Privacy Policy

1. Who handles your data

Fragtal (“the app”) is a project by Andrés Blanco F., an individual based in Mexico, who acts as the data controller for the personal data described here.

You can write to hello@fragtal.app at any time about anything to do with your data.

This policy explains what the app collects, why, where it is stored, who it is shared with, and how you can get it back or delete it. It is written to be understood on one reading.

2. Summary

Advertising

None. The app shows no ads.

Trackers

None. No third-party analytics, no advertising SDKs, no attribution. Your activity is not tracked across apps or websites.

Selling data

Never. Your personal data is not sold or handed to third parties for commercial purposes.

Your photos

In private storage where each account can only reach its own folder.

Location

Approximate (city level), optional, and never visible to anyone else.

Deletion

From inside the app, no email required. It is immediate and irreversible.

3. What we collect

3.1 Your account

• Email address, needed to identify your account.
• The provider identifier you sign in with. Sign-up happens through Apple or Google; signing in with an email and password is also possible. If you use “Sign in with Apple” and choose to hide your email, we receive the anonymous relay address Apple generates, not your real one.
• Your name, if the provider passes it to us at sign-up or if you type it in. Apple only sends it the first time you authorise the app.

3.2 Your profile

• The display name you choose.
• Year of birth and gender, both optional. You can leave them empty or choose “prefer not to say”.
• Country, and city if you typed one in.
• Profile photo, if you upload one. It is kept in private storage and shown only within your own session.
• Welcome survey: how you heard about Fragtal and what interests you about it. Answering is optional.

3.3 Your collection and activity

• Fragrance entries: brand, name, size, price paid, reference price, purchase date, millilitres remaining, and any shelves or groups you create.
• Photos you take of your own bottles. They are processed on your phone to cut the bottle out, then stored privately in a folder only your account can open.
• Wear logs: which fragrance you wore, when, how many sprays, and on what occasion (work, casual, party, date, formal, home or other), plus a free-text note if you write one.
• Notes and journal: the text you write about each fragrance, with its date.
• Reviews: emotional rating, longevity, sillage, whether it needed reapplication, and what reaction you noticed in people around you. This includes a question about physical discomfort, which has its own section below.
• Wishlist and trials: fragrances you want, where the impulse came from, and how testing them went — whether you recognised it, whether it lasted, whether it caused an allergic reaction.
• Monthly budget, if you set one.

3.4 Support and suggestions

• The feedback messages you send from the app, along with your account identifier, so we can reply and understand the context.
• Catalogue suggestions (the brand and name of a fragrance you couldn't find), so we can add it.

3.5 Device preferences

Language, light or dark theme, and currency are stored on your own phone, not on our servers. The initial language is taken from your system language.

3.6 What we do NOT collect

• Not your calendar, not your contacts, not your whole camera roll: only the image you pick for a fragrance or your avatar.
• No card details, bank account or billing address. Purchases are processed by Apple and Google, and we never see that data.
• No advertising identifiers, no device fingerprinting, no browsing history.
• No audio or recordings. The app does not use the microphone.

4. Data about your health

In some countries that answer counts as health-related data and receives heightened protection. We treat it that way in every case and for every user:

• It only exists if you create it. It is never inferred or derived: it appears only when you choose to write a review or log a trial, and answer that question.
• It is used for one thing: showing it back to you, inside your own collection, so you know which fragrances disagree with you and don't buy them again by mistake.
• It does not leave your account. It is not shared with other users, brands, advertisers, insurers or anyone else. It is also excluded from the aggregated statistics described in section 8.
• You can delete it by removing the review, the trial or the fragrance it belongs to, or by deleting your whole account.

Fragtal is not a medical device and gives no medical advice. If you suspect a fragrance is causing a reaction, consult a healthcare professional.

5. Approximate location

The app may ask for location permission the first time you open the camera to photograph a fragrance. Granting it is optional and the app works exactly the same if you decline; you will not be asked again.

If you do grant it, here is exactly what happens:

• We request the lowest accuracy available from the system (on the order of kilometres). On iPhone the app is additionally configured to receive location already blurred by the system. In the app stores this is declared as approximate location, not precise.
• That position is immediately turned into place names: city, municipality, state, country and country code. Coordinates are not stored: they are used to obtain those names and then discarded. No postal code, neighbourhood or street address is stored either.
• It is read at most once a week, never continuously, and never while the app is in the background.
• It is never shown to anyone else. Your own profile displays only the country — and not even that if you had already typed one in yourself.

It exists to understand which fragrances are worn and wanted in which areas, always in aggregate (section 8). You can revoke the permission at any time in your phone settings; if you also want what was already stored to be erased, write to us and we will delete it.

6. Legal basis

If you are in the European Economic Area or the United Kingdom, these are the legal bases for processing:

• Performance of a contract (Art. 6(1)(b) GDPR): creating and maintaining your account, storing your collection, photos, notes, wear logs and budget, and giving you access to the subscription if you buy one. Without this data the app cannot provide the service.
• Your consent (Art. 6(1)(a) GDPR): approximate location, granted through the system permission, and the optional profile and welcome-survey fields.
• Your explicit consent (Art. 9(2)(a) GDPR) for the answers about discomfort or allergies described in section 4, given when you answer that specific question.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure, preventing abuse, and producing aggregated, anonymised statistics to understand the market and improve the app. You can object by writing to us.

You can withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

7. Who we share it with

We do not sell your data or hand it over for advertising. The only third parties involved are the infrastructure providers needed to run the app, acting as data processors on our instructions:

• Supabase — database, authentication and storage for your photos. This is where your account and collection live.
• Cloudflare — delivery of the fragrance catalogue images and hosting of this website. It receives your device's IP address when serving those files, like any internet server.
• Apple and Google — sign-in, app distribution and purchase processing. Their processing is governed by their own privacy policies.

We may also disclose information if legally required by a competent authority, or where necessary to defend rights against misuse of the service.

8. Aggregated and anonymised data

Fragtal may produce aggregated, anonymised statistics about trends — for example, which brands are most wanted in a region, or how average spending evolves — and share or commercialise them with brands, retailers and industry media.

9. International transfers

Our database is hosted on servers located in the United States. If you use the app from Mexico, the European Union or anywhere else, your data is transferred there in order to provide the service.

For transfers from the European Economic Area and the United Kingdom we rely on the Standard Contractual Clauses approved by the European Commission, incorporated into our infrastructure provider's data processing agreement. You can ask us for further information about these safeguards at hello@fragtal.app.

10. How long we keep it

• For as long as your account exists. Your collection is a history: it is useful precisely because it builds up, so it is not deleted automatically over time.
• When you delete your account, the data is removed immediately from the database and from file storage.
• Backups: our provider keeps encrypted backups for a maximum of 30 days, after which they expire automatically. During that window your data may persist in a backup, which would only be restored after a serious service incident.
• Aggregated statistics that have already been anonymised (section 8) may be kept indefinitely, since by then they no longer identify you.

11. Your rights

You can exercise these rights by writing to hello@fragtal.app from the email address linked to your account. We reply within 30 calendar days at most, free of charge.

• Access: get a copy of the data we hold about you.
• Rectification: correct anything wrong or incomplete. Almost everything can be edited inside the app.
• Erasure: delete your data. Available inside the app (section 12).
• Objection and restriction of processing.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw your consent where processing is based on it.

We do not make automated decisions with legal effects about you, nor do we profile you with such consequences.

If you are in the EU or the UK

You may lodge a complaint with the supervisory authority in your country of residence if you believe we have not handled your request properly.

If you are in Mexico

You may exercise your rights of access, rectification, cancellation and objection (ARCO rights) through the same channel, as well as withdraw your consent, in accordance with Mexican legislation on the protection of personal data held by private parties, and turn to the competent authority in the matter.

If you are in California

We do not sell or share your personal information as those terms are defined under California law, and we do not carry out cross-context behavioural advertising. You have the right to know what we collect, to request its deletion and correction, and not to be treated differently for exercising those rights.

12. Deleting your account

It lives inside the app: Profile → Account → Delete account. No need to email us or wait for approval.

When you confirm, the following are removed, in this order:

• Your fragrance photos and profile picture, from private storage.
• Your sign-in account and, cascading from it, your profile, collection, wear logs, reviews, notes, wishlist, budgets and survey answers.

Deleting the app from your phone does not delete your account: your data stays on the server until you use the option above.

13. Minors

Fragtal is intended for people 18 and over. We do not knowingly collect data from anyone under that age. If we find out about, or are told about, an account belonging to someone under 18, we will delete it along with their data. If you believe a minor in your care has given us information, write to hello@fragtal.app.

14. Security

• All traffic between the app and the server is encrypted (TLS), and data is stored encrypted at rest.
• The database enforces row-level security: every query is confined to its own user's rows. This is not an app-side check that can be bypassed — it is a rule of the database engine itself.
• Your photos live in private storage with no public URL. They are served through signed, temporary links that expire on their own.
• Passwords, where used, are stored with irreversible hash functions: we do not know them.

No system is infallible. If a security breach affecting your data were to occur, we will notify you and inform the authorities where the law requires it.

15. This website

fragtal.app uses no cookies, runs no third-party code and has no analytics. It loads no external fonts or resources: it uses the typefaces already on your device. That is why you will not see a cookie banner — there is nothing to consent to.

The site is hosted on Cloudflare, which processes technical connection data — such as your IP address — to serve the pages and protect them from attacks.

16. Changes to this policy

If something relevant changes, we will update this page and the effective date in the header. When a change materially affects how we handle your data, we will tell you inside the app or by email before it takes effect. Previous versions are kept and we can send them to you on request.

17. Contact

Andrés Blanco F. — Mexico
hello@fragtal.app

Write without hesitation: there is a person on the other end, not a form.