Privacy Policy

1. Data Controller

The controller of your personal data is:

• Name: Daniel Pospíchal
• Registered address: Havlíčkův Brod, Czech Republic
• Company ID: 19079583
• Email: cigarioapp@gmail.com

2. Personal Data We Collect

Data provided during registration

• Email address
• Display name or nickname
• Profile photo, if provided

Data created while using the app

• Cigar experience records, including cigar name, ratings, tasting profile, story, and photos
• Humidor content, including your personal inventory of cigars
• Social interactions, including follows, likes, and comments
• Location data, only if you explicitly allow location access for the map feature

Technical data

• Device type and operating system
• Date and time of sign-in
• IP address processed by our infrastructure provider

Optional web app analytics

If you allow analytics, we record the page path without URL parameters, page type, selected actions (such as using a filter or successfully saving a review), active time, language, device category, and the referring domain. A random visitor identifier and a session identifier are stored in your browser. We do not collect search text, email addresses, or review text for analytics. Only administrators can access individual events; the admin dashboard displays aggregates.

Analytics does not start until you select “Allow analytics”. Declining does not restrict the website. You can change your choice at any time through “Analytics settings” in the web app footer. Declining removes local analytics identifiers and stops new events; it does not immediately erase events previously sent.

3. Purposes and Legal Basis for Processing

• Operating the app — performance of a contract under Article 6(1)(b) GDPR
• Social features — performance of a contract under Article 6(1)(b) GDPR
• Security and abuse prevention — legitimate interest under Article 6(1)(f) GDPR
• Location — your consent under Article 6(1)(a) GDPR, which you may withdraw at any time
• Optional web app analytics — your consent under Article 6(1)(a) GDPR, which you may withdraw at any time

4. Recipients of Personal Data

Your data is processed by the following service providers:

• Supabase Inc. — database and file storage, with servers in the European Union
• Apple Inc. — Sign in with Apple
• Google LLC — Google Sign-In

We do not sell your personal data and do not share it with third parties for marketing purposes.

5. Data Transfers Outside the EU

Supabase operates infrastructure in the European Union. If any processing takes place outside the EU, appropriate safeguards under Article 46 GDPR, such as standard contractual clauses, are applied.

6. Data Retention

• Account data is retained for as long as your account exists.
• After account deletion, all related personal data is permanently removed within 30 days.
• Individual events from optional web analytics are retained for no more than 90 days and then deleted.
• Anonymized aggregate statistics may be retained for a longer period.

7. Your Rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data
• Restriction of processing — limit how we process your data
• Data portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — withdraw consent at any time

You can delete your account and related data directly in the app: Settings → Delete my account.

To exercise other rights, contact us at: cigarioapp@gmail.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. In the Czech Republic, the authority is:

9. Age Restriction and Age Verification

Cigario is intended only for individuals aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we discover that such data has been provided, we will delete it promptly.

When the app is first launched, we verify age by asking for your date of birth. We do not store your date of birth — it is used only for a one-time local check that you are at least 18 years old. After verification, only an “age confirmed” flag is kept on the device, not the date of birth itself. We apply this approach in line with the data minimisation principle (Article 5(1)(c) GDPR).

10. Security

We use reasonable technical and organizational measures to protect your data, including encrypted transmission (TLS), access controls, and regular backups.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes in the app or by email. The date of the latest update is shown at the top of this page.

12. Contact

If you have any questions about privacy or personal data protection, contact us at: cigarioapp@gmail.com