Privacy Policy

Puff Social, Inc. · Last Updated: August 24, 2026 · Version 2026.08

1. Introduction

Puff Social, Inc. ("Puff Social," "Company," "we," "us," or "our") respects user privacy and recognizes that people using a dating and social networking platform for adults interested in cannabis culture may choose to share information that is personal, sensitive, or private. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you access or use the Puff Social mobile application, website, profiles, messaging features, Locator Feature, events, subscriptions, customer support, safety tools, sponsored features, and related services (collectively, the "Platform").

This Privacy Policy is incorporated into and forms part of our Terms of Service. By creating an account, accessing, or using the Platform, you acknowledge that you have read and understand this Privacy Policy. Your agreement to the Terms does not replace any separate consent that applicable law, a device or operating system, or an integrated third-party service requires for particular data processing. Where separate consent is required, Puff Social will seek it through the appropriate mechanism.

This Privacy Policy is designed for a U.S.-focused launch. Additional state-specific notices or rights may apply depending on where you reside and where Puff Social operates.

2. Age Restriction and Adult-Only Platform

The Platform is intended only for adults who are at least twenty-one (21) years old, or the minimum legal age for cannabis-related adult-use activity in the user’s jurisdiction, whichever is greater. We do not knowingly permit use of the Platform by individuals below the applicable Minimum Age.

Puff Social may log and retain the date and method of an age attestation or verification for a period reasonably necessary for compliance, safety, security, fraud prevention, and enforcement. If we use identity-, document-, selfie-, or third-party age-verification tools, we will provide any additional disclosures or consent mechanisms required for the information actually collected and processed.

If we learn that an underage individual has provided information through the Platform, we may suspend or terminate the account and delete or retain information as reasonably necessary for safety, legal, fraud-prevention, or enforcement purposes and as permitted by law.

3. Scope of this Policy

This Privacy Policy applies to Personal Information collected by or on behalf of Puff Social through the Platform and related communications. "Personal Information" or "Personal Data" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular person or household, as defined by applicable law.

This Policy does not govern the independent privacy practices of third-party websites, app stores, payment processors, mapping providers, social media platforms, or other third-party services that operate under their own privacy policies. Where an integrated third party receives information directly through its own service, we identify that relationship where material to your privacy choices.

4. Categories of Information We May Collect

4.1 Account and Registration Information

4.2 Cannabis-Culture and Preference Information

Because the Platform is designed for adults who share an interest in cannabis culture, you may choose to provide information about cannabis-related lifestyle preferences, social interests, consumption preferences, or cannabis-community identity. Puff Social treats this information as heightened-risk information even when it is not classified as "sensitive" under every applicable law.

Cannabis-related information may, depending on context, also reveal or permit an inference about health, disability, medication use, or other sensitive characteristics. Our treatment of health-related and other sensitive information is described in Sections 5 and 16.

4.3 Dating, Relationship, and Social Interaction Information

4.4 Location Information and the Locator Feature

Subject to device settings, in-app controls, and any required permissions or consent, Puff Social may process approximate location, city/state location, IP-based location, or precise geolocation to provide matching, proximity, safety, fraud-prevention, account-security, and Locator functionality. The Locator Feature may use location to identify nearby licensed dispensaries or social consumption lounges, including sponsored or featured locations.

We do not intend to display your exact location to other users. The Platform may display approximate distance, region, city, or other generalized location indicators depending on available settings. Users should not place home addresses, workplace addresses, or precise meeting locations in public profiles.

Precise geolocation is treated as sensitive information. Puff Social will obtain any separate consent required by applicable law or applicable third-party terms before obtaining or caching precise location and will provide a mechanism to revoke location permission.

Revoking location permission may limit location-dependent features.

4.5 Device, Usage, and Technical Information

4.6 Cookies, SDKs, Analytics, and Similar Technologies

We may use cookies, mobile SDKs, pixels, local storage, analytics tools, crash-reporting tools, and similar technologies to operate the Platform, measure performance, improve features, prevent fraud, support security, understand usage, and administer sponsored features. We will not use third-party tracking or advertising technologies in a manner that materially conflicts with this Privacy Policy or applicable law.

4.7 Safety, Reporting, Moderation, and Enforcement Information

4.8 Identity, Age, Verification, and Fraud-Prevention Information

If Puff Social implements identity, age, selfie, document, or fraud-prevention verification, we may collect or receive information reasonably necessary to verify eligibility, prevent duplicate accounts, detect impersonation, and protect the Platform. Before deploying functionality that creates or processes biometric identifiers or biometric information, Puff Social will provide disclosures and obtain consent where required by applicable law.

4.9 Payment and Subscription Information

If you purchase Premium Services, Puff Social and/or its app-store or payment providers may process subscription status, transaction identifiers, purchase history, billing status, cancellation information, and limited payment-related metadata. Payment providers may independently collect information under their own privacy policies.

4.10 Information from Third Parties

We may receive information from app stores, payment processors, social login providers, mapping providers, customer-support tools, analytics vendors, safety vendors, fraud-prevention providers, verification providers, Advertising Partners, or other users who submit reports or content involving you. We use third-party information for the purposes described in this Policy and subject to applicable law.

5. Sensitive Personal Information and Health-Adjacent Information

Information used on a dating and cannabis-culture platform can be sensitive because of what it states directly or what it may reveal when combined with other information. Depending on applicable law and context, sensitive or heightened-risk information may include precise geolocation, private communications, sexual orientation or sex-life information, identity-verification information, financial account information, biometric identifiers, government identifiers, health information, and information that reveals or is used to infer health status or other legally protected characteristics.

Puff Social also treats certain cannabis-related information as health-adjacent when it identifies, reveals, or is used to infer information about a person’s physical or mental health, medical condition, diagnosis, treatment, medication use, disability, symptoms, or health-related behavior. Health-adjacent information can arise from information you voluntarily provide, from content you submit, or in some circumstances from the combination of cannabis preferences, location, activity, or other Platform information.

Puff Social does not require users to provide medical information and does not ask users to upload medical records, prescriptions, physician certifications, medical cannabis cards, laboratory results, patient identification numbers, diagnoses, treatment information, insurance information, or other medical records. Users should not include such information in public profiles, messages, photos, reports, or other submissions unless they understand that the Platform is not a medical-record system and that information shared with another user may be further disclosed by that user.

Unless separately disclosed and permitted by applicable law, Puff Social will not use the contents of private messages, precise geolocation, consumer health data, or other sensitive Personal Information to target or personalize public advertising or Sponsored Content, and will not disclose those categories to Advertising Partners for their independent advertising or marketing. This does not prevent Puff Social from using information as reasonably necessary to provide a feature you request, protect safety and security, prevent fraud or abuse, enforce our Terms, comply with law, or provide contextual or location-dependent Platform functionality.

6. No Medical, Healthcare, or HIPAA-Regulated Service

Puff Social is a social networking and dating platform. It does not provide medical advice, healthcare services, diagnosis, treatment, therapy, counseling, pharmacy services, medical cannabis recommendations or certifications, or patient referrals.

The general Platform is not designed or offered as a medical-record system, patient portal, telehealth platform, or service through which users should transmit Protected Health Information (“PHI”), as that term is defined under HIPAA. Puff Social is not a healthcare provider, health plan, or healthcare clearinghouse merely because users may discuss health-related subjects or cannabis use. Health-related information submitted to a consumer social platform may therefore fall outside HIPAA even though it remains subject to this Privacy Policy and other applicable federal or state privacy, consumer-health-data, security, and breach-notification laws.

If Puff Social later introduces a feature that involves healthcare providers, medical recommendations, patient verification, telehealth, medical records, or another regulated healthcare workflow, that feature will require a separate legal, privacy, security, and technical review before launch.

7. How We Use Information

We may use Personal Information for the following purposes, subject to applicable law and any consent required for sensitive processing:

We will not use Personal Information for a materially incompatible new purpose without providing additional notice and obtaining consent where required by applicable law.

8. How We Disclose Information

We may disclose Personal Information in the following circumstances:

Puff Social expects service providers and processors handling Personal Information on our behalf to use it only for authorized purposes; not to independently sell, monetize, redirect, or disclose the information for another purpose; and to maintain confidentiality, security, use-limitation, and deletion protections appropriate to the information and applicable law. The precise contractual role of an integrated third party may differ; where a third party independently determines how it processes data, its own privacy policy also applies.

9. Sponsored Content, Advertising, Analytics, and Data Monetization

The Platform may display paid Sponsored Content from licensed cannabis dispensaries or cannabis brands. Sponsored or featured placement does not mean Puff Social discloses a user’s identity or sensitive information to the sponsor.

Puff Social may use contextual information, the feature being viewed, generalized location, or location needed to provide the Locator Feature to select or display relevant sponsored or featured locations. Puff Social may also provide Advertising Partners with aggregated, de-identified, or limited campaign-performance information, such as impressions, clicks, or generalized performance metrics, where permitted by law and technically implemented.

Puff Social does not sell consumer health data. Puff Social also does not intend to sell raw, identifiable sensitive Personal Information such as precise geolocation, private messages, identity-verification data, financial account information, or health-adjacent information. Puff Social will not disclose those categories to Advertising Partners for their independent advertising or marketing unless separately disclosed and authorized in a manner permitted by applicable law.

If Puff Social later uses cross-context behavioral advertising, third-party advertising networks, mobile advertising identifiers, or another activity treated as a "sale," "sharing," or targeted advertising under applicable law, we will provide required notices, consent mechanisms, opt-out rights, and recognition of legally required preference signals before or when that activity is deployed.

We may use aggregated or de-identified information for internal analytics, product improvement, safety reporting, business planning, and lawful external reporting. When information is treated as de-identified under applicable law, Puff Social will use a documented method reasonably designed to support that designation, take reasonable measures designed to prevent re-identification, will not attempt to re-identify it except as permitted by law, and will impose contractual restrictions on recipients where required.

10. Google Maps and Other Mapping Services

The Locator Feature may include Google Maps Platform features and content. When those features are used, Google may collect or receive information through the normal operation of its services, including search terms, IP addresses, and latitude/longitude coordinates. Google may use and retain information it receives in accordance with its own privacy policy

and applicable terms. For certain data processed in connection with Google Maps Platform, Google and Puff Social may each have independent responsibilities under applicable privacy law.

Puff Social will provide advance notice of the type of location information it intends to obtain and will use applicable in-app, device, or operating-system controls to obtain and permit revocation of location consent where required. Your use of Google Maps features through the Platform is also subject to Google’s applicable end-user terms and privacy policy.

11. User Content, Private Messages, Moderation, and Reporting

Messages and other User Content may be stored, processed, transmitted, and reviewed as reasonably necessary to operate the Platform, deliver communications, investigate reports, detect prohibited conduct, enforce our Terms and Community Guidelines, comply with law, and protect users. Puff Social will not represent that messages are end-to-end encrypted unless that functionality has been implemented and verified.

If a user reports another user, Puff Social may review relevant profiles, messages, photos, metadata, interaction history, and account information to evaluate the report. We may preserve information relating to abuse, fraud, safety incidents, suspected illegal activity, or prohibited cannabis or controlled-substance transactions when reasonably necessary for safety, enforcement, legal hold, dispute resolution, or compliance.

Deleting a message, blocking a user, unmatching, or deleting an account may not immediately remove copies from recipient accounts, backup systems, legal records, safety reports, or records retained for security, fraud-prevention, enforcement, compliance, or dispute-resolution purposes.

Consistent with the Terms of Service, Puff Social will not use the content of private messages or sensitive Personal Information contained in User Content for public advertising or promotional purposes without separate permission.

12. Data Retention and Deletion

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Policy, including to operate the Platform, maintain accounts, provide requested services, protect safety and security, prevent fraud or abuse, enforce our Terms, comply with legal obligations, resolve disputes, and maintain legitimate business records. Retention periods vary based on the category and sensitivity of information, the purpose for collection, user settings, legal requirements, safety needs, and deletion requests.

13. Data Security and Breach Response

Puff Social uses reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, acquisition, use, alteration, or disclosure. Safeguards should be proportionate to the sensitivity of the information and may include access controls, encryption in transit, appropriate encryption at rest, secure development practices, vendor diligence, logging and monitoring designed, where appropriate, to identify access to sensitive information, the purpose of that access, and any onward disclosure, incident-response procedures, and confidentiality obligations for personnel and contractors.

No application, network, database, or transmission method is completely secure. Users are responsible for protecting their login credentials and should promptly notify Puff Social of suspected unauthorized account access.

Puff Social will investigate suspected data-security incidents and take response measures appropriate to the circumstances. Where an incident triggers notification obligations under applicable law, Puff Social will provide required notices to affected users, regulators, or other parties. Because health-related information may be subject to specialized privacy and breach-notification laws even when HIPAA does not apply, incidents involving health or health-adjacent information will be evaluated under applicable federal and state requirements.

14. Your Privacy Choices and Consent Controls

15. U.S. State Privacy Rights

Depending on where you reside and whether a particular state law applies to Puff Social, you may have rights to access, confirm, correct, delete, or obtain a portable copy of Personal Information; to opt out of certain sales, sharing, targeted advertising, or profiling; to limit or withdraw consent for certain uses of sensitive Personal Information; and to appeal certain privacy-request decisions. Puff Social will honor legally required rights and will not unlawfully discriminate against you for exercising them.

To submit a privacy request, contact privacy@puffsocialapp.com or use available in-app privacy tools. We may need to verify your identity before fulfilling a request. Authorized agents may be required to provide proof of authorization. Where required by law, Puff Social will recognize applicable browser- or device-based universal opt-out preference signals for covered activities.

California residents may have rights under the California Consumer Privacy Act, as amended, including rights concerning sensitive Personal Information such as precise geolocation, private communications, health information, sex-life or sexual-orientation information, biometric information used for identification, and certain financial or account credentials. If Puff Social becomes subject to California-specific disclosure requirements, the final published policy should include the required category/source/purpose/recipient disclosures and any required "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" mechanisms.

16. Consumer Health Data Privacy Notice

This section provides additional information about health-related data that may be protected under state consumer-health-data laws. It applies to the extent Puff Social collects or processes information that qualifies as "consumer health data" under an applicable law. Some state laws define consumer health data broadly to include information that directly identifies health status as well as information inferred or derived from other data.

16.1 Categories of Consumer Health Data

Depending on what a user voluntarily provides and how Platform information is used, consumer health data may include:

Puff Social does not require users to provide these categories in order to use the general social and dating features of the Platform.

16.2 Sources of Consumer Health Data

Consumer health data, if collected, may come directly from you; from User Content or communications you choose to submit; from your interaction with Platform features; from device or location information where legally permitted; from other users who submit reports involving you; or from service providers acting on Puff Social’s behalf. Puff Social does not intend to purchase consumer health data from data brokers.

16.3 Purposes for Collection and Use

Where Puff Social processes consumer health data, it may do so only for disclosed purposes reasonably connected to providing a feature you request, operating and securing the Platform, protecting users, moderating content, preventing fraud or abuse, providing customer support, complying with law, or another purpose for which legally sufficient consent has been obtained. Puff Social does not use consumer health data for Advertising Partner targeting or for the independent marketing of an Advertising Partner.

16.4 Sharing of Consumer Health Data

Puff Social may disclose consumer health data only as permitted by applicable law, including with processors or service providers acting on our behalf where reasonably necessary to provide a requested service or operate and secure the Platform; with another user when you intentionally direct or choose to share the information with that user; with professional advisors under confidentiality obligations; or when required or permitted by applicable law for legal, safety, fraud-prevention, or enforcement purposes.

Puff Social does not sell consumer health data. Puff Social does not disclose consumer health data to Advertising Partners for their independent advertising or marketing.

16.5 Consumer Health Data Rights

Where applicable law provides consumer-health-data rights, you may have the right to confirm whether Puff Social collects, shares, or sells consumer health data about you; access such data; obtain information about parties with whom it has been shared; withdraw consent from future collection or sharing; and request deletion. To exercise a right, contact

privacy@puffsocialapp.com or use an available in-app privacy mechanism. We may take reasonable steps to authenticate your request and will respond within the period required by applicable law.

If you withdraw a consent that is necessary to provide a feature you requested, the affected feature may no longer be available. A withdrawal applies prospectively and does not require Puff Social to undo processing that was lawful before withdrawal, except where applicable law requires otherwise.

16.6 Health-Related Location and Geofencing

Puff Social does not intend to use precise location to identify or track a user’s visit to a health-care facility or other health-related location for advertising, sale of data, or creation of a health profile. The Locator Feature is designed to identify nearby licensed cannabis locations at the user’s request, not to infer a medical condition from a user’s physical presence. [VALIDATE LOCATION/LOCATOR IMPLEMENTATION AND LAUNCH-STATE GEOFENCING REQUIREMENTS BEFORE PUBLICATION.]

16.7 Additional Notice or Consent

If Puff Social proposes to collect a new category of consumer health data, use consumer health data for a materially different purpose, share it with a new category of recipient, or engage in another activity for which applicable law requires separate consent or authorization, Puff Social will provide the legally required notice and obtain the required consent or authorization before the covered activity occurs.

17. Law Enforcement, Legal Process, and Safety Requests

Puff Social may preserve, disclose, or provide information when we reasonably believe doing so is required or permitted by applicable law, valid legal process, court order, subpoena, government request, investigation, safety concern, Terms enforcement, or protection of rights, property, or users. We do not intend to retain all user data merely because it could someday be requested; preservation is limited to information reasonably necessary for the relevant safety, investigation, enforcement, legal-hold, dispute-resolution, or compliance purpose and consistent with this Policy and applicable law.

18. Third-Party Links and Services

The Platform may link to or integrate third-party services, including app stores, payment processors, mapping providers, analytics providers, verification vendors, social login tools, customer-support tools, communications providers, or external websites. Third parties may collect information directly from you or your device and may act independently from Puff Social. Their privacy policies and terms govern their independent processing. We encourage you to review those policies before providing information or enabling an integration.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. For material changes, Puff Social will provide notice in a manner reasonably designed to inform users and as required by applicable law, which may include posting the updated Policy, email, or in-app notice, and will update the effective or last-updated date.

Where applicable law or the nature of a material change requires affirmative consent before the change applies to previously collected information or particular processing, Puff Social will obtain that consent. Otherwise, continued use after the effective date of an updated Policy means you acknowledge the updated Policy.

20. Contact Information

If you have questions, concerns, or requests concerning this Privacy Policy or Puff Social’s privacy practices, please contact:

← Back to Puff Social