Privacy policy

Version 2, in effect since Oct 22, 2026, 9:36 PM (New York time)

NSEW Trading Company LLC ("NSEW", "we" or "us") makes the Ripe Rewards app for our licensed adult-use cannabis store at 245 Broadway, Suite 4, Schenectady, NY 12305. This policy explains what the app collects, why, who sees it, how long we keep it and the choices you have. It covers the app on iPhone and Android, the web version of the app, and our website at rewards.ripecannabisny.com. It does not cover the store's own in-store records, such as its sales records.

In short: your account is your email address. We don't ask for your name, phone number, date of birth or home address. We don't sell your information or use it for advertising, and the app contains no advertising or analytics trackers.

When you sign in, by tapping Agree and email me a code, you consent to our collecting and using your information as this policy describes.

1. What we collect

Your email address. You sign in with it, and it identifies your account. We email a sign-in code to it when you sign in. We also keep the address without any +tag (and, for Gmail, without dots), so that one inbox has one account.

Your answers to our entry questions. We record that you confirmed you are 21 or older and that you confirmed you are in New York, when you did, and whether New York was confirmed from your location or from the state you chose. We don't collect your date of birth.

Your location, only if you choose to share it. On iPhone and Android, if you tap Use my location, the app gets your approximate location once, uses your phone's location service to work out which state that is, and sends us only whether you are in New York. We never receive or store your location. The web version asks you to choose your state instead.

Your device. The app creates a random ID for each installation. We record the type of device (iPhone, Android or web browser), the app version, when the device last used the app and, if you turn on notifications, the token that lets us send them to that device.

Device checks. To keep the promotion fair, the iPhone app uses Apple's App Attest and the Android app uses Google's Play Integrity to confirm that it is a genuine copy of the app on a real device, and the web version uses Cloudflare Turnstile to tell people from automated programs. We keep the result of each check (passed, failed or missing) and when it happened. On iPhone we also keep the key that App Attest creates for your installation.

Your promotion activity. For each spin: when it happened, the promotion and the published odds it was drawn against, the result and the device used. For each prize: its code, value, expiry date and whether it has been used. When you use a prize at the counter: when, which employee handled it, whether its code was scanned or typed, the receipt number of that sale if staff enter it, and any note staff add, such as the details of a dispute. We also record which versions of the official rules, these terms of use and this privacy policy you accepted, and when.

Your notification choices, and a record of the notifications we send you.

Sign-in and technical records. Our sign-in service keeps a record of each sign-in, including the IP address it came from. The services that host the app keep standard request logs, which include IP addresses, for a short time.

Messages you send us, if you contact support.

2. How we use it

To run the promotion: to sign you in, confirm you are eligible, record your spins, give you your prizes, and let the store check and redeem them at the counter.

To keep the promotion fair: to hold everyone to one spin a day, to find and stop abuse such as automated programs, emulators and multiple accounts, and to settle disputes about prizes.

To send the notifications you turn on: the daily spin reminder and store updates.

To keep the records that New York's cannabis rules require of licensed retailers, and to respond to the Office of Cannabis Management and other authorities when the law requires.

To answer your questions, and to protect the rights and safety of our customers, our staff and our business.

We don't use your information for advertising, sell it, or share it for anyone else's advertising. We don't combine it with information from other companies or track you across other apps or websites.

3. Who sees it

Our staff, as far as their jobs need. Budtenders see a prize, and whether it can be used, when you show it at the counter; if they type the prize's code instead of scanning it, they ask you for the first four letters or digits of your email address, and the app checks them. Managers and owners can look up an account to help you or to settle a dispute, and each time one of them opens an account showing its full email address, that is logged.

Companies that run parts of the app for us, each receiving only what its job needs: Supabase, which hosts our database and sign-in service in the United States; the email service that sends your sign-in codes; Expo, which delivers notifications through Apple and Google; Apple and Google, which run the device checks and deliver notifications, and whose location services work out your state on your phone; Cloudflare, which hosts the web version and our website and runs the web version's check; and GitHub, which stores our encrypted backups.

Authorities, when the law requires it: the Office of Cannabis Management, courts and law enforcement. We may also share information when needed to protect someone's safety.

A buyer, if our business or the app is sold. The buyer would have to honor this policy for the information it receives.

We share your information with no one else.

4. How long we keep it

While your account is open, we keep the information above, with these limits: records of notifications for 90 days; records of sign-ins for 90 days; a device's notification token until the device goes 180 days without opening the app; and an email address that received a sign-in code but never finished signing in, for 7 days.

If you delete your account, you are signed out on every device, and prizes in your wallet can no longer be used. Thirty days later we erase your email address, your devices and their notification settings, and our sign-in records about you. Until then, signing in again restores your account.

After that, your spin, prize and redemption history, and your acceptance of the official rules, are kept for five years under an anonymous ID, because New York's cannabis rules require licensed retailers to keep records showing that their promotions comply. Our records of staff actions keep your email address only masked, as its first character and its domain.

Backups: our database host keeps daily backups for 7 days, and we keep encrypted nightly backups for 35 days, so information we erase can remain in a backup for up to 35 days after it is erased. Backups are used only to recover from a failure, and if one is ever restored, our daily cleanup erases the deleted accounts again.

5. How we protect it

Everything the app sends and receives is encrypted in transit. Staff sign in with a password and a second factor, and each role sees only what it needs. Every change staff make is recorded in a log that cannot be edited. Our backups are encrypted, and the key that opens them is not kept with them. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

6. Your choices

Notifications are off until you turn them on. Turn them on or off in the app under More, then Account, or in your phone's settings. The web version does not send notifications.

Sharing your location is optional: you can choose your state from a list instead.

To delete your account, open the app and go to More, then Account, then Delete account, or visit rewards.ripecannabisny.com/delete-account. If you can no longer reach that email address, email ripecannabis@gmail.com with the address, and once we have checked the request, we will delete the account for you.

7. Adults only

Ripe Rewards is only for adults 21 and older. We don't knowingly collect information from anyone younger. If we learn that someone under 21 has an account, we close it.

8. Browser storage and cookies

The web version keeps your sign-in and its own settings in your browser's storage on your device. Neither the web version nor our website sets cookies. Cloudflare's check runs in a frame from Cloudflare, under Cloudflare's own privacy policy. Because nothing in Ripe Rewards tracks you across other websites or apps, it works the same way whether or not your browser sends a Do Not Track signal.

9. Changes to this policy

When we change this policy, we post the new version in the app and on our website with the date it takes effect. If a change affects how we use information we already have, we will tell you in the app before it takes effect.

10. Contact us

NSEW Trading Company LLC, 245 Broadway, Suite 4, Schenectady, NY 12305. Email: ripecannabis@gmail.com.