01Who runs this site
sebastiantidwell.com is run by Sebastian Tidwell, a cannabis compliance and METRC consultant based in Tulsa, OK. "We", "us" and "our" in this policy mean Sebastian Tidwell and this website. "You" means anyone who visits the site or uses its API or MCP server.
Questions about this policy or your data: [email protected], or the contact form.
02Browsing the site
You can read every public page, including the state map, state resources, bulletins, the API docs and the games, without an account. When you do, we receive what any web server receives:
- your IP address, browser type (user agent), the page requested, the time, and the referring page, in standard server and network logs;
- aggregate counters (for example, how many requests an API endpoint served and how long they took). These counters contain no IP addresses, usernames or browser details.
We use this to keep the site running, secure and fast: spotting errors, blocking abuse and enforcing rate limits. Server logs are deleted automatically after 31 days and performance counters after 30 days.
Our network provider (such as Cloudflare) may also process this request data, including privacy-focused, cookie-free traffic measurement, under its own privacy policy.
03Cookies and browser storage
The site sets only two cookies, and only when you sign in or use a form:
- admin_token: keeps you signed in. It lasts 24 hours, or 30 days if you choose "remember me", and is deleted when you sign out.
- csrf_token: protects forms against cross-site request forgery. It lasts 24 hours.
Both are essential, "httpOnly" cookies (page scripts cannot read them). We do not use advertising, analytics or cross-site tracking cookies.
The site also saves a few preferences in your own browser (localStorage). They never leave your device unless noted:
- your chosen theme, and whether daily rotation is on;
- game progress, settings and high scores;
- cached state resource lists (refreshed after 24 hours) and your default search state;
- whether you dismissed the notification prompt.
As an installable web app, the site also caches pages and files in your browser so it loads quickly and works offline. Clearing your browser's site data removes all of the above.
04Accounts
An account is optional. It is needed for API keys, bulletin notifications and some tools. To create one we collect only a username and a password. We do not ask for your email address or real name.
- Passwords are stored as a one-way bcrypt hash, never in readable form.
- We record when the account was created and last signed in, its role, and which tools it can use.
- Repeated failed sign-ins are counted briefly in memory to lock out password guessing. That count is not saved.
Site administrators can see account usernames, roles, permissions and sign-in dates. They cannot see passwords.
05Contact form
When you send a message through the contact form we store your name, email address, message and the time it was sent. We use it only to read and reply to you. The form does not record your IP address, although the server and network logs described above still apply.
When a message arrives, a short notification (your name and the first part of the message) is pushed to the site owner's devices. We may use software tools, including AI assistants connected through our own MCP server, to read, search and organise messages. We do not add you to any mailing list.
Messages are kept until they are deleted. Ask us and we will delete yours.
06Bulletin notifications
If you turn on notifications (this needs an account), your browser gives us a push "subscription": an address at your browser maker's push service (such as Google, Mozilla or Apple) plus encryption keys. We store it with your account, the topic you chose, and your browser's user agent so you can tell devices apart.
Notifications are delivered through that push service, which receives the notification text (for example, the title of a new bulletin). Turn notifications off in the site or your browser settings and we stop sending. Subscriptions your browser reports as expired are deleted automatically.
07API keys, the API and the MCP server
Signed-in users can create API keys for the REST API and the MCP server. We show the key once and store only a one-way hash of it, its first 8 characters (so you can tell keys apart), its name, and when it was created and last used.
Requests to the API and MCP server are rate limited by IP address or key. Those counts are held in memory only and not saved. We do not log the contents of your requests, apart from short excerpts of search queries kept in server logs for up to 31 days to diagnose problems.
08AI features and your OpenAI key
Some tools (AI answers on bulletin search, and the voice trainer in the members-only study area) can use your own OpenAI API key, if you choose to add one to your account. The key is stored encrypted and you can remove it at any time.
When you use these features, the content needed to answer (your question and the relevant bulletin text, or your voice recording and practice prompt) is sent to OpenAI under your OpenAI account, and OpenAI's terms and privacy policy apply to it. Nothing is sent to OpenAI unless you add a key and use these features. Ordinary bulletin search runs entirely on our own server.
09Members-only study area
Invited members can use a private study area. It stores lesson progress, quiz results, saved items, a daily goal, an optional display name and avatar, and your time zone. Depending on the visibility you choose (cohort, friends or private), your display name, avatar, points and streaks may be shown to other members on leaderboards. Microphone access is requested only there, only when you start a voice exercise.
10Other services your browser contacts
A few pages load files from outside services, which receive your IP address and browser details when they do:
- the interactive US map loads its outline data from jsDelivr (cdn.jsdelivr.net);
- maps in the members-only study area load tiles from CARTO and Esri ArcGIS;
- links to LinkedIn, Instagram and other sites take you to services with their own privacy policies.
Fonts are served from our own server, and we embed no social media widgets, ad networks or video players.
11Public records about licensed businesses
The site republishes public information from state regulators, including METRC bulletins and licensed-business records (business name, licence number, location and, where the state publishes them, business contact details). This comes from public government sources. Business contact details are not returned in API search results by default. If a record about your business is wrong or out of date, tell us and we will correct or remove it here. The official record stays with the state regulator.
13Security and where data is kept
The site runs on servers managed by Sebastian Tidwell in the United States. Traffic is encrypted with HTTPS. Passwords and API keys are stored only as hashes, OpenAI keys are encrypted, and administrative tools require sign-in. The database is backed up so data can be recovered after a failure.
No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires, as far as we are able to reach you.
14How long we keep data
- Server logs: 31 days. Aggregate performance counters: 30 days.
- Accounts, and everything linked to them (API keys, notification subscriptions, study progress): until the account is deleted.
- Contact messages: until deleted, on request or at our discretion.
- Browser storage: until you clear it.
Deleting an account also deletes its API keys, notification subscriptions and study-area data. Copies in backups are overwritten on the normal backup cycle.
15Your choices and rights
You can:
- use the public site without an account and without giving us any personal information;
- turn off notifications, delete API keys and remove your OpenAI key from your account;
- ask for a copy of your data, a correction, or deletion of your account or messages, by emailing [email protected]. There is not yet a self-service delete button, so we handle these requests by hand, normally within 30 days.
Depending on where you live (for example California, Colorado, Virginia, or the EU and UK), you may have further rights under local law, such as the right to know, access, correct or delete personal information, and to object to certain uses. We honour those requests wherever they apply. We never sell or "share" personal information for cross-context advertising, so there is nothing to opt out of.
To protect your account, we may ask you to confirm you control it before acting on a request.
16Children
The site is for professionals and adults interested in cannabis regulation and compliance. It is not directed to children, and accounts are for people 18 and older. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, contact us and we will delete it.
17Changes to this policy
If our practices change we will update this page and its "Last updated" date. If a change materially affects how we use information we already hold, we will say so prominently on the site before it takes effect.