Effective 15 September 2026
Privacy Policy
CigarTale is an audio app about the history and craft of cigars. This policy explains what we collect, why, where it is processed and how to delete it.
"CigarTale", "we" and "us" mean the operator of the CigarTale app and of cigartale.app. Contact: hello@cigartale.app.
1. Who the app is for
CigarTale is for adults aged 18 and over. The app asks you to confirm your age before anything else and stores that confirmation on your device only. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, write to us and we will delete it.
2. What we collect
Without an account
- Age confirmation and your language choice, stored on the device.
- Band scans. When you scan a cigar band, the photo is sent to our servers and to our recognition provider to read the printed text. We keep the extracted text (brand, line, size, factory marks), the result and timing of the scan and a random per-install identifier. We do not store the photo.
- Playback. Which story you started, how far you listened, and playback errors, tied to the per-install identifier, so that the app works and we can see which stories people finish.
- Device and app diagnostics when something breaks: app version, OS version, device model and the error. Crash reporting is provided by Sentry (EU region) when enabled.
With an account
You can use the whole app as a guest. An account is offered only when you save a cigar to your Humidor or make a purchase. Then we also keep:
- Sign-in identity: your email address, or the identifier and email that Apple or Google provide when you sign in with them. Email sign-in uses a one-time code sent to your address.
- Your Humidor: the cigars you saved, their size, your 1–10 rating and dates.
- Listening progress for full stories, so you can resume on another device.
- Requests you send for cigars we do not have yet, as text.
- Push notification token if you allow notifications; you can turn them off in the app or in system settings at any time.
- Entitlement to full stories: whether you have the paid tier, its source and expiry. Purchases, when available, are made through Apple or Google and handled by RevenueCat; we never see your payment details.
3. Analytics
We measure how the app is used in aggregate (for example, how many people finish a story) with PostHog, hosted in the EU, when enabled. We do not use session replay, advertising identifiers or third-party advertising SDKs, and we do not sell or share personal data for advertising.
4. Where your data is processed
| Purpose | Provider | Location |
|---|
| Database, sign-in, audio storage, server functions | Supabase | Frankfurt, Germany (EU) |
| Reading the text on a scanned band | OpenAI (API) | United States; the request is not used for model training and the image is not retained by us |
| Sign-in codes and account email | Resend | Tokyo, Japan |
| Sign in with Apple / Google | Apple, Google | Per their policies |
| Push notifications | Expo Push Service, Apple, Google | United States and per platform |
| Crash reports and usage analytics (when enabled) | Sentry, PostHog | EU |
| Purchases (when available) | Apple, Google, RevenueCat | Per their policies |
Providers act on our instructions under their data processing terms. Where data leaves the country you are in, it is protected by those terms and by the safeguards those providers publish.
5. Why we process it
To run the app you asked for (recognising a cigar, playing stories, keeping your Humidor), to keep it secure and working, to understand what people listen to so we can make better stories, and to comply with law. Where consent is required, for example for notifications, we ask for it in the app and you can withdraw it at any time.
6. How long we keep it
- Account data: while your account exists.
- Scan records: extracted text and outcome are kept for up to 12 months to improve recognition; they never include the photo.
- Diagnostics and analytics: up to 12 months.
- Backups: up to 30 days after deletion.
7. Your choices and rights
- Delete your account in the app: Profile → Delete account. This removes your account, Humidor, progress, requests and push tokens, and anonymises scan and listening records. It cannot be undone.
- Notifications can be turned off in Profile or in your device settings.
- Access, correction, portability, objection: write to hello@cigartale.app. We answer within 30 days. If you are in the EU, the UK or another jurisdiction with a data protection authority, you may also complain to that authority.
8. Security
Data is encrypted in transit and at rest with our providers. Access to personal data inside CigarTale is limited to people who need it to run the service. Audio and personal records are served only through short-lived, signed links.
9. Changes
We will post changes here with a new effective date and, for material changes, tell you in the app.
10. Contact
hello@cigartale.app