Privacy in this preview

What stays on your device.

Saved product and brand IDs, price targets and shopping plans stay in this browser when saved.

Named filter lists, display layouts, collection searches and default-feed choices stay in this browser. Remembering catalog searches, sort and filters is optional.

Inventory assumptions and tool preferences stay in browser storage when those tools are used.

Store and strain favorites, scoped brand/store mutes and local expiry clock checkpoints stay in this browser; they are not sent to source APIs or shared links.

Visit-alert opt-in, delivery settings, rule IDs and bounded exact source baselines stay in this browser. Nearby-rule baselines are visit-only. Background push is not configured.

Merchant handoff can optionally remember recent exact listing IDs in this browser. Source names, destination URLs and personal copy-assist fields are not stored in that recent list. Copy-assist fields stay in page memory until cleared or the page is left; copying requires an explicit button action.

Optional Recently explored starts off. If you turn it on, qualifying active visits to exact product pages can save up to 20 product IDs and coarse UTC days in this browser for seven days. Partial dwell time, product names, URLs, searches and location are not saved. Pause or clear this history in its controls; it is separate from account sync, aggregate interest contributions, analytics and notifications.

Product reminders fetch current visible product information only after you choose Check my recent & saved products. Separate reminder controls can pause reminders, hide up to 100 product IDs and keep up to 20 local package confirmations for seven days. A package confirmation is saved only when you choose Use this current package; changed or unconfirmed packages require review. These reminder choices use a separate browser key and do not save product names, prices, photos or location. Clear history & reminder data removes these reminder choices and remembered visits together; explicitly saved product lists are retained.

Location & availability controls reuse your chosen shipping country and keep a separate local region and include-unconfirmed-shipping preference. These new location options stay in this browser and are excluded from account sync and import/export. A country choice filters dated merchant shipping statements; it does not establish purchase eligibility or choose a physical-store location. A remembered nearby ZIP only fills the input: choose Use ZIP to apply it. Temporary device coordinates are not saved in these preferences or share links. Clear country and region choices keeps separately remembered nearby ZIP choices; use Clear nearby location to remove those.

The COA checklist can save six yes/no checkmarks in this browser only when you choose Save checkmarks. It saves no report, lot, package, date, notes or file and never loads a copy automatically. Load, Delete and Export are separate actions. A saved copy has no report association: review all six against the report currently open. These checkmarks are excluded from accounts and sync.

Comparison product IDs may be put into a shareable URL. A shared filter list can also include its search text, selected filters and exact saved-package scope; review the prepared link before copying it. Anyone with that URL can see those details; loading or sharing it also reveals the URL to the relevant server or recipient. Correction notes on these educational pages stay in the page and are copied to your clipboard only when you choose Copy.

What the server receives.

Product search/filter queries, requested product IDs and brand requests are sent to this site’s server to fetch scoped results. Background delivery requires a configured enabled HTTPS site and your explicit opt-in; it remains inactive in an unconfigured preview. If you explicitly enable it, selected structured rule/filter copies, the push endpoint and encryption keys are retained privately by this site; saved-list names, free-text searches and device coordinates are excluded. A manual coarse ZIP/radius requires a separate storage choice. These details are not put in analytics, referral links or notification text. A separate secure HttpOnly ownership cookie controls the account-free subscription. The dedicated notification worker retains only an enabled flag, a random delivery generation and bounded opaque message IDs/expiry times; it does not cache prices, reports or APIs. The browser’s push platform receives routing metadata and encrypted generic messages. Opt-ins expire within 30 days; expiry does not promise immediate deletion. Normal cleanup after subscription expiry or removal keeps only a minimal batch-frequency and scheduling record until the original server session expires. If stored alert data is corrupt, its existing private records may remain until a confirmed Stop removes them, or cleanup runs after that original session expires. This does not extend that expiry. Enabling again does not reset the minimum gap. Confirmed server revocation or session expiry clears that frequency record. Minimal revocation records may remain until the server session expires. Stop attempts local suppression, server revocation and browser unsubscription separately; use the background settings page to retry unconfirmed cleanup before clearing site data. Browser notification permission remains under browser settings.

The application does not write request URLs, IP addresses or search terms to access logs. It keeps bounded in-memory rate-limit counters; hosting or proxy retention is not configured for this local preview.

Documents you choose to submit.

Reports and corrections may include an optional contact, private PDF, source link and submitter notes. These are retained privately for human review; they are never automatically published. This preview has no automated deletion policy. Contact the owner through the person who supplied the preview for a data request.

Accounts, analytics and outside links.

Optional sign-in is available only for configured Google or Amazon providers. Google sign-in requests OpenID identity and verified email. The site checks the owner allowlist against the signed, verified Google identity and takes the owner directly to the admin panel. This is SSO verification, not proof of a new Google password or MFA step. Owner email is checked transiently and is not stored in the owner lease. Admin access uses a separate Secure, HttpOnly, SameSite=Lax cookie for up to seven days and ends with revocation, sign-out or account-session expiry. Ordinary account sessions last up to thirty days and use a separate Secure, HttpOnly, SameSite=Lax cookie; sign-in attempts expire after ten minutes. The site privately stores provider issuer and opaque identity, an internal account ID, account and sign-in timestamps, and hashed session records. Sign-in does not save provider name, email, avatar, access tokens or refresh tokens. Profile fields, account settings, saved-list sync and merging browser saves use separate explicit controls; signing in does not upload browser saves automatically. Account-data export, identity changes and deletion follow their own controls and verification requirements. Signing out revokes the current account session and its admin access; it does not delete account identity or clear browser saves. Expired session records are removed when checked and expired sign-in attempts when another attempt begins. Sign-in is separate from analytics consent, email and push notifications. Optional security passkeys can separately verify sensitive actions. Explicit first setup checks an already-linked provider again; it does not promise a new provider password or MFA step. The site stores public credential information, chosen key names and lifecycle dates, not device biometrics or private keys. Setup and verification attempts last at most five minutes; expired stored attempts are pruned on later guarded operations. A recovery key is shown once and only its hash is stored. Keep that key separately: if all passkeys and the recovery key are lost, ordinary sign-in remains available but sensitive actions stay locked. Removing the last passkey does not silently reset security setup. Passkey records are removed by account deletion; guest browser copies and outside backups remain separate.

An owner-only reviewer sign-in uses a random HttpOnly, SameSite=Strict session cookie lasting up to8hours. It is separate from optional visitor account sessions.

CannaCompare uses the standard Google Analytics tag to measure visits and vendor referrals. Google receives network and browser information, including your IP address, and may derive an approximate location. Analytics cookies require your choice in Analytics settings; advertising storage and personalization stay disabled. With analytics cookies off, Google consent mode can still send limited cookieless measurement signals. The country you select for shopping, precise location, saved lists and search text are not added to our custom events. Page URLs sent by our configuration omit query strings and fragments. Change your choice in Analytics settings at any time.

Features are free to use. Affiliate links are the only monetization model; we do not sell subscriptions or advertising placements.

Vendor, publisher, laboratory and government links open their own sites. Those services have their own privacy practices and may use cookies or tracking. Approved referral links, when configured, may carry a referral identifier. Local product images do not require a visitor request to the original vendor image host.

Your controls.

Use the product Save controls to remove saved items, or your browser’s site-data settings to clear local choices. Clearing browser data does not remove a copied URL or an outside vendor’s records. Recheck this page before launch or when storage, hosting or analytics changes.

Manage previous interest contributions checks only when you explicitly request it and cannot turn collection on.