Cookies

This policy explains what Canopy stores in your browser. It applies to canopy-os.com (staff dashboard, member portal, and marketing pages).

We do not currently use advertising, analytics, or social-media cookies. Error monitoring (Sentry) sends crash reports from the browser without setting advertising cookies, and session replay is off. Because of that, we do not show a cookie consent pop-up. If we add non-essential cookies later, we will ask for permission first (LSSI Art. 22.2 and AEPD cookie guidance).

Strictly necessary

• Auth.js / NextAuth session (authjs.session-token or __Secure-authjs.session-token): staff login. HttpOnly session cookie.
• canopy_member_portal: member portal JWT (about 24 hours).
• canopy_patient_portal: legacy member PIN session; being retired.
• NEXT_LOCALE: remember language (en, es, th).

Preferences stored on your device (not advertising)

These live in localStorage or similar, not as tracking cookies:

• Theme (light / dark) — so the interface does not flash the wrong colours
• canopy:landing-audience — whether you last opened the site as a dispensary or a member
• Staff-only keys such as active location, workstation, and POS drafts — cleared on staff logout
• Electron scale configuration on the desktop till — kept as a device setting

You can delete site data in your browser settings. Logging out of staff Canopy clears session-scoped canopy_* keys but keeps theme and landing-audience so the next visit is usable.

How long

Session cookies last for the login session or the portal token lifetime. Language and theme stay until you clear them.

Contact

Questions: privacy@canopy-os.com. See also the Privacy policy.