Privacy statement

What we collect

Without an account: nothing that identifies you. Our server keeps short technical logs — IP address, the page requested, the moment it was requested — so the site can be kept running and defended against abuse.

With an account: your email address, a hashed password (never the password itself), your handle, and a display name if you fill one in. If you sign in with Google we receive your email address, your name and your Google account id — never your Google password.

What you do while signed in: the fragrances you save, the ratings you give and the votes you cast. Ratings and votes are published as community averages. Your handle, your rating count and your Scent Points are visible on your public profile; your email address never is.

Outbound clicks: when you click through to a shop we record the click together with the shop, the fragrance, and the country the page was shown for. That record holds nothing about you — not your IP address, not your account, not a device id.

Analytics: only if you accept them. See the cookie policy.

Why, and on what legal basis

To give you the account you asked for — signing in, saving fragrances, rating them. Legal basis: performance of a contract with you.

To keep the site running, fast and free of abuse, and to count in aggregate which shops get clicked so we know which partners are worth keeping. Legal basis: our legitimate interest. These counts do not identify anyone.

To measure how the site is used with Google Analytics. Legal basis: your consent, which you can withdraw at any time from the footer of any page.

Who else processes it

Hosting: Hetzner Online GmbH, on servers in Germany. Images are served through Cloudflare.

Email: Resend, for account email only — confirmation and password messages. There is no newsletter.

Analytics: Google Ireland Ltd (Google Analytics 4), only after you accept. Data may be processed in the United States under the EU–US Data Privacy Framework and standard contractual clauses. We do not enable Google’s advertising features and we do not share data for advertising.

Affiliate networks: Awin and Daisycon. When you click through to a shop, the network sets its own cookie on that shop’s site to attribute a purchase to us. From that moment their privacy statement applies, not ours.

How long we keep it

Account data: until you delete your account. Your ratings and votes are then removed or detached from you, so the community averages stay honest without pointing at you.

Server logs: a few weeks, then they roll off.

Click counts: kept as statistics. They never identified you in the first place.

Analytics: Google Analytics data retention is set to 14 months.

Your rights

You can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how we use it, take it elsewhere, and withdraw consent you have given. Withdrawing consent does not undo what was lawful before it.

Write to the address at the bottom of this page. We answer within one month. If you think we got it wrong you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live.

Children

This site is not aimed at children. Do not create an account if you are under 16.

Changes

When this statement changes, the date at the top changes with it. If a change matters to you, we say so on the site rather than hoping you re-read this page.