Toke AI

Version 1.1 · Effective Date: 1 September 2026

Applicable jurisdictions: United Kingdom · European Economic Area

Important Notice: This Cookie Policy explains how Toke AI Ltd uses cookies and similar technologies on the Toke website and mobile applications. Read it alongside our Privacy Policy and our Terms of Service, both published at toke.ai/policies

Which parts of this Policy apply to you
The Toke platform is released in stages, and not every feature described here is available in every release or in every territory. Where a feature is not available to you, the processing described in connection with it does not take place.
Sections marked Feature-dependent describe processing that occurs only if the relevant feature is available to you and you choose to use it. If you are unsure, contact us at support@toke.ai.

1. What This Policy Covers

Cookies are small text files placed on your device when you visit a website. Mobile applications do not generally use cookies, but they use technologies that do comparable things — software development kits, storage on the device, and identifiers.

This Policy uses "cookies" as shorthand for all of these, and covers both our website and our mobile applications. They behave differently, so they are described separately.

The Platform is operated by Toke AI Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom (company number 15816742).

2. Our Website

We set only cookies that are strictly necessary for the site to work: keeping you signed in, protecting the security of your session, and routing your requests. We do not use analytics, advertising, or tracking cookies on our website. These cookies last for your session only and are deleted when you close your browser.

Strictly necessary cookies are exempt from the consent requirement under UK and EU e-privacy law, because they are essential to providing a service you have requested. Where they involve personal data, we process it on the basis of our contract with you and our legitimate interest in operating a secure service.

Because we set nothing else on the website, there is no cookie banner and no website preference centre. There is nothing on the site to consent to.

3. Our Mobile Applications

The app sets no cookies. It stores information on your device and uses software development kits, described below.

3.1 Information Stored on Your Device

The app stores a small amount of information on your device so that it works as you expect: what keeps you signed in, your account details so the app works offline, your language and display preferences, the last dispensary you looked at, your recent searches, and any location you have set manually.

Your session token is sent to us, because it authenticates your requests. Nothing else in this list is sent to us — it stays on your device and is removed when you delete the app, or when you sign out in the case of your session and account details.

Your session token and cached account details are held securely, in your device's keychain or keystore. The rest is held in ordinary app storage.

3.2 Location

The app uses your device location in two ways. We ask your permission first, and location is used only while you are using the app — we do not request background location access, and the app cannot see where you are when it is closed.

To show the map. We show dispensaries near you. If you decline location access, the map uses a location you set manually, or a fallback city.

For features that depend on where you are. Some features are only available while you are at a particular dispensary — live menus for some dispensaries, and reviews for some of them. Where a feature works this way, your position is checked against that dispensary at the moment you use it. The check is performed by Mapbox, so your location is sent to Mapbox to carry it out. Nothing about the check is stored, whether it succeeds or fails.

You can withdraw location permission at any time in your device settings. Location-dependent features then become unavailable and the map falls back as described above; everything else works normally, and reviews you have already left stay up. Section 6 explains how to change this.

3.3 Software Development Kits

Mapbox renders the map. It collects precise and approximate location, device and operating system information, map interaction, an identifier it generates itself, and performance data. It uses this to operate and improve its own service, which includes its own analytics. We do not receive that data and cannot query it. For that part of what it does, Mapbox determines its own purposes and its own privacy policy applies: https://www.mapbox.com/legal/privacy

Google Maps Platform returns address search suggestions. It receives the address text you type and nothing else. Google determines its own purposes for this service, so its own privacy policy applies: https://policies.google.com/privacy

3.4 Age Signal from the App Store

When you first open the app, we ask the app store for an age signal indicating whether you meet the minimum age. This is not a cookie, but it is a request made to your device, so we record it here. We receive an age range and an indication of how it was established. We do not receive your date of birth or any other information from your app store account.

3.5 Reporting a Technical Problem

Feature-dependent. When you report a technical problem, the app reads your device model, operating system version, app version and build number, and your app language, and sends them to us with your description so that we can investigate. The screen tells you exactly what will be sent before you send it.

This information is read at the moment you submit the report. It is not stored on your device and is not collected at any other time. We do not read any device identifier for this.

4. What We Do Not Use

Stated plainly, because these are the things people most often assume.

No advertising identifiers. We do not use the Apple Identifier for Advertisers or the Google Advertising ID, and we do not present the App Tracking Transparency prompt.
No tracking across other apps or websites.
No advertising networks, and no sharing of your data with advertisers.
No advertising profiles built from anything described in this Policy.
No analytics provider. We use no analytics or product measurement tool. Mapbox operates its own service telemetry, described in Section 3.3, which is a separate thing.
No install or attribution tracking.
No crash reporting tool.
No push notifications.
No inference of health or other special-category information from anything described in this Policy. Where you write free text — a review, or a description of a technical problem — you may mention something sensitive. We do not analyse, categorise, or search that content for such information, and we do not build anything from it.

5. Legal Basis and Consent

Strictly necessary website cookies are exempt from the consent requirement, as described in Section 2.

Access to your device location requires your consent, which we ask for through your device before location is used, and which you can withdraw at any time in your device settings.

The information stored on your device under Section 3.1 is necessary to provide the app you have asked for — keeping you signed in, remembering your settings, and letting the app work offline — and is exempt from the consent requirement on that basis.

Where national implementations of the ePrivacy Directive differ across EEA member states, we apply the standard most protective of your rights.

6. Your Choices

You control location and camera access through your device settings — on iOS under Settings, Privacy and Security, Location Services, and on Android under Settings, Location. Camera and photo access is used only for a profile photo. Deleting the app removes everything held on your device. Website cookies can be blocked or deleted through your browser settings, though blocking strictly necessary cookies will stop parts of the site working.

7. Third Parties

Mapbox and Google Maps Platform are described in Section 3.3. Both act on our instructions under a written agreement. Where a provider determines its own purposes for part of what it does, its own privacy policy applies to that part. Our other service providers are described in Section 7 of our Privacy Policy.

8. Changes to This Policy

We update this Policy when the technologies we use change. The date at the top shows when it was last revised. Where a change would require your consent, we will ask for it rather than relying on this Policy alone.

9. Contact Us

Questions about this Policy: support@toke.ai
Data Protection Lead: Tristan Mallinson — dpo@toke.ai
Postal address: Toke AI Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
EU representative under Article 27 GDPR: Europe Services, SE, Na Cecelicce 425/4, Smichov, 150 00 Praha 5, Czech Republic. Data subjects may contact the representative at info@gdprrepresentative.com regarding the processing of their personal data.

For how we handle personal data generally, see our Privacy Policy at toke.ai/policies