Privacy Policy

Who runs Grams Left

Grams Left is operated by MorpheOS Ltd. Grams Left is the first app/SaaS product launch from MorpheOS Ltd. ICO registration is in progress and details will be added once available.

1. What We Collect

We collect the minimum data needed to provide the service: your email address (via Clerk, for account access), consumption logs (method, amount, time, strain/product), stock and inventory data, and subscription status.

Some tracker information may reveal health, prescription, or medical cannabis use information. This is treated as special category data under UK GDPR and processed only with your explicit consent.

2. How We Use Your Data

Your data is used solely to provide the Grams Left service — displaying your tracker, computing estimated balances, and managing your subscription.

We collect limited product usage information to understand whether Grams Left is working, improve the service, fix bugs, prevent abuse, measure subscription performance, and understand where users get stuck.

Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

Consent (Article 6(1)(a)) — You consent at sign-up to the processing of your tracker data.
Explicit consent for health data (Article 9(2)(a)) — Your consumption logs and prescription information constitute special category data. You provide explicit consent for this processing at sign-up. You may withdraw consent by deleting your account.
Contract (Article 6(1)(b)) — Processing necessary to provide the subscription service you have purchased.
Legal obligation (Article 6(1)(c)) — Processing required to comply with UK tax and regulatory requirements.

3. Data Storage and Processors

Your data is stored in Cloudflare D1 (SQLite at the edge) and is encrypted in transit and at rest. We use the following processors:

Cloudflare — hosting and database (D1, R2 backups)
Clerk — authentication (stores your email and login credentials separately)
Stripe — payment processing (does not access your tracker data)
Sentry — server-side error reporting with sensitive fields scrubbed
Google Analytics — optional product-usage analytics only if you choose to help improve Grams Left
Listmonk — service/account emails, invite delivery, and optional product updates where you opt in
Better Stack — uptime monitoring (pings our health endpoint only)

Data-processing terms for the processors above are being verified before launch and will be kept with the internal compliance records.

4. Our Privacy Promise

We do not sell your personal records. We do not sell, share, or broker your cannabis, prescription, consumption, strain/product, or account data to clinics, pharmacies, advertisers, insurers, employers, or data brokers. We do not use your cannabis, prescription, strain/product, or consumption records to target adverts.

5. Aggregated Milestones

We may publish broad aggregated product milestones, such as the number of users, active trackers, or logs recorded. These statistics are rounded, aggregated, and designed not to identify individual users. We do not publish individual tracker records, strain/product details, prescription details, dose amounts, notes, or small-cohort statistics that could identify a person.

6. Future Sponsorship and Adverts

Grams Left may introduce clearly labelled sponsorships, partner messages, affiliate links, or contextual promotions in future. These will not be based on your cannabis, prescription, strain/product, or consumption records. If optional cookies or similar technologies are required, we will request consent where required by law.

7. Cookies

Grams Left uses essential authentication cookies via Clerk and a first-party age-check cookie. Optional Google Analytics product-usage measurement is disabled unless you choose "Help improve Grams Left" in the cookie banner. Analytics is limited to broad page and product-usage signals. We do not use advertising cookies, and cannabis records, strain/product names, prescription details, dose amounts, consumption logs, and notes are not sent to analytics.

Current choice: essentials only.

8. Data Retention and Deletion

Your data is retained for as long as your account is active. You may export your data at any time (JSON or CSV) from the Settings page. You may delete your account and all associated data from Settings. Deletion removes your data from our active database. Daily backups are retained for up to 30 days for disaster recovery.

9. Your Rights

Under UK GDPR, you have the right to access, correct, export, and delete your data. Contact us to exercise any of these rights.

10. ICO Registration

ICO registration is in progress and details will be added to this page once available.

11. Contact

For privacy-related questions, contact support@gramsleft.com.