PRIVACY
Privacy Policy
Effective date: 15 September 2026. This policy must be updated whenever a provider, feature, purpose, or retention period changes.
1. Who is responsible
The data controller is the Cigara publisher identified in the Legal Notice. Use that page for the controller’s full identity, address, registration details, and contact email. No data protection officer has been appointed.
2. Data we process
Depending on the features you choose, Cigara may process account and profile data; smoking and pacing records, pack information, dates, times, quantities, moods, triggers, reasons, notes, and personal insights; precise location and derived places when enabled; photos, scanner input, voice input, speech transcripts, and Ask Ara messages; community posts, comments, reactions, reports, and media; push-notification tokens and preferences; purchase and entitlement status; device, app, network, log, crash, security, and diagnostic information; and support messages.
Please do not enter medical diagnoses, emergency information, passwords, or unnecessary sensitive information in free-text fields. Smoking and well-being information may be sensitive in context. We do not use it to provide medical care or make medical decisions.
3. Purposes and legal bases
We use data to operate accounts, sync records, and provide requested features on the basis of contract performance; provide optional camera, location, microphone, community, and AI features on the basis of consent for optional access and processing; process Premium access and billing support on the basis of contract performance and legal obligations; send service notifications and requested reports on the basis of contract performance or consent where required; prevent abuse, secure, troubleshoot, and maintain the service on the basis of legitimate interests balanced against your rights; and keep accounting, tax, legal, and dispute records on the basis of legal obligations or legitimate interests.
We do not use your data for targeted advertising and do not sell personal data. Where processing relies on consent, you may withdraw it in the relevant setting or by contacting us.
4. Permissions
Camera, microphone, location, notification, and media permissions are requested only for features that need them. You can refuse or later disable optional permissions; unrelated features should continue to work.
5. Providers and recipients
We use Supabase for authentication, database, storage, and server functions; Google Firebase services for active legacy app functions, push notifications, and storage; Google Sign-In when you choose it; Cloudflare for the website and guest-sign-in safety check; Groq for Ask Ara, pack-image analysis, and catalogue-name processing when you use those features; Resend to send requested weekly reports; and Open Food Facts Open Prices for catalogue price data. Apple and Google process store purchases if Premium is launched. RevenueCat will be added only if store subscriptions are enabled. Map, geocoding, and location services are used only when you request the related feature or grant the relevant device permission. We may disclose data when required by law or necessary to protect users or the service.
6. International transfers
Supabase is configured for an EU region. Other providers, including Google, Cloudflare, Groq, Resend, Apple, and Google Play, may process data in countries outside the European Economic Area. Where a transfer is required, we use the provider's applicable adequacy decision, EU-US Data Privacy Framework participation where applicable, or European Commission standard contractual clauses. We do not sell personal data or permit providers to use it for their own advertising.
7. Retention and deletion
We keep account, profile, packs, logs, settings, Ask Ara history, uploaded media, and community content while your account remains active. When you delete your account, Cigara removes those records from its active systems; limited copies can remain in restricted backups for up to 30 days before being overwritten. Report and moderation records are kept for up to 24 months after closure to investigate abuse and defend legal claims. Support messages are kept for up to 24 months after resolution. Security and diagnostic logs are kept for up to 90 days. Accounting and purchase records, if Premium launches, are kept for the legally required period. We delete or anonymise data when these periods end unless a longer period is required to establish, exercise, or defend a legal claim.
8. Your rights
Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time. Delete your account in the app or through the account deletion page. Email requests to support@cigara.app. We may verify your identity and normally respond within one month. You may also complain to the CNIL or another competent supervisory authority.
9. Security and incidents
We use measures appropriate to the risks, including access controls, secure transport, provider security controls, and data minimisation. No internet service can guarantee absolute security. We handle personal-data incidents as required by law and notify affected people when legally required.
10. Children
Cigara is not directed to children. If we learn that we collected a child's data unlawfully, we will take reasonable steps to delete it.
11. Cookies
The website may use strictly necessary technologies for security, preferences, or requested functionality. Non-essential analytics, advertising, or tracking will be used only after consent required by French law, with an equally simple way to refuse or withdraw consent. The deployed site must be checked before claiming it uses no cookies.
12. Changes
We will publish updates with a new effective date and provide additional notice or request consent where required.