WARNINGNicotine pouches contain nicotine, which is highly addictive. Sold to adults of legal age only.Nicotine is highly addictive. Adults only.
Canadian owned & operated
Delivered across Canada
0

Security & Encryption

Bank-grade protection, built into every page.

Your details are encrypted, in transit and at rest.Here's exactly how, in plain language with the technical specs alongside.
TLS 1.3Encrypted connection on every page
AES-256Encryption for stored customer data
HMAC-SHA-256Tamper-proof signed sign-in sessions
100,000×PBKDF2 rounds protecting staff passwords
15 minOne-time sign-in codes expire
0Card numbers or bank passwords we ever see

1Encrypted from Your Screen to Our Servers

Every page, form and order travels over TLS (up to TLS 1.3), the same protocol online banking uses. Our site also sends HSTS (HTTP Strict Transport Security), which tells your browser to refuse any unencrypted connection to us for a full year, so nobody on public Wi-Fi can downgrade or read your traffic.

2Encrypted While It's Stored

Your name, address and order history are kept in a database on Cloudflare's network that is encrypted at rest with AES-256 (in GCM mode), the standard used by governments and banks. Data moving between our systems and the database is encrypted with TLS too.

3No Passwords to Steal

You sign in with a one-time 6-digit code sent to your email. We store only a keyed HMAC-SHA-256 fingerprint of the code, never the code itself. Each code expires after 15 minutes and locks after 5 wrong tries. Once you're in, your session is held in a signed, HttpOnly, Secure cookie: scripts on a page can't read it, it's only ever sent over HTTPS, and any tampering breaks the signature.

4We Never Touch Your Money Details

You pay by Interac e-Transfer from your own bank's app. Your bank handles the payment end to end, so we never see, receive or store a card number, CVV or banking password. There's nothing for anyone to steal from us.

5We Keep as Little as Possible

Your date of birth is checked on your own device at checkout and is not sent to us or stored. For birthday points we keep the month only, never the day or year. We don't sell or rent your information, ever.

6Locked-Down Staff Access

Only our team can open the store's back office, and each person sees only what their role needs (owner, manager or staff). Staff passwords are protected with PBKDF2-SHA-256 and 100,000 rounds plus a unique salt, and repeated wrong attempts are blocked for 15 minutes.

7Protected Network and Browser Shields

The store runs on Cloudflare's global network, with always-on protection against denial-of-service attacks and automatic limits on sign-in, order and form abuse. Every page also sends browser security headers that block other sites from framing ours (clickjacking), stop browsers guessing file types (nosniff), share minimal referrer details, and switch off camera, microphone and location access entirely.

8Your Part (It's Easy)

  • We will never ask for a password, card number or your bank login, by email, text or chat.
  • Sign-in codes only come from our own address; never share yours with anyone.
  • Look for the padlock and nicotine-pouches.ca in the address bar.
  • Anything suspicious? Email help@nicotine-pouches.ca and we'll look into it.

Questions about privacy? See our Privacy Policy or the FAQ.