation email and each issue. It holds the address to send our email and for nothing else, working on our instructions under its own privacy policy. Like most email services, it records whether an email is opened and which of its links are clicked; we read those counts to see which subjects readers want more of.
Nothing is sent to an address until it is confirmed. Every newsletter we send carries an unsubscribe link that works in one click, with no login and no reason asked. When you unsubscribe, the address stays on file marked as unsubscribed, here and at HighLevel, so that it can never be emailed again by mistake. If you would rather we forgot it entirely, ask, and it is deleted from both.
Server logs
The site runs on Microsoft Azure in the central United States. Like every web server, it records each request it answers: the address of the page, the time, the browser and device type, the page you came from when your browser says so, and the network (IP) address the request came from. We read these logs for two reasons only: to keep the site secure, and to find and fix errors.
The web server’s own access log keeps the full network address for seven days, then deletes it. Our monitoring service, Azure Application Insights, uses the address once to work out a rough location, at city level, and then masks it; what it keeps is deleted after 30 days.
Counting visits
We use Google Analytics 4 to count visits and see which pages are read, which is how we decide what to write next. It runs only on www.hailmaryjane.com, and its advertising features are switched off in the code that loads it: no remarketing, no audience building, no ads personalisation. Google states that Analytics 4 does not log or store IP addresses. Besides page views it records two kinds of click, a click on an affiliate link and a click through to BudFinders, in each case with the page you were on and the link you followed, and nothing about who you are.
Google processes that data under its own privacy policy. You can opt out of Google Analytics on every site with Google’s opt-out browser add-on, or by blocking its cookies, and the site works exactly the same either way.
Email you send us
If you write to us, we keep the email for as long as we need it to answer you and deal with what it raises, and then it goes the way of old correspondence. Writing to us does not put you on any list.
Every cookie, listed
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
hmj_age | Hail Mary Jane | Remembers that you answered the age check | 30 days |
_ga | Google Analytics | Tells one browser from another, so a visit is counted once | 2 years |
_ga_… | Google Analytics | Keeps the state of the current visit | 2 years |
That is the full list. There are no advertising cookies, no social-media cookies and no tracking pixels, and the site’s fonts are served from our own server rather than fetched from Google. The two Google cookies are set only on www.hailmaryjane.com and only while analytics is running. Block or delete any of them freely: the only effect of blocking hmj_age is that the age screen appears on every visit.
Where your data lives
What the site holds is stored in Microsoft Azure in the United States: the newsletter list in a database, the logs in Azure’s monitoring service. HighLevel, the email service, keeps its own copy of the newsletter list; it is a United States company, and its policy says it may process data in other countries, India among them. Analytics data is held by Google. If you are reading from outside the United States, your data crosses a border to get here. Microsoft, HighLevel and Google each publish the terms under which they process data for the businesses that use them, and we rely on those: Microsoft’s privacy statement, HighLevel’s privacy policy and Google’s privacy policy.
Who can see it
- The people who run the site. They can see the newsletter list and the logs, and nobody else on our side can.
- Microsoft, HighLevel and Google, as the companies that host the site, send the newsletter and count the visits. They process data on our instructions and under their own terms.
- Nobody else. We do not sell or rent data, we do not swap lists, and we do not hand data to advertisers, brands or the shops we link to. The one exception is a lawful demand from a court or a law-enforcement agency, which we would meet only as far as the law requires.
Your rights
Whatever country or state you are in, you can ask us to:
- Tell you what we hold about you. For most readers the honest answer is nothing. For a subscriber it is the row described above.
- Correct it. A mistyped email address, for example.
- Delete it. Including the unsubscribed marker, if you would rather be forgotten than remembered.
- Stop using it. Unsubscribing does this for the newsletter; blocking cookies does it for analytics.
- Give you a copy. Sent to you in a plain, readable form.
Write to info@hailmaryjane.com from the address in question, so we know the request is yours, and we will answer within 30 days. There is no charge and no form to fill in.
If you are in the European Union or the United Kingdom, these are the rights the GDPR and the UK GDPR give you. Our lawful basis is your consent for the newsletter, and our legitimate interest in keeping the site secure and knowing what is read for the logs and the analytics. You also have the right to complain to your data-protection authority. If you are in California, the same requests are your rights under the CCPA, and in the words that law uses: we do not sell personal information, and we do not share it for cross-context behavioural advertising. Because we do neither, a Global Privacy Control signal from your browser has nothing to opt you out of; it is honoured by default. Whoever you are, we would rather hear from you first.
Links to other sites
Most pages link out: to studies, to official sources, to brands, and to BudFinders for menus and prices. Once you follow a link you are on someone else’s site, under their privacy policy. A shop reached through an affiliate link may set a cookie of its own to record that you came from us. The disclosure explains how those links are marked, so you can see one before you click it.
Adults only
This site is for adults aged 21 and over. We do not knowingly collect anything from anyone younger, and we never ask for a date of birth. If you believe someone under 21 has joined the newsletter, tell us and the address will be deleted.
Security
Every page is served over an encrypted (HTTPS) connection, and the age-check cookie is marked so that a browser will only ever send it over one. There are no passwords to leak, because there are no accounts. The newsletter’s confirmation and unsubscribe links carry a random code long enough that nobody can guess another reader’s. The site connects to its database with an identity that Azure manages, not with a stored password. If a breach ever did expose subscriber data, we would tell the subscribers affected and the relevant authorities, as the law requires.
Changes to this policy
If what we collect changes, this page changes first, and the date at the top shows when it was last edited. A change that matters to subscribers, such as a new use for the list, would be announced in the newsletter before it took effect, with the chance to leave first.
Questions people ask
Do you sell my data?
No. Not to advertisers, not to brands, not to the shops we link to, not to anyone. The old version of this site said it shared its email list with other companies; this one does not. The one company that handles the list is the email service that sends the newsletter, and it handles it only to send it.
Do I need an account to read the site?
No. There are no accounts, no logins and no paywall. The only thing you can sign up for is the newsletter, and the only thing it asks for is an email address.
How do I unsubscribe from the newsletter?
Click the unsubscribe link at the bottom of any issue. It works in one click, with no login and no reason asked. If you have lost the email, write to info@hailmaryjane.com from the subscribed address and we will do it for you.
How do I delete everything you hold about me?
Write to info@hailmaryjane.com from the address you want deleted. For a subscriber, that is the newsletter row and its copy at our email service; for everyone else the truthful answer is that there is nothing on file to delete, because the logs hold no name and are gone within 30 days.
Does the age check track me?
No. The cookie holds the number 1 and nothing else, so it cannot tell you apart from any other reader. It exists only so the screen does not come back on every page, and it is sent only to this site.
Can I read the site with cookies blocked?
Yes, all of it. Every page works with cookies off and with JavaScript off. The only difference is that the age screen appears on each visit, because there is no cookie to remember your answer.