Privacy Policy

What we collect

• Newsletter email address (only if you give it). If you subscribe, we store the email address you submit and the date you subscribed. Providing it is voluntary and is used only to send the updates you asked for.
• Aggregate analytics data. We use Vercel Web Analytics (cookieless) and, with your consent, Google Analytics 4 to understand which pages are read and how the site performs. This may include approximate region, device/browser type, referring page, and the pages viewed. We use it only in aggregate and not to identify you.
• Basic server logs. Our hosting provider may automatically log technical request data (IP address, timestamp, user agent) for security and reliability. We do not use these logs to build profiles of individuals.

What we do not collect

• We do not require accounts, names, or passwords to read the site.
• We do not knowingly collect sensitive personal information, and we do not ask you to tell us about your own drug use to read our content.
• We do not collect or store your payment card details. Payments are processed by Stripe; card information goes directly to Stripe and never touches our servers.

How we use information

• To send the newsletter you subscribed to, and to let you unsubscribe.
• To measure and improve the site’s content, performance, and reliability, in aggregate.
• To protect the site against abuse, fraud, and security threats.
• To comply with legal obligations.

We do not use your information for advertising, and we do not sell, rent, or trade your personal information to anyone.

Order fulfillment

When you place an order, we share the information needed to fulfill it (your name, shipping address, and the items ordered) with our fulfillment partner, who ships harm-reduction products on our behalf. Our fulfillment partner receives only what is required to pack and ship your order and may not use it for any other purpose.

We do not share your payment details with our fulfillment partner. Payments are processed by Stripe, and payment information is handled under Stripe’s privacy policy.

Community reports

If you submit a community report through our report form, we collect only the information you enter in the form: what the substance was sold or represented as, its form and appearance, reagent test results you observed, the country or region you choose to share, the test date, and any notes you add.

We do not collect or store your name, email address, IP address, account information, or device details with your report, and nothing in a report is linked to you. Submissions are anonymous by design.

Every report is reviewed by a human moderator before any part of it is displayed. Approved reports appear on the site only in anonymous, aggregated form, individual reports are never published.

Do not include personal information about yourself or anyone else in a report, and do not include any information related to buying or selling. Reports containing this are rejected.

Cookies and tracking

We minimize tracking. Vercel Web Analytics is cookieless , it sets no cookies and runs without consent. Google Analytics 4 (GA4) loads on every visit to 2CB.com, but what it is allowed to do depends on your choice. We use Google Consent Mode v2 with analytics consent set to “denied” by default, so before you choose, and for as long as you decline or ignore the banner, GA4 sets no cookies and sends only anonymous, cookieless measurement pings that carry no identifier for you or your device. Only when you click “Accept” does GA4 set cookies and record full analytics. You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page. We do not use third party advertising or cross site tracking cookies.

Third parties we rely on

• Analytics: Vercel Web Analytics (cookieless) and Google Analytics 4, which loads on every visit but sets cookies and records full analytics only after you accept, and otherwise sends only anonymous, cookieless pings.
• Email / newsletter: subscriber email addresses are stored directly in our own database and are not shared with a third-party email processor at this time.
• Hosting / infrastructure: our hosting provider processes requests and may keep short-term technical logs.

These providers process data on our behalf under their own terms and privacy policies; we share only what is necessary for them to perform their function.

Data retention

• Newsletter emails: retained until you unsubscribe or ask us to delete them, then removed within a reasonable period.
• Analytics:retained in aggregate per each provider’s retention settings; not tied to your identity.
• Server logs: retained only as long as needed for security and reliability.

How we share information

We do not sell your personal information. We disclose information only: (a) to the service providers listed above, to operate the site; (b) if required by law, legal process, or to protect rights and safety; or (c) in connection with a business transfer, in which case this policy will continue to govern your information.

Your privacy rights

We try to honor privacy requests from everyone, regardless of where you live.

• Access / deletion: request a copy of the personal information we hold about you (your email address), or ask us to delete it, at contact@2cb.com.
• California (CalOPPA / CCPA-aware):California residents may request access to and deletion of personal information and may opt out of any “sale” of personal information. We do not sell personal information. We will not discriminate against you for exercising your rights.
• EU/EEA/UK (GDPR-aware): you have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Where we rely on consent (the newsletter and GA4), you may withdraw it at any time. You may also lodge a complaint with your local data-protection authority.
• Do Not Track: because there is no common standard, we treat minimal-data collection (and consent-gated GA4) as our default regardless.

Children’s privacy

This site is intended for adults (18 and older) and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under 13 under COPPA). If you believe a child has provided us information, contact contact@2cb.com and we will delete it.

Security

We take reasonable measures to protect the limited information we hold. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the site evolves or the law changes. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice where appropriate.

Contact

Privacy questions or requests: contact@2cb.com.