Privacy at InaBag
This review draft separates confirmed sample behavior from facts that still require verification. The sample preview is not evidence of how the live service processes data.
Who operates InaBag
InaBag is operated by Green Growth Advisors Corp, New Jersey. This draft describes the proposed customer privacy notice. It is not an effective policy. The verified preview behavior below must be reconciled with the production service before approval.
When you scan an offer
Opening an InaBag offer can associate your visit with an offer and its distribution source. That association can suggest that you are a dispensary customer, so we treat it as sensitive. A scan or forwarded link is not proof that you visited a dispensary or bought cannabis. Open question: confirm the actual scan endpoint and fields recorded, including offer and source identifiers, timestamp, IP address, browser/device information, referrer, location and any cookie or visitor identifier. Confirm hosting and security logs as well as application records.
Saved offers and your identity
In the reviewed sample catalog, saved offers and activity are stored in this browser using local storage. The sample stores offer identifiers, save times, reopen times and successful copy-action times. This code does not ask for your name, email address or phone number to save a sample offer. These browser records do not automatically follow you to another browser or device. Some displayed activity is clearly labeled sample history. Open question: confirm how the live catalog connects device records, private catalog links and any email, phone number or account; which records reach a server; and whether identities are joined across devices.
Sharing an offer
The reviewed sharing feature copies a prepared message to your clipboard when you choose Copy. It does not send an SMS. You choose whether and where to paste and send it. A successful copy is recorded locally as a sharing action; it does not prove a message was sent, delivered or opened. The sample does not request the recipient’s contact details. Any messaging service you use has its own privacy practices. Open question: verify that live shared links expose only the public offer and never a private catalog identifier or dispensary-customer identity.
Your choices and consent
Scanning, saving or copying an offer is not permission to send marketing messages. Any future optional messaging requires its own clear choice; this draft does not announce SMS sending as available. Open question: verify the live consent controls, exact purposes and wording, consent records, withdrawal process, and any nonessential cookies or tracking. Counsel must approve the handling of sensitive inferences before launch.
Why information is used and who receives it
The reviewed browser records support the sample saved-offer catalog and its activity display. Open question: list every actual production use and recipient, including hosting, database, analytics, support and messaging providers; specify which fields each receives and why. Dispensary partners and merchants are covered by separate agreements, but those agreements do not replace explaining customer-data disclosures here. Confirm whether their reports are aggregate or individual, what they can identify, and whether data is sold, used for targeted advertising or disclosed for other purposes. Do not claim that information is anonymous or never shared until verified.
How long information stays
The reviewed sample code has no automatic time-based deletion for its browser records. They can remain until the site’s browser storage is cleared or the browser removes them. Clearing local records does not establish that server logs or provider copies are deleted. Open question: set and verify a retention schedule for scan events, saved offers, identifiers, contact details, consent/withdrawal records, security logs, backups and provider copies. State actual durations or specific retention criteria in the approved policy.
Seeing or deleting your information
You can see the sample’s saved offers and displayed activity in its catalog. Clearing this site’s browser storage removes the sample records stored in that browser; it can also remove access to those saved offers. This is not a server-side deletion request. Proposed request channel, not yet verified: info@inabag.com, subject “Privacy request.” Before publication, confirm who handles access, correction and deletion requests, how ownership is verified without collecting unnecessary sensitive information, response timing, provider deletion, backup handling and any legally required exceptions. Do not promise a self-service account or deletion feature that is not live.
Approval and updates
For legal review — October 18, 2026. No effective date has been assigned. Resolve the open questions against the live implementation, obtain counsel approval, and obtain Michael’s production-release instruction before publishing this as the InaBag privacy policy.