DRAFT — under legal review. These documents are working drafts, are not yet effective, and do not yet bind anyone. They are being finalized with counsel.

Cookie & Tracking Technologies Policy

DRAFT v0.1 — FOR ATTORNEY REVIEW ONLY. NOT LEGAL ADVICE. NOT YET EFFECTIVE.

Last updated: [EFFECTIVE DATE] · Version: 0.1-DRAFT

*[Drafting note to counsel: This is a first draft prepared for your review and finalization. Bracketed items require confirmation. Engineering should verify the exact identifier names, storage mechanism (HTTP cookie vs. browser local/session storage), first-vs-third-party classification, and retention/duration values in the technologies table before this Policy is published. Vendor-set names (e.g., Supabase, Cloudflare) can change; confirm against a current technical scan. This draft is written for a US-only, opt-out-jurisdiction posture and assumes Cannvas does not sell or share personal information for cross-context behavioral advertising and uses no third-party advertising technologies.]*

1. Introduction and Scope

This Cookie & Tracking Technologies Policy ("Cookie Policy" or "Policy") explains how Cannvas, LLC, doing business as "Cannvas" ("Cannvas," "we," "us," or "our"), uses cookies, local storage, and similar technologies on and through the Cannvas platform available at cannvas.app, including our business-facing operator dashboard (the "Dashboard") and our consumer-facing applications (the "Consumer Apps") (collectively, together with related websites, sub-domains, and services, the "Service").

Cannvas is ancillary cannabis software. We provide planning, compliance-support, and sales-workflow tooling to licensed operators (via the Dashboard) and product-discovery experiences to consumers (via the Consumer Apps). Cannvas does not sell cannabis, and this Policy addresses only our use of tracking technologies.

This Policy describes:

the categories of cookies and similar technologies we use and why;
the specific representative technologies we deploy (see the table in Section 4);
the technologies and practices we deliberately do not use (see Section 5);
the choices and controls available to you, including how we honor browser-based opt-out preference signals such as Global Privacy Control ("GPC") (see Section 6); and
how our consent approach works (see Section 7).

Scope. This Policy applies to the Service and is offered to users located in the United States only. It supplements, and should be read together with, the Cannvas Privacy Policy available at https://cannvas.app/legal/privacy.html (the "Privacy Policy"), which describes in full how we collect, use, disclose, and protect personal information and describes your privacy rights. Capitalized terms used but not defined in this Cookie Policy have the meanings given to them in the Privacy Policy. If there is a conflict between this Policy and the Privacy Policy regarding tracking technologies specifically, this Policy controls with respect to the technologies it describes.

2. What Are Cookies and Similar Technologies?

"Cookies and similar technologies" (referred to throughout as "tracking technologies" or "technologies") are small files or data records that are placed on, or read from, your device when you visit or use the Service. Modern privacy expectations treat these technologies broadly — not just as traditional browser cookies — and this Policy uses the term to include the following:

Cookies. Small text files that a website stores in your browser. A *session cookie* is deleted when you close your browser; a *persistent cookie* remains for a set period or until you delete it. A *first-party cookie* is set by the site you are visiting (here, Cannvas); a *third-party cookie* is set by a different domain than the one you are visiting.

Local storage and session storage. Browser-based storage mechanisms (part of the "Web Storage" standard) that let a site store larger or longer-lived values on your device — for example, your interface preferences or a saved record of your consent choices. These are not technically "cookies" but serve similar functions and are covered by this Policy.

Pixels, web beacons, and tags. Tiny, often invisible, snippets of code or graphics embedded in a page or message that can record that a page or event was loaded. We use pixel-style event capture only for our own first-party analytics (see Section 3(c)); we do not host third-party advertising pixels.

Software development kits (SDKs) and scripts. Code libraries and scripts integrated into an application — for example, our own first-party analytics script, cannvas-tracker.js — that enable functionality and measurement.

Device and network signals. Information your browser or device sends automatically, such as browser and operating-system type, screen characteristics, and IP address. As described below, we use IP address only in an approximate/coarse manner for security and analytics and do not use it to build cross-site advertising profiles.

Where this Policy refers to "cookies" for brevity, it means all of the tracking technologies described above unless the context clearly indicates otherwise.

3. Categories of Technologies We Use

We group the technologies we use into three categories, based on their function. The specific representative technologies in each category are listed in the table in Section 4.

3(a). Strictly Necessary Technologies (cannot be disabled)

These technologies are essential to operate the Service, keep it secure, and deliver features you request. Without them, core functions — such as signing in, maintaining a secure session, protecting against fraudulent or abusive traffic, and load balancing — would not work.

Strictly necessary technologies include:

Authentication and session technologies used to sign you in and keep you signed in as you move through the Dashboard or Consumer Apps, and to associate your requests with your authenticated session. These are provided through our authentication and backend service provider, Supabase.
Security and integrity technologies used to detect and mitigate bots, abuse, and malicious traffic, to complete security challenges, and to route and balance traffic reliably. These are provided through our content-delivery and security service provider, Cloudflare.

Because these technologies are required to provide the Service and to fulfill functions you affirmatively request (such as logging in), we set them without asking for consent and they cannot be turned off through our consent controls. You may block them using browser controls (see Section 6), but if you do, the Service may not function properly or at all.

*[Drafting note to counsel: Supabase and Cloudflare act as our service providers / processors and set these technologies on our behalf to deliver the Service. We treat them as first-party / strictly necessary rather than third-party tracking. Confirm this characterization against the current data-processing agreements and the Privacy Policy's "service providers" disclosures.]*

3(b). Preferences / Functional Technologies

These technologies remember choices you make so the Service can behave the way you expect. They are not required to deliver the core Service, but they improve usability. Preferences technologies include:

Interface/theme preference (for example, light or dark mode).
Age-gate acknowledgment, which records that a Consumer App visitor has acknowledged our age/eligibility gate so we do not repeatedly prompt during a session or for a limited period.
Consent preference storage, which records your cookie/consent choices so we can honor them on return visits and apply them consistently.

Because storing your consent decision is what allows us to respect your choices, we treat the consent-preference record itself as necessary to give effect to your preferences; the theme and age-gate records are functional/preferences technologies as described in the table.

3(c). First-Party Analytics Technologies

We operate our own first-party analytics using our proprietary tracker script, cannvas-tracker.js, to understand how the Service is used so we can measure performance, diagnose problems, and improve the product. This analytics data is collected by Cannvas, stored by Cannvas or our service providers acting on our behalf, and is not shared with third-party advertising networks or data brokers.

At a high level, our first-party analytics may collect:

Usage and event data — pages and screens viewed, features and elements interacted with, actions/events taken within the Service, referring page, and timestamps;
Device and environment data — browser type and version, operating system, device type, screen/viewport characteristics, and language;
Approximate location — a coarse, city/region-level estimate derived from a truncated or generalized IP address, used for aggregate analytics and security; we do not use this to precisely locate you; and
A first-party analytics identifier — a randomly generated identifier used to distinguish sessions and returning visits within the Cannvas Service only.

Our analytics identifiers are first-party and site-specific. We do not use them to track you across other websites or apps, and we do not combine them with third-party advertising data to profile you for cross-context behavioral advertising. See Section 5.

We treat first-party analytics as non-essential. It is governed by your consent and opt-out choices as described in Sections 6 and 7.

4. Technologies We Use (Representative Table)

The following table describes the representative tracking technologies used on the Service. Names, storage mechanisms, and durations are representative and may change as the Service evolves; we will maintain an accurate list and update it as described in Section 8.

Name / Type	Purpose	Category	First / Third Party	Storage & Duration
`sb-<project>-auth-token` (and related auth records) — authentication/session, via Supabase	Signs you in and maintains your authenticated session across the Dashboard and Consumer Apps; associates requests with your account	Strictly necessary	First party (set by Supabase as our service provider)	Cookie and/or browser local storage; session plus refresh — persists until sign-out or token expiry [confirm: e.g., up to ~30–60 days]
`__cf_bm` — Cloudflare bot-management	Distinguishes humans from bots to protect the Service from automated abuse	Strictly necessary (security)	First party (set by Cloudflare as our service provider)	Cookie; ~30 minutes
`cf_clearance` — Cloudflare security clearance	Records that a security/anti-abuse challenge was passed so you are not repeatedly challenged	Strictly necessary (security)	First party (set by Cloudflare as our service provider)	Cookie; session up to ~1 year [confirm]
`__cflb` — Cloudflare load balancing (if enabled)	Routes your requests to a consistent backend for reliable performance	Strictly necessary	First party (set by Cloudflare as our service provider)	Cookie; session to ~24 hours [confirm/remove if unused]
`cv_consent` (representative) — consent-preference record	Stores your cookie/consent choices so we can apply and honor them	Strictly necessary / preferences	First party	Browser local storage or cookie; persistent [e.g., ~12 months, then re-prompt]
`cv_age_ack` (representative) — age-gate acknowledgment	Remembers that you acknowledged our age/eligibility gate in the Consumer Apps	Preferences	First party	Browser local storage or cookie; session to [e.g., ~30 days]
`cv_theme` (representative) — theme/interface preference	Remembers your display preference (e.g., light/dark mode)	Preferences	First party	Browser local storage; persistent until cleared [e.g., ~12 months]
`cv_aid` (representative) — first-party analytics visitor identifier, via cannvas-tracker.js	Distinguishes returning visits within the Service for product analytics and improvement	Analytics	First party	Browser local storage or cookie; persistent [e.g., ~12 months]
`cv_sid` (representative) — first-party analytics session identifier, via cannvas-tracker.js	Groups activity within a single visit for product analytics	Analytics	First party	Browser session storage or cookie; session [~30 minutes of inactivity]

*[Drafting note to counsel: The above names/durations are representative placeholders pending an engineering confirmation scan of production. Confirm whether auth and analytics identifiers are stored as cookies, in local storage, or both, since the correct legal characterization (and some state-law analysis) can turn on the mechanism. Add or remove Cloudflare rows to match the actual deployment.]*

5. What We Do NOT Do

We have deliberately limited how the Service uses tracking technologies. Specifically:

No third-party advertising cookies or trackers. We do not place third-party advertising cookies, ad pixels, or ad SDKs on the Service, and we do not permit third-party advertising networks to track you through the Service.
No cross-context behavioral advertising; no sale or sharing of personal information for it. We do not "sell" your personal information, and we do not "share" your personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended (the "CCPA/CPRA"), and analogous US state privacy laws. Our analytics are first-party and used to operate and improve the Service, not to serve you targeted ads elsewhere.
No third-party ad-tech data brokering. We do not use tracking technologies to disclose your information to data brokers or ad-tech intermediaries for advertising or profiling.
No cross-site tracking. Our identifiers are site-specific to Cannvas. We do not use them to follow you across unaffiliated websites or applications.

Because we do not sell or share personal information for cross-context behavioral advertising, there is no such "sale" or "share" for you to opt out of. We nonetheless honor opt-out preference signals as an opt-out of our non-essential technologies, as described in Section 6.

6. Your Choices and Controls

You have meaningful choices about non-essential tracking technologies. Note that strictly necessary technologies (Section 3(a)) cannot be disabled through our consent controls because they are required to operate and secure the Service.

6(a). Consent banner and preference center

When required, we present a cookie/consent banner and/or a preference center for non-essential technologies (preferences/functional and first-party analytics). Consistent with current best practices, we design these controls so that declining non-essential technologies is as easy and as prominent as accepting them, and we do not use deceptive design ("dark patterns"), pre-checked boxes, or misleading wording to influence your choice. Strictly necessary technologies are described in the banner/preference center for transparency but are listed as always-on.

6(b). Changing your consent

You can change your choices at any time by [opening the "Cookie Settings" / "Privacy Preferences" control available at [LOCATION — e.g., the site footer or account settings]]. Updating your choices there takes effect on a going-forward basis; where technically feasible, we will also remove or stop reading non-essential technologies you have declined.

6(c). Browser and device controls

Most browsers and devices let you view, block, and delete cookies and clear local storage, and let you set preferences for specific sites. You can typically manage these settings in your browser's "Privacy," "Security," or "Site Settings" menus. Clearing your browser storage will remove our preference and analytics records (and may sign you out). Blocking all cookies and storage may prevent the Service from functioning, because strictly necessary technologies will also be blocked.

6(d). Global Privacy Control and opt-out preference signals (honored)

We honor Global Privacy Control (GPC) and other browser- or device-based opt-out preference signals ("opt-out preference signals" or "OOPS") that we recognize. GPC is a signal your browser or a browser extension can send automatically to every site you visit, without you having to click anything on each site.

How we treat the signal. When we detect a recognized opt-out preference signal (such as GPC) from your browser or device, we treat it as a valid request to opt out of our non-essential tracking technologies — that is, we disable first-party analytics and non-essential preferences technologies for that browser/device. Because we do not sell or share personal information for cross-context behavioral advertising (Section 5), there is no separate advertising "sale/share" for the signal to disable; the signal instead opts you out of our non-essential technologies.
Confirmation. Consistent with current US state privacy requirements, we [will reflect that your opt-out preference signal has been recognized and applied — for example, by [showing an "Opt-Out Honored" indicator in the preference center / reflecting the opt-out state in your Cookie Settings]]. *[Drafting note to counsel: The revised CCPA regulations effective January 1, 2026 require covered businesses that process opt-out preference signals to display that a consumer's signal has been recognized and processed. Confirm the exact confirmation UX and whether Cannvas meets the CCPA "business" thresholds; even if not strictly covered, honoring GPC and confirming it is our stated best-practice posture and should be implemented consistently.]*
Scope and limits. An opt-out preference signal applies to the specific browser or device that sends it. If you use multiple browsers or devices, or clear your browser storage, you may need to set the signal (or your preferences) again on each. If you have a Cannvas account and a signal conflicts with an account-level choice, we will give effect to the opt-out and may inform you of the conflict and how to adjust account settings.

Learn more about GPC at globalprivacycontrol.org.

6(e). Do Not Track

Some browsers offer a legacy "Do Not Track" ("DNT") setting. Because there is no common industry standard for interpreting DNT, we do not separately respond to DNT signals; instead, we honor the more widely recognized GPC / opt-out preference signals described in Section 6(d).

6(f). Effect of disabling technologies

Disabling first-party analytics does not affect your ability to use the Service; it means we collect less information about how the Service is used.
Disabling preferences/functional technologies means the Service may not remember your settings (for example, your theme), and Consumer App age-gate prompts may reappear.
Strictly necessary technologies cannot be disabled through our controls. If you block them at the browser level, you may be unable to sign in, maintain a session, or use secured features, and portions of the Service may not work.

7. Our Consent Approach

Strictly necessary technologies are set without consent because they are required to deliver and secure the Service and to carry out actions you request (such as authentication). They cannot be turned off through our consent controls.
Non-essential technologies — first-party analytics and non-essential preferences/functional technologies — are governed by your choice. We deploy them in accordance with your consent and opt-out selections, including any recognized opt-out preference signal (Section 6(d)). Where we rely on your affirmative choice, we obtain it through the consent banner/preference center; where you have opted out (including via GPC), we do not use the non-essential technologies you have declined.
We apply a symmetry-of-choice standard: accepting and declining non-essential technologies require comparable effort and prominence, and we do not use dark patterns.
Our consent-preference record (Section 3(b) / Section 4) exists specifically to store and give effect to these choices.

*[Drafting note to counsel: The US is generally an opt-out regime, so this draft sets non-essential technologies subject to opt-out plus a consent banner, rather than a strict EU-style prior opt-in. If Cannvas anticipates any EU/UK/EEA traffic despite the US-only scope, a prior opt-in (consent-before-fire) model for non-essential technologies would be required and this Section would need revision.]*

8. Changes to This Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use, our practices, or applicable law. When we make material changes, we will update the "Last updated" date above, increment the version, and, where appropriate, provide additional notice (for example, through the Service or by re-presenting the consent banner). We encourage you to review this Policy periodically. Your continued use of the Service after an update takes effect indicates your awareness of the updated Policy, subject to the choices and consent described above.

9. Relationship to the Privacy Policy

This Cookie Policy is part of, and incorporated into, the Cannvas Privacy Policy. The Privacy Policy contains important additional information, including the categories of personal information we collect, the purposes for which we use it, the parties with whom we disclose it, how long we retain it, how we secure it, and your privacy rights and how to exercise them. Please read this Cookie Policy together with the Privacy Policy, available at https://cannvas.app/legal/privacy.html.

10. Contact Us

If you have questions about this Cookie Policy or our use of tracking technologies, contact us at:

Email: [email protected]
Entity: Cannvas, LLC (d/b/a "Cannvas")
Postal address: [MAILING ADDRESS]

*[Drafting note to counsel: Add any statutorily required contact method, an authorized-agent process for state privacy rights (cross-reference the Privacy Policy), and confirm the legal entity name, d/b/a registration, and mailing address before publication.]*

END OF DRAFT v0.1 — FOR ATTORNEY REVIEW ONLY. NOT LEGAL ADVICE. NOT YET EFFECTIVE.