YOUR INFORMATION · PLAIN ENGLISH
Privacy policy.
What we collect on theshroomverse.com, why we collect it, who helps us handle it, how long we keep it, and what you can ask us to do with it.
Last updated
Who we are
Shroomverse is a business based in Toronto, Ontario, Canada. It runs theshroomverse.com, including the Journal, the films pages and the shop. In this policy, “we” and “us” mean Shroomverse.
We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). For any privacy question or request, contact us:
- Email: sales@theshroomverse.com
- Phone or text: (416) 618-1454
What we collect and why
We collect only what we need for the thing you are doing. If you only read the site, we do not ask you for anything.
Your account
To create an account you give us your name, your email address and a password. We store the password only as a one-way scrambled form (a hash), never as you typed it. You can add a phone number later on your account page. When you sign in, we keep a session record so you stay signed in; it includes the IP address and browser type the sign-in came from. To protect accounts, we also count sign-in and sign-up attempts by IP address.
We use these details to run your account, confirm your email address, let you reset your password, save your cart and show your order history. We send these account emails: the email-confirmation link, a welcome note, and password-reset links when you ask for them.
Your orders
When you place an order we collect your first and last name, email, phone number, delivery address (including apartment, city, province or region, postal code and country), any delivery notes you write, your chosen delivery window, the payment method you pick, and any promo code. We store this with the items, prices and status of the order.
We use it to prepare and deliver the order, contact you about it, and keep business records. We email you a receipt, updates when your order’s status changes, and, if an Interac e-transfer is still unpaid a few hours after checkout, one payment reminder. Each order also has a private tracking link that shows its status, items and delivery city, but not your address, phone or email.
Payment
We do not take card payments on the site, and we do not collect or store card or bank details. Depending on where you are, checkout offers Interac e-transfer, cash on delivery (Toronto and the GTA) or cryptocurrency (BTC, ETH or USDC, for shipped orders). The payment itself happens outside the site, through your bank, in person, or through your own wallet. We record only which method you chose and whether the order has been paid.
Reviews
After an order is completed you can choose to leave a review: a star rating, a title, a short comment and the display name you want shown. We publish a review on the site only if you tick the box allowing it and we approve it. Only the display name, stars, title and comment are shown publicly.
The Journal newsletter
If you sign up for the Journal newsletter, we store your email address and a record of your consent: the exact wording you agreed to, when you ticked the box, the page you signed up on, and when you confirmed. Sign-up is double opt-in: nothing is sent except the confirmation email until you press the button in it. Every newsletter email has a one-click unsubscribe link.
To stop abuse, we limit how often sign-ups can be sent. For this we keep a one-way scrambled code, made from your network address with a secret key, that expires after one hour. We never store your IP address with your subscription.
When you contact us
If you call, text or email us, we use what you send to answer you.
Consent
We rely on your consent, given when you create an account, place an order, leave a review or sign up for the newsletter, to use your information for the purposes described above. Where it is needed, we ask for express consent: the newsletter box is unticked until you tick it, a review is published only if you allow it, and analytics cookies are set only if you choose “Allow analytics”.
You can withdraw your consent at any time, subject to legal or contractual limits, by unsubscribing, changing your analytics choice, or contacting us. If you withdraw consent for something we need to fulfil an order, we may not be able to complete that order.
Cookies and storage on your device
The site keeps a few small items in your browser. Most are in local storage, which stays on your device and is not sent to us. Our two cookies are only set when you sign in. Google Analytics and advertising measurement cookies are only set if you allow analytics.
| Name | Type | What it does | How long |
|---|---|---|---|
__Secure-shroomverse.session_token | Cookie (ours) | Keeps you signed in to your account. Only set when you sign in. | Up to 7 days, renewed while you use the site; removed when you sign out |
sv_two_step | Cookie (ours) | Staff accounts only: shows that a two-step login code was entered. | 12 hours |
_ga, _ga_… | Cookies (Google Analytics) | Counts visits and pages read. Only set if you choose “Allow analytics”. | Set by Google, up to about 2 years |
sv-age-ok | Local storage | Remembers that you confirmed you are 18 or older. | 30 days |
Advertising measurement cookies | Cookies (Google and ad partners, via Google Tag Manager) | Measure whether our ads led to visits. Only set if you choose “Allow analytics”. | Set by each provider, typically up to about 13 months |
_fbp | Cookie (Meta Pixel) | Measures visits that came from our Facebook or Instagram ads. Only set if you choose “Allow analytics”. | Set by Meta, about 3 months |
_clck, _clsk | Cookies (Microsoft Clarity) | Groups page views into a visit so Clarity can show how pages are used. Only set if you choose “Allow analytics”. | Set by Microsoft, up to about 1 year |
_twclid, _twpid, _twsid | Cookies (X pixel) | Measure visits and orders that came from our ads on X. Only set if you choose “Allow analytics”. | Set by X, up to about 13 months |
sv-analytics-consent | Local storage | Remembers your analytics choice (allowed or not). | Until you clear it or change your choice |
shroomverse-guest-cart-v3 | Local storage | Your cart before you sign in. When you sign in it is merged into your account’s cart. | Until you clear it or check out |
sv-search-recent | Local storage | Your last six site searches, shown as shortcuts. Never sent to us. | Until you clear it |
sv-journal-last-visit | Local storage | When you last opened the Journal, to mark newer articles as new. | Until you clear it |
sv-sound, sv-hero-paused, sv-uv-seen | Local storage | Your sound and motion choices, and whether you have seen the homepage opening. | Until you clear it |
shroomverse-account-changed | Local storage | Tells other open tabs that you signed in or out, so they update. | Until you clear it |
sv-guide-chat | Session storage | Your conversation with the Shroomverse guide, so it stays when you move between pages. Never sent to us except with each new question. | Until you close the tab |
sv-tilt, sv-vt-*, sv-journal-baseline | Session storage | Motion-sensor permission, page-transition effects and the Journal’s “new” marker for this visit. | Until you close the tab |
You can clear these at any time in your browser’s settings. If you block them, the site still works, but it will ask your age again, forget your cart and settings, and you will not be able to stay signed in.
Analytics and performance
Google Analytics is off until you choose. After you confirm your age, we ask whether you allow analytics. Google Analytics does not load, and sets no cookie, unless you press “Allow analytics”. If you allow it, Google Analytics records the pages you visit and how you use them, along with technical details such as your browser, device and approximate location, and Google processes this for us. We use it to see which pages are useful.
Google Tag Manager loads on every page. It is how we add and manage measurement tags, including tags that measure our own advertising (for example, whether someone who saw one of our ads visited the site). Until you press “Allow analytics”, we tell Google, through its consent mode, that analytics and advertising storage are not allowed, so Google’s tags do not set their cookies. If you allow analytics, those tags may set cookies from Google or other ad partners we use, and those companies process the data. Google may still receive basic technical information, such as your IP address and browser details, when Tag Manager loads. The tags we run this way include the Meta Pixel (Meta Platforms), which measures visits that come from our Facebook and Instagram ads, including which of our films visitors play and how much of each they watch, and Microsoft Clarity, which records how pages are used (clicks, scrolling and page layout, with text you type in forms masked) so we can fix confusing pages. Both are set to run only if you allow analytics. We do not sell your information. You can change your choice at any time with the “Analytics settings” button in the site footer.
Vercel Speed Insights measures how fast pages load and respond for real visitors (for example, how long the main image takes to appear). It does not use cookies and is not used to identify you. Pages are grouped by type, so each article is counted under one shared heading rather than by its address.
Films and YouTube
Our films are hosted on YouTube. On our film pages, YouTube is not contacted until you press play. The player then loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode. Once a film plays, YouTube (Google) handles it under its own privacy policy. Links that open youtube.com, Instagram or X take you to those services, which have their own policies.
The Shroomverse guide (AI chat)
The “Ask the guide” chat answers questions from our own articles and pages. When you ask a question, the question and the earlier messages of that conversation are sent to Anthropic, the company that makes the AI model, to write the answer. Anthropic handles them under its commercial terms and does not use them to train its models. We do not save the conversation, link it to your account or use it for marketing; it stays in your browser for that tab only. To limit misuse, we keep a count of questions per visitor for a day, using a one-way code made from your network address (not the address itself). Please don’t type your name, contact details or health information into the chat. The guide is for education only: it does not give medical, dosing or buying advice, and its answers can be wrong.
Service providers
We use these companies to run the site. They handle personal information on our behalf, only for these purposes:
- Vercel: hosts the website and runs its server code. Like any web host, it processes technical request data (such as IP address, browser type and the page requested) to deliver pages and keep the site secure. It also provides Speed Insights.
- Turso (libSQL database): stores accounts, sessions, carts, orders, reviews and newsletter records.
- Resend: sends our emails (account emails, order receipts and updates, newsletter confirmations, and order alerts and daily order summaries to us).
- Anthropic: writes the Shroomverse guide’s answers, only for the questions you ask it (see above).
- Google: Google Tag Manager on every page; Google Analytics only if you allow analytics; YouTube, only when you play a film.
- Meta: the Meta Pixel, only if you allow analytics.
- Microsoft: Microsoft Clarity, only if you allow analytics.
- X: the X pixel, only if you allow analytics. If you allowed analytics and then place an order, our server also tells X about the order: the order number and time, your email address and phone number scrambled with SHA-256 (so they are not sent as readable text), and X’s ad click ID if you arrived from one of our ads on X. X uses this to tell us whether our ads on X led to orders, and can match the scrambled email or phone number to an X account that uses the same one.
- Other advertising partners: measurement tags added through Google Tag Manager, only if you allow analytics.
Our web fonts are served from our own site, not loaded from Google Fonts. We do not sell your personal information. Apart from the scrambled order details sent to X described above, and only if you allow analytics, we do not share it with advertisers.
Where your information is stored
Our service providers may store and process your information on servers outside Canada, including in the United States. While it is there, it is subject to the laws of that country, and the authorities there may be able to access it under those laws.
How long we keep it
- Account and order records are kept while your account is open, and after that for as long as we need them for the purposes above and for our legal, tax and accounting obligations. Ask us if you want your account closed.
- Sign-in sessions end after up to 7 days without use, or when you sign out. Email-confirmation and password-reset links expire after 1 hour.
- Newsletter sign-ups that are never confirmed are deleted after 7 days.
- If you unsubscribe, we keep your email address with your consent and unsubscribe history as proof that we respected your choice, and we never email you the newsletter again.
- The rate-limit codes used for newsletter sign-ups expire after one hour.
Who can see it
Your order and account details are visible only to you (when signed in) and to the Shroomverse owner account on our order desk, which is used to prepare and deliver orders. People we allow to edit the Journal and product descriptions cannot see orders, customers or newsletter subscribers. Staff accounts can be protected with a two-step login code.
Security
The site is served only over HTTPS. Passwords are stored as hashes, and new accounts must confirm their email before they can sign in. Sign-in and sign-up attempts are rate-limited, and the links in our emails are signed so they cannot be guessed or changed. No system is perfectly secure, but we protect your information with safeguards suited to how sensitive it is, and we limit who can see it.
Your rights
Under PIPEDA you can:
- Ask for access to the personal information we hold about you, and how we have used and shared it.
- Ask us to correct it if it is wrong. You can change your name and phone number yourself on your account page.
- Withdraw your consent, as described under Consent.
To make a request, email sales@theshroomverse.com or call or text (416) 618-1454. We may need to confirm your identity first. We will answer within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
Age
The site is for adults 18 and older, and it asks you to confirm your age before you enter. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us their information, contact us and we will delete it.
Changes to this policy
When what we collect or how we use it changes, we will update this page and the date at the top.
Last updated .