Privacy Policy
Last updated: October 26, 2026
What you share
Biriah collects your email address, username and display name when you create an account. Your password is stored as a one-way hash. Your date of birth is submitted to check that you are 21 or older; the birth date itself is not stored. We also store the strains you save, your private observations, ratings, reviews, forum posts and other contributions you choose to make. A session cookie keeps you signed in.
Members can upload label or package photos and lab-report (COA) PDFs to their private journal, add text notes, reviews and personal observations, upload a profile photo, and submit community strain reports with an optional photo or PDF. Saved uploads and contributions are stored in Biriah's database on its server and tied to your account.
Your journal uploads, notes and personal evidence records are private to your account, rather than shared with other members. The private journal allows up to 200 uploads and 50 MB of uploaded files per account, with files up to 5 MB and PDFs of up to 20 pages. Community strain submissions are limited to 100 per account; their photos can be up to 1 MB and their PDFs up to 2 MB and no more than 20 pages. Profile photos can be up to 1 MB.
Approved community strain reports, reviews and their attachments are visible to other signed-in members. Pending or rejected submissions are visible to their author and the Biriah owner. Profile photos appear to other signed-in members immediately after passing file checks under the current site settings; staff can review and remove them. Forum posts and replies are visible to members; posts you choose to share publicly can also be read without signing in.
Why we use it
We use this information to provide your account, check 21+ eligibility, verify your email, help with password recovery, keep your saved strains and community features working, and protect the service against abuse. Community contributions can be visible to other people. Avoid posting personal medical details or information about others.
Account email
Verification and password-reset emails are sent through the site's email provider, Namecheap Private Email, using mail.privateemail.com, from support@biriah.com. Your email address is sent to that provider to deliver these messages. Biriah does not send marketing email.
Traffic counts and browser storage
Biriah does not sell personal information and does not use advertising trackers. It uses a first-party traffic counter to count page views and estimate daily visitors. A random browser ID is saved in local storage and resets daily. The counter sends the page name, that daily ID and a random event ID to Biriah; it does not store search terms, email addresses, referrers or individual browsing histories. Our visit counter doesn't store IP addresses. The visit counter respects Do Not Track and Global Privacy Control signals.
Our web server keeps standard access logs, which include IP addresses, for up to 14 days for security and troubleshooting, then deletes them. These Caddy server logs rotate daily. The sign-in, sign-up and password-reset rate limiter also uses your client IP address as a key in server memory to block abuse. Those rate limit keys are not written to the database.
Finder target profiles may also be saved in your browser without encryption. Optional older device vaults use a separate passphrase. Clearing browser storage can remove local profiles, so keep a downloaded copy if you need them.
Delete your account
Open Account settings and choose Delete account (shown as “Erase my account”). This deletes your active account and its associated records, including your journal uploads, personal evidence records, profile photo, community strain submissions and attachments, notes, reviews, forum posts and replies. Copies other people have saved cannot be recalled. You can also email admin@biriah.com for help deleting your account or with a privacy question.
Backups
Daily database backups keep the most recent 30 snapshots, normally about 30 days. This is a snapshot count, not a fixed 30-day expiry: extra snapshots or missed backups can change the time covered. Backups taken before site updates are kept until removed. Data deleted from the active site can remain in these earlier backups until those copies are removed.