Tokr™ understands that your information is important, and we only share it in certain circumstances:

4.1 With Other Tokr™ Users

Some of your information is visible to other users by the nature of the app’s functionality:

 - Public or Shared Content: When you post UGC (videos, comments, etc.), other users (or followers)
can see that content along with your username and any profile info you’ve made visible. If your
profile is public, anyone on Tokr™ can see your posts. If private, only approved followers can. Keep in
mind, if a follower can see your content, they could potentially screenshot or share it externally
(violating our Terms, but it’s possible), so treat any content you post as potentially shareable.

 - Profile Information: As mentioned, your username and photo are always visible to others in
association with your content. Other profile details (like bio or city) are visible if your profile is public
or to your followers if private. Your email or real name (unless you choose to put your real name in
the profile) are never displayed to other users.

 - Social Interactions: If you follow someone and they approve, they can see that you are a follower. If
you comment on a video, other users viewing that video can see your comment and profile name. If 

you like a post, the creator may see your username in the list of likes (depending on feature). We
may also show mutual followers or friends if you connect contacts (though Tokr™ does not currently
import contacts, if we did, we would ask permission first).

 - AI Budtender Q&A: If we implement a community feature where AI Q&As can be made public (for
example, a forum of questions answered by the AI), we would only do so either with your content
anonymized or with your consent. By default, your AI questions are private. We do not show your
individual AI conversations to other users.

​

4.2 With Service Providers (Processors)

We share information with third-party companies that perform services on our behalf. These service
providers only get access to the data necessary for their function, and they are contractually obligated to
protect it and use it only for our specified purposes . Key service providers include:

 - Hosting and Infrastructure: We use cloud providers (like Supabase’s hosting or Firebase’s cloud
services) to store and manage data. They might host our databases, user content, and backups. They
technically process all user data that lives in our database or file storage, but they have no
independent right to use it.

 - Authentication & Account Tools: Google Firebase Authentication is used when you log in. In that
process, your credentials and tokens pass through Google’s systems securely. Similarly, if we send
verification emails or SMS (not currently in Tokr™, but if we did), we’d use providers for that.
Analytics: We use Firebase Analytics (Google) to gather usage data and Crashlytics for crash
reporting. These tools receive device and usage info (described in 2.2) and aggregate it for us.
Google may have access to some device identifiers and IP through these services, but cannot use the
data for their own purposes beyond providing analytics to us. We’ve configured these services to the
extent possible to not collect unnecessary data.

 - Video Processing (Mux): Our video partner Mux receives your uploaded videos to encode and
stream them. They also collect streaming stats. They act as a processor to deliver video to viewers.
They may temporarily cache or store video content on their servers (for streaming efficiency), but
they do not have rights to use the videos beyond streaming to Tokr™ users.

 - Content Moderation Tools: We might employ automated moderation services (for example, an AI
that detects nudity or hate speech in videos). If we do, your content could be sent to those services
for analysis. Such providers are typically bound to only use the data for analysis and not retain it
longer than needed. We also have human moderators (internal or contractors) who might view user
content and reports. All personnel with access to personal data are bound by confidentiality and
undergo training on privacy.

 - Advertising Partners: If we serve ads, we might use an ad-serving platform. For instance, if we
partner with an ad network specialized in cannabis (ensuring compliance), we might need to share
non-identifying info like “show this ad to users in X region”. We will not share personally
identifying info (name, email) with advertisers. If an ad network uses cookies or IDs to deliver
ads, we will obtain necessary consent for tracking. Some advertisers might require confirmation that
an impression or click happened – in those cases an ad impression pixel might collect your device ID
or IP for the sole purpose of verifying and counting the ad delivery. We contractually require any
such partners to use data only for ad delivery and measurement, not for profiling outside Tokr™,
and to comply with Apple’s Ad Tracking Transparency rules (meaning no tracking without opt-in) .
Also, per Apple guidelines, our app allows users to report ads that are inappropriate , which
goes through our system to inform the ad provider (though that report usually does not send your
personal data, just context of which ad).

​

 - Email/Communication Tools: If we send emails (for support or newsletters), we might use an email
service provider which will handle your email address and the content of the message. Similarly,
push notifications might go through Apple’s push notification service.
All these providers are vetted for strong privacy and security practices. We maintain agreements (like Data
Processing Addendums) with them to ensure they comply with laws like GDPR, CCPA, etc., where applicable.
We list our major third-party processors in this policy (see above), and we will update the list if we add
significant new ones. If you need a full list of sub-processors, you can contact us.

​

4.3 With Business Partners

At this time, Tokr™ does not extensively share personal data with business partners (like co-marketers or
researchers). However, if we run a promotion or partnership (say, a contest sponsored by a cannabis brand),
we might share winners’ contact info with that sponsor only if you participate and with your consent. We will
always tell you at the point of collection if information will be shared with a third party for their own use,
and you will have a choice (e.g., checking a box to agree). We will not sell or rent your information.

If you use some integrated feature such as ordering through a dispensary (hypothetical future feature),
your information necessary for that transaction would be shared with that dispensary (like order details and
your contact/delivery info). But as of now, Tokr™ itself does not process orders – we purely link or refer.

​

4.4 For Legal Reasons

We may disclose information to third parties (including government agencies or courts) if we, in good faith,
believe that such disclosure is necessary to:

 - Comply with a legal obligation: This includes responding to lawful subpoenas, warrants, or court
orders, or other legal process. We will verify any request to ensure it has appropriate authority
before disclosing. If a request is overly broad, we may challenge it. Where allowed, we might notify
you of such requests (unless prohibited by law or if we believe doing so would be futile or
dangerous).

 - Protect rights and safety: We might share data to enforce our Terms of Use or other policies (e.g.,
sharing info with law enforcement about someone posting content that is part of a criminal act). We
may also share data if needed to protect our rights, property, and safety or that of our users or
the public. For instance, if we suspect fraudulent activity or an imminent threat, we might alert
authorities or relevant third parties (like informing a user’s ISP of a security issue related to them).

 - Address fraud or security issues: Information (like IP addresses, account activity) might be shared
with cybersecurity consultants or law enforcement if we are investigating fraud, hacking, or other
security incidents.

 - Merge or Sell our Business: This is not exactly legal reasons, but for completeness – if Tokr™ is
involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership,
sale of assets, or transition of service to another provider, your information may be transferred as
part of that transaction. We would ensure the successor respects your privacy rights and this Policy
(we would contractually require the data to remain protected or seek your consent where required
by law).

​

4.5 In Aggregated or De-Identified Form

We may share information that has been aggregated or anonymized, so it cannot reasonably be used to
identify you. For example, we could publish usage trends (like “X% of Tokr™ users prefer strain Y” or “We have
N users in California”). We could also share aggregated analytics with industry partners or research
organizations interested in cannabis use trends, but this would not include personal data. Apple’s
guidelines encourage privacy, so we ensure that such data has all personal identifiers removed and cannot
be re-associated with individuals.

​

4.6 Your Sharing

Keep in mind that any information you share via Tokr™ (in public content or privately to other users) can of
course be seen by those recipients. Tokr™ is not responsible for what other users do with information you
make available to them, so choose what you share wisely. If you join in-app forums or groups, those
communications may be visible to the group. If you share a link to your Tokr™ profile externally, anyone with
that link (who can access the app) might see your content depending on your privacy settings.

We do not facilitate any search engine indexing of your profile or content at this time – your Tokr™ content
is within the app environment. But if we ever had a public web feature, we would inform you and allow
opting out.

To summarize, we do not share your personal info except as needed to provide the service and as
permitted by you or by law. We strive to be transparent about any third-party data sharing. If you have
questions about specific sharing, contact us.

​