Who we are
CannabisStrains.com is run by Gordon Hill, a sole trader based in the United Kingdom. He is the “controller” of the personal information described here, which means he decides how it is used and is responsible for it.
Postal address: [ADDRESS]
The quickest way to reach us about privacy is our contact form. Choose “Privacy request” as the topic.
The short version
- We don’t have user accounts, comments, reviews or a newsletter.
- We never ask about your health, any medical condition or whether you use cannabis.
- The strain finder, the calculator, your Day or Night choice, your age answer and your saved strains all stay in your browser. They are never sent to us.
- Our web host and security tools keep standard technical logs, such as IP addresses, to keep the site running and safe.
- We use Google Analytics to count visits and see which pages people read.
- If you write to us, we use your message only to reply.
- We don’t sell personal information, and we don’t share it for targeted advertising.
What we collect and why
When you visit the site
Like almost every website, ours records some technical details each time a page loads:
- Server logs. Our web host, Krystal Hosting Ltd in the United Kingdom, logs each request: your IP address, the date and time, the page requested, your browser’s user agent and the page that linked to us. These logs keep the site working and help us investigate faults and attacks.
- Bot check. Our host’s security system may show a short “one moment, please” check before a page loads, and may set a short-lived cookie to remember that your browser passed it.
- Firewall. We use Wordfence, a security plugin, to block attacks. It checks each request, and it records the IP address and request details when it blocks something or when someone tries to log in to the site’s admin area. Wordfence’s security network, run by Defiant, Inc. in the United States, receives the IP addresses of blocked attacks so it can protect other sites.
- Missing pages. When a page isn’t found, our SEO plugin logs the address that was requested, the page that linked to it and the browser user agent, so we can fix broken links. It doesn’t log IP addresses.
Analytics
We use Google Analytics 4, through Google’s Site Kit plugin, to count visits and see which pages are read, which sites send us visitors and roughly which countries they come from. Google Analytics sets cookies in your browser (see the table below) and sends Google details such as the pages you view, your browser and device type, and your IP address, which Google uses to estimate your location and says it doesn’t store. We use these reports only in aggregate. We haven’t linked Google Analytics to any advertising product, and we don’t use it to build profiles of individual people.
UK law now allows some first-party analytics cookies without consent, under strict conditions. Google Analytics is a third-party service, so we don’t rely on that exception for it.
To stop Google Analytics, you can block cookies for this site in your browser settings, or install Google’s opt-out browser add-on. The site works the same either way.
When you contact us
The contact form asks for your name, your email address, a topic and your message. They reach us only as an email; the website itself doesn’t store them. We use them only to read and answer your message, and to keep a record of corrections and requests. The form uses a hidden field to catch spam bots, not a CAPTCHA or any outside service. Please don’t include health information or anything about your own cannabis use. We don’t need it, and if you send it anyway we use it only to reply and delete it with your message.
Things that stay on your device
Some features remember things in your own browser. This information is stored on your device and is never sent to us:
- Day or Night theme. Your choice is kept in a small cookie and in your browser’s local storage, so the next page opens in the same theme.
- Age question. When you confirm you’re 21 or over, a cookie remembers your answer, so you aren’t asked on every page.
- Saved strains. The Save buttons keep your list in your browser’s local storage. Clearing your browser data deletes it.
- Tools. The strain finder, the total THC calculator, compare and the chemistry map run in your browser. Your answers and inputs are not sent anywhere.
What we don't collect
- No accounts, passwords or profiles for readers.
- No comments, reviews, ratings or other posts from readers.
- No newsletter list. If we start a newsletter, sign-up will be opt-in, and we will update this policy before it opens.
- No health information, and no information about whether or how you use cannabis.
- No payment details. Nothing is for sale on this site.
- No advertising pixels, and no selling or renting of personal information.
- No fonts or icons loaded from outside services. They are served from our own host.
Cookies and similar storage
| Name | Set by | What it does | How long it lasts |
|---|---|---|---|
| cs_theme | This site | Remembers Day or Night | 1 year |
| cs-theme (local storage) | This site | Remembers Day or Night | Until you clear it |
| cs_age_ok | This site | Remembers that you confirmed you’re 21 or over | 30 days |
| cs-saved (local storage) | This site | Keeps the strains you saved | Until you clear it |
| ga, _ga* | Google Analytics | Tells visits apart so they can be counted | Up to 2 years |
| Bot-check cookie | Our host’s security system | Remembers that your browser passed the check | Short-lived |
| WordPress and Wordfence login cookies | This site | Keep site staff logged in | Staff only; never set for readers |
The theme, age and saved-strain items are there because you asked for them: they make the site work the way you chose. You can delete any of these items at any time in your browser settings.
Our legal bases (UK and EU)
Under the UK GDPR and the EU GDPR, we rely on these legal bases:
- Legitimate interests for server and security logs (keeping the site available and safe), for analytics (understanding which pages are useful) and for answering messages you send us.
- Legal obligation where we have to keep or disclose information by law.
Where we rely on legitimate interests, you can object, and we will stop unless we have a strong reason to continue, such as protecting the site from an attack.
Health information and Washington's My Health My Data Act
We don’t collect “consumer health data” as the Washington My Health My Data Act and similar US state laws define it. We don’t ask about health, symptoms, medical conditions or cannabis use. We don’t collect precise location. The strain finder runs entirely in your browser, and its answers never reach us. We don’t sell or share any health information, because we don’t hold any. If you put health information in a message to us, we use it only to reply and delete it with the message.
Who we share information with
We share personal information only with the service providers that run the site for us, and only for the purposes above:
- Krystal Hosting Ltd (United Kingdom): web hosting, server logs, security checks and email.
- Google LLC (United States): Google Analytics.
- Defiant, Inc. (United States): the Wordfence firewall and its security network.
We may also disclose information if the law requires it, or to protect the site, our readers or others from fraud or attack. If the site ever changes hands, this information may pass to the new owner under the same promises.
The tools we use to write and publish pages work with our own page content and with overall search figures, such as how often a page appears in Google. They don’t receive information about individual visitors.
International transfers
Our host keeps the site and its logs in the United Kingdom. Google and Defiant are based in the United States. Where information leaves the UK or the European Economic Area, it is protected by the safeguards the law requires, such as the UK–US data bridge, the EU–US Data Privacy Framework or standard contractual clauses.
How long we keep information
| Information | How long |
|---|---|
| Server logs | Kept by our host for a short period for security and troubleshooting, then deleted |
| Firewall and login records | Up to 30 days, longer only while we investigate an attack |
| Missing-page log | Until the broken link is fixed, and no more than 12 months |
| Google Analytics data | The retention period set in our Google account, no more than 14 months, then deleted by Google |
| Contact messages | Up to 2 years after we last reply, then deleted |
| Items stored on your device | Until you clear them, or until they expire as shown in the cookie table |
Your rights
UK and EU
Under the UK GDPR and the EU GDPR you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct it, or to delete it;
- ask us to restrict how we use it, or object to how we use it;
- receive information you gave us in a portable format;
- withdraw any consent you gave, at any time.
You can also complain to a data protection regulator. In the UK, that is the Information Commissioner’s Office. In the EU, it is the regulator in your country. We’d be grateful for the chance to sort out any concern first.
United States
Depending on the state you live in, including California, you may have the right to know what personal information we collect, use and disclose; to ask us to delete or correct it; and to opt out of its “sale” or “sharing” for targeted advertising. We don’t sell personal information, we don’t share it for cross-context behavioral advertising, and we don’t use sensitive personal information. We won’t treat you differently for using any of these rights.
How to make a request
Use our contact form and choose “Privacy request”. We may need to confirm your identity before we act. We reply within one month, or within the time your state’s law sets, such as 45 days in California. Server and analytics records rarely identify a person by name, so tell us what you’re asking about, for example the date of a visit or the email address you wrote from.
Children and people under 21
This site is for adults 21 and over. We don’t knowingly collect personal information from anyone under 21. If you think someone under 21 has sent us information, tell us through the contact form and we will delete it.
Changes to this policy
We will update this policy when the site changes how it uses personal information, for example if we add a newsletter. The date below shows the latest version. If a change matters, we will also note it on this page.
Last updated: October 21, 2026.