Privacy

This explains what The Cigar Shelf stores about you and what you can do about it. It describes the service as it actually works today, not a generic template.

What we store

• Your account — email address and a hashed password, held by our authentication provider. We never see your password.
• Your real name — optional, and private. It is stored so you can identify your own account and is never shown to other members. Access to it is blocked at the database level, not merely hidden in the interface.
• Your nickname, photo and bio — these are public to signed-in members. Anything you put here is visible to others by design.
• Your humidor — the cigars you own, quantities, purchase dates, smoking dates and your private notes. Private to you.
• Your check-ins — only if you check in on the smokers map, and never otherwise. A check-in is a place you chose from a list, not a position anyone read: the site never asks your device for your location and cannot obtain it. What is stored is which public venue you picked, the note and photo you chose to attach, and when. Signed-in members can see it, and it appears in the feed and the lounge. It stops showing on the map six hours later, you can check out sooner, and deleting the check-in deletes it outright.
• Your ratings — the score you give a cigar feeds the shared average shown in the index. The average is public; which member gave which score is not shown in the interface.
• Lounge activity — chat messages, photos you attach and reactions. All visible to signed-in members.
• What you ask the assistant — questions you type into Ask the shelf, and the photo you send when you scan a band, are sent to MiniMax, the model provider, to be answered. So that a recommendation is about you rather than about nobody, your question also carries the names of cigars you own and the verdicts you have given — never another member's, never your notes, prices or dates, and never anything at all if you have not rated or added a cigar. Nothing is sent when you are not asking.
• Activity feed entries — that you added or smoked a cigar, and any rating. Shown to other members alongside your nickname.

What we don't do

There is no advertising, no third-party marketing tags, and no profiling. We do not sell or share your data with anyone for their own purposes.

We do measure how many people visit which pages, using Vercel Analytics. It is cookieless and sets no identifier: it records that a page was viewed and where the visit came from, not who you are, and it cannot recognise you on a later visit or on another site. Vercel already hosts this site, so no new company sees anything.

Who processes it

• Supabase — database, authentication and file storage. Our instance is hosted in the EU.
• Vercel — application hosting and delivery.
• Resend — sends account emails such as confirmations and password resets.
• OpenStreetMap — draws the map. Map tiles are fetched by your browser, so their servers see your IP address the way any website you visit would. They are not told who you are or what you are looking for, and no map tiles are loaded unless you open the map.
• Photon — searches OpenStreetMap for venues when you look for somewhere to check in. We call it from our own server rather than from your browser, so it receives the words you typed but never your IP address or anything identifying you.

Each acts as a processor on our behalf. Some may process data outside the EU/EEA under standard contractual clauses.

Your rights

Under the GDPR you can access, correct, export, restrict or erase your data, and object to processing. Two of these are built into the app and take effect immediately:

• Export — download everything we hold about you as a JSON file, from your profile page.
• Erasure — delete your account from the same page. This removes your profile, humidor, wishlist, ratings, activity, chat messages, reactions and uploaded photos.

How long we keep it

For as long as your account exists. Deletion is immediate and permanent when you ask for it — there is no recovery window, so export first if you want a copy.

Age

This service is for adults. You confirm you are 25 or older when you sign up, and it is not intended for anyone under that age.

Contact

For anything privacy-related, or to exercise a right the app doesn't cover directly, write to philipeklund@hotmail.com. That address reaches the person who runs the site and is the one to use for access, correction, export or erasure requests. You also have the right to complain to your data protection authority — in Sweden, Integritetsskyddsmyndigheten (IMY).