Privacy

This explains what The Cigar Shelf stores about you and what you can do about it. It describes the service as it actually works today, not a generic template.

What we store

• Your account — email address and a hashed password, held by our authentication provider. We never see your password.
• Your real name — optional, and private. It is stored so you can identify your own account and is never shown to other members. Access to it is blocked at the database level, not merely hidden in the interface.
• Your nickname, photo and bio — these are public to signed-in members. Anything you put here is visible to others by design.
• Your humidor — the cigars you own, quantities, purchase dates, smoking dates and your private notes. Private to you.
• Your check-ins — only if you check in on the smokers map, and never otherwise. A check-in is a place you chose from a list, not a position anyone read: the site never asks your device for your location and cannot obtain it. What is stored is which public venue you picked, the note and photo you chose to attach, and when. Signed-in members can see it, and it appears in the feed and the lounge. It stops showing on the map six hours later, you can check out sooner, and deleting the check-in deletes it outright.
• Your ratings — the score you give a cigar feeds the shared average shown in the index. The average is public; which member gave which score is not shown in the interface.
• Lounge activity — chat messages, photos you attach and reactions. All visible to signed-in members.
• Activity feed entries — that you added or smoked a cigar, and any rating. Shown to other members alongside your nickname.

What we don't do

There is no advertising, no analytics or tracking service, no third-party marketing tags, and no profiling. We do not sell or share your data with anyone for their own purposes.

Who processes it

• Supabase — database, authentication and file storage. Our instance is hosted in the EU.
• Vercel — application hosting and delivery.
• Resend — sends account emails such as confirmations and password resets.
• OpenStreetMap — draws the map. Map tiles are fetched by your browser, so their servers see your IP address the way any website you visit would. They are not told who you are or what you are looking for, and no map tiles are loaded unless you open the map.
• Photon — searches OpenStreetMap for venues when you look for somewhere to check in. We call it from our own server rather than from your browser, so it receives the words you typed but never your IP address or anything identifying you.

Each acts as a processor on our behalf. Some may process data outside the EU/EEA under standard contractual clauses.

Your rights

Under the GDPR you can access, correct, export, restrict or erase your data, and object to processing. Two of these are built into the app and take effect immediately:

• Export — download everything we hold about you as a JSON file, from your profile page.
• Erasure — delete your account from the same page. This removes your profile, humidor, wishlist, ratings, activity, chat messages, reactions and uploaded photos.

How long we keep it

For as long as your account exists. Deletion is immediate and permanent when you ask for it — there is no recovery window, so export first if you want a copy.

Age

This service is for adults. You confirm you are 25 or older when you sign up, and it is not intended for anyone under that age.

Contact

For anything privacy-related, or to exercise a right the app doesn't cover directly, contact the site administrator. You also have the right to complain to your data protection authority — in Sweden, Integritetsskyddsmyndigheten (IMY).