Last updated 7 October 2026
420 Maps is a directory of cannabis social clubs. Every club has a public page that anyone can open; the map, the full list of clubs and search are for members, who need a free account and must be signed in. This page says exactly what we hold, why, who else can see it, how long it stays and how to get rid of it. It is written to be read rather than survived, and it describes what the software actually does — not what a privacy policy usually says.
Signed in or not, there are no analytics scripts, no advertising pixels and no third-party cookies on this site. We do not build a history of the pages or listings you looked at. Private account and sales reporting is described below.
Two things do happen, though, and it would be wrong to say "no tracking" without naming them.
These stay on your device. They are not sent to us, and we cannot read them.
| What | Why, and how long |
|---|---|
420maps-age-confirmed, in session storage |
Remembers that you confirmed you are 18 or over, so the age screen does not reappear on every click. Gone when you close the tab. |
420maps-account-state, in local storage |
Your saved clubs, your language choice, and — when you are signed in — your name, email address, account id, any 420Pass activity and which clubs you manage. It is what lets the page reopen where you left it. It stays until you clear your browser data or sign out. If you share a computer, sign out, or use a private window. |
To draw a map at all, your browser has to ask someone for map tiles. Those companies see your IP address as part of answering, in the ordinary way any website you visit does:
We load no third-party fonts. The map page loads the mapping resources listed above. If you open the 420Pass checkout and choose to connect a wallet, the wallet connection may contact Reown / WalletConnect relay and API services and the blockchain RPC services needed for the network you choose. Those services receive the network information needed to provide the connection and, like any internet service, your IP address. We do not send them your 420 Maps password or ID document. The map's "find my location" button uses your browser's own location permission; the coordinate is used to move the map on your screen and is never sent to us.
The site runs on Google Cloud Run, which records a line per request — time, page, result code, and your IP address and browser user-agent — in Google Cloud Logging. We use it to keep the service running and to investigate abuse. Our own application code deliberately logs almost nothing: when something fails it records the type of error and nothing about you.
Anybody can read the club pages one at a time. To stop them being copied in bulk, our server counts how many club pages each IP address opens in an hour. The count is kept against a one-way keyed hash of the address, never the address itself, and is deleted automatically within three days of the last page opened. Search engines whose crawlers we can verify are let past the limit.
The local storage preference 420maps-directory-height remembers the mobile directory height you choose. It contains only a screen-height ratio and is not sent to the server.
Club managers can connect the Google account that manages their establishment, once Google approves our Business Profile API access. We request Google's business.manage permission, use read operations only and do not edit Google profiles. The verified email must match the signed-in 420maps account. Google access supports an ownership request; our team must independently approve editing authority. We do not import Google addresses, photos or coordinates into the public directory.
The verification results are encrypted and expire after 15 minutes; expired results are removed by the scheduled worker. Google access and refresh tokens are never stored. When you submit a claim, the selected profile, verified Google identity and email are retained privately with the ownership evidence for operator review. Write to hello@420maps.co if you need manual verification or removal.
You may upload an optional profile photo, visible only through your own signed-in account, and supply an optional country of residence, city/region and age range. We remove image metadata and resize profile photos. You can supply these optional answers at email signup or in your Profile. Signup answers are initially held by Supabase Auth and copied into the member profile when you activate it. These answers help us understand the audience. Saving or clearing your Profile also removes the original signup answers from Supabase Auth. Geography and age statistics use answers supplied by members, with missing values shown as unknown. We do not infer age or residence from email, Google profiles, GPS or IP addresses, and we do not reuse the date of birth supplied for a pass for demographic statistics.
Only authorised platform operators can use the private management dashboard. It shows registered-account and activation counts, signup and last sign-in dates, account display names and email addresses, optional demographic answers, and completed-sale totals and references. It excludes test purchases from revenue. Registered accounts include accounts that have never purchased and are not presented as paying customers. Individual answers are not published on the directory or disclosed to club managers. Our application database stores the optional demographic answers with the member account, until you clear them or delete the account.
Owner-access, listing and advertising enquiries use your verified account email and the details you enter. They are emailed to hello@420maps.co. An enquiry does not grant ownership or editing rights. Completed purchases generate an internal notification to hello@420maps.co containing the sale reference, venue, amount, network and transaction reference; it contains no identity document or date of birth.
| What we hold | Why |
|---|---|
| Your email address, your display name, and your password stored only as a hash we cannot reverse | To have an account, to sign you in, and to send you the confirmation and password-reset emails you ask for |
| If you use Sign in with Google: your name, your email address, whether Google has verified it, and your Google account identifier | Google supplies these when you choose that button, so we can recognise you without a password. We ask Google for nothing else — no contacts, no calendar, no files, no profile browsing. We do not keep Google's own access tokens: they are discarded the moment you sign in, because we never call Google on your behalf. |
| The date and time you confirmed you are 18 or older | Every way of signing in asks for it, and the account keeps the moment you first gave it. It is your statement, not a check we have carried out. |
| A session record: a hash of your session identifier, and your own sign-in tokens held encrypted with a separate key | To keep you signed in for up to seven days without storing anything that would let someone else use your session |
| Reviews and photographs you publish, and your display name beside them | That is the point of a member review. Every member who is signed in can read them; a club's public page shows only how many there are and their average. A club's logo appears on its public page, which anyone can open; its other photographs are for members. |
| What you write when you ask to manage a club listing | To check you are entitled to speak for that club. We ask you to explain your authority in writing; we do not collect identity documents, and there is no way to upload one. |
| A record of security-relevant actions tied to your account id — signing in with Google, resetting a password, posting a review, submitting a manager claim, editing a listing, uploading or removing a photo | So that a dispute or a misused account can be investigated. It records who, what and when. It does not record your IP address or your browser. |
| Counters that limit how often an email address or address can be used to request emails or attempt sign-ins. The address itself is stored only as a one-way hash, never in readable form. | To stop somebody hammering the reset form or using us to send mail to strangers |
| If you start a 420Pass booking: the holder name, date of birth and country you enter, with the club and dates | A club may lawfully need to check age and identity at the door. 420Pass is not on sale yet and nothing is charged; if you start a booking anyway, this is what it keeps. |
Your email address is held by Supabase, our authentication provider, and is deliberately not copied into our own database — which holds the member profile, optional demographic answers and records described above. The private operator dashboard reads the account email from Supabase for account administration; it does not store a separate contact list.
One cookie: maps_session. It carries your session identifier and a token that
protects forms from being submitted by another site. It is HttpOnly and Secure, so scripts
cannot read it and it only travels over HTTPS, and it lasts seven days. During a Google sign-in
it briefly carries one encrypted value used to complete that sign-in, which expires by itself
after ten minutes.
It is strictly necessary to sign you in, so there is no consent banner — and there is nothing else to consent to, because we set no analytics or advertising cookies at all.
420 Maps is for adults. You confirm you are 18 or over before the map opens, and again when you sign in or create an account, whether by email or with Google; the account keeps the moment you first confirmed it. That confirmation is your statement rather than a check we have carried out. If we learn an account belongs to someone under 18 we delete it.
hello@420maps.co. Danish company.These act only on our instructions, under contract. Everything above is in the EU.
We do not sell your data. We do not share it for advertising. We have no advertising network on this site.
The site has an operator role for publishing decisions. Through the app, an operator can see every club listing including unpublished ones, the written evidence behind each decision, and the text people write when claiming to manage a club. The database itself prevents an operator from reading the member list, other people's sessions, or any member's email address.
Beyond the app, the owner of the 420 Maps infrastructure has administrative access to the database and the authentication system, and can therefore see everything held there, including email addresses. That access exists to run and repair the service and is used for that.
We keep personal information only for as long as we reasonably need it for the purposes described on this page.
While your 420 Maps account is active, we keep the account information needed to provide and secure it. If you close your account or ask us to delete it, we delete or anonymise the personal information we no longer need — apart from anything we have to keep for a limited period for a legal obligation, for fraud prevention, for security, to resolve a dispute, to enforce our Terms, or to establish, exercise or defend a legal claim.
Some information may remain for a short time in secure backups until those backups are overwritten in the normal cycle. Backup copies are not used for ordinary account activity.
Here are the actual periods, not just the principle:
| What | How long |
|---|---|
| Your account, display name and email address | While the account is active, and until you close it or ask us to delete it |
| Reviews and photographs you posted | Until you delete them or ask us to. If you close your account, tell us whether to remove them or to leave them without your name. |
| Session records and the encrypted sign-in tokens | Deleted when you sign out and when a password is reset, and automatically one day after the session expires — a job runs nightly |
| Abuse counters (the hashed ones) | Two days, then deleted by the same nightly job |
| The security record of account actions | 24 months from the event, then deleted automatically by the nightly job. The one exception is below. |
| Manager-claim text and our decision | While the manager access lasts, and 24 months after it ends |
| Reports sent through /report | 24 months after we have dealt with them, so a repeat problem can be recognised |
| 420Pass booking details | 24 months, for consumer and tax records. Longer only while a dispute is open. |
| Server request logs, including IP addresses | Held by Google Cloud Logging on our project, under the retention set on that log store rather than record by record |
An individual security record may be kept beyond 24 months where it is specifically needed for an active security or fraud investigation, a live legal dispute, or a legal obligation — and only until that purpose ends.
That exception is deliberately narrow, and it is built that way rather than promised that way. Keeping a record past 24 months takes a hold placed on that individual record, by hand, with a written reason recorded against it. Nothing sets a hold automatically, the application cannot set one at all, and the nightly job reports how many held records exist so that a hold outliving its investigation is visible rather than forgotten. Everything not held is deleted on schedule.
Where the law requires us to keep particular information for a set period, we keep it for that period and delete or anonymise it when the requirement ends.
You can ask for a copy of what we hold about you, have it corrected, have it deleted, take it somewhere else, restrict what we do with it, or object to us relying on legitimate interests. Write to hello@420maps.co and we will answer within one month.
Two honest notes about deletion. There is no delete-account button yet — ask us by email and we do it by hand; we are building the self-service version. And a published review is written about a club for other members: if you close your account, tell us whether you want your reviews removed with it or left in place without your name, and we will do what you ask.
If you are not satisfied with how we have handled something you can complain to the data protection authority where you live. In Spain that is the AEPD.
Club listings are built from information that is already public — official address registers, open map data, clubs' own websites and public social profiles, public business listings — and from what verified club managers tell us. They are not built from members' accounts or reviews.
Listings describe organisations, not individuals. We do not publish the names of club owners, staff or members, and we do not want them: do not send us anyone's personal details, and do not post photographs of other people's faces, documents or membership cards.
If you run a club, or appear in a listing, and want it corrected or removed, use 420maps.co/report or write to hello@420maps.co and say which club you mean. Tell us what is wrong and we will check it against our sources.
Photographs uploaded by verified club managers are re-encoded when they arrive, which removes the camera and location data that phones embed in an image file — the GPS coordinates of where a picture was taken never reach our storage. Photographs are held in a private store and served through our own server, so your browser never talks to the storage provider directly.
If this page changes, the date at the top changes with it. If we start collecting something new or use something differently, we will say so in the app before it takes effect rather than quietly editing this page.