Privacy policy

• Your account. Your email address and password. Passwords are stored only in hashed form by our sign-in provider; we can’t read them.
• Your ledger. What you enter: cigars in your collection, humidors, dates acquired, prices paid, smokes, verdicts, scores, tasting notes, notes and reminders, and your settings.
• Photos. Any photos you attach to a smoke, and smaller copies we make for thumbnails.
• Billing. When you subscribe, Stripe handles your card. We receive only what we need to manage your plan: that you’ve paid, which plan you’re on, the last four digits and expiry of your card, and your billing country.
• Technical basics. Our hosting providers keep standard server logs (such as IP address, browser type and the pages requested) for security and fixing faults. They’re kept for a short time and not used to profile you.

We don’t collect your location, contacts or anything from your device beyond what you choose to upload.

• to run the ledger: storing your records and showing them back;
• to do what the ledger does with them — the cigar’s page, the journal, reminders and tonight’s pick;
• to send email you need: sign-in links, password resets, email changes, receipts, reminders you’ve set, and notice of changes to your plan or these policies;
• to take payment and manage your subscription;
• to keep the service secure and fix what breaks.

We don’t send marketing email unless you’ve asked for it, and every such email will let you stop it.

Nothing, unless you share it. Your collection, journal and notes are private to your account.

• Shared pages. Sharing is off until you switch it on in Settings. While it’s on, anyone with the link to one of your journal pages can see that page — the cigar, verdict, score, notes and photo — but not your email or the rest of your ledger. We ask search engines not to list shared pages. Switch sharing off and every link stops working.
• The shared catalog. The details of a cigar you add (brand, line, vitola, size and leaf) join a catalog every keeper can pick from. They aren’t shown with your name. Your holdings, prices and opinions never join it.
• Photos. Photos are served from unlisted web addresses that can’t be guessed. Anyone who has a photo’s exact address can open it, which is how shared pages show them.

We may study aggregated, de-identified patterns across all keepers (how a cigar tends to be rated, say) to improve the service. That never identifies you.

We use only the cookies that keep you signed in. Your browser also remembers a few display preferences on your own device, such as which panels you’ve collapsed. There are no advertising cookies, no third-party trackers and no analytics that follow you elsewhere.

We don’t sell or rent your information, and we don’t share it for anyone’s advertising. A few providers process it on our behalf, only to run the service:

• Supabase — database, sign-in and photo storage;
• Cloudflare — photo storage and delivery;
• Vercel — hosting the website;
• Stripe — payments;
• our email provider — sending account and reminder email.

Your information is stored and processed in the United States. We may also disclose it if the law requires us to, or to protect the service or its keepers from harm.

For as long as you have an account. Closing it from Settings deletes your account, your records and your photos there and then, except where we must keep something longer — billing records, for instance, which tax law requires us to hold. Backups roll over and clear within 30 days. Catalog entries stay, because they aren’t tied to you.

Wherever you live, you can ask us to:

• send you a copy of your records;
• correct something that’s wrong;
• delete your account and everything in it.

You can do most of this yourself in the app, deletion included: Settings has a “Close your account” option that removes your account, your records and your photos immediately. For anything else, write to sepialedger@gmail.com from the address you sign in with and we’ll answer within 30 days. Depending on where you live you may have further rights under local law; we’ll honour them.

Connections to Sepia Ledger are encrypted. Each keeper’s records are walled off at the database, so one account can’t read another’s. Secret keys stay on our servers and never reach your browser. No system is perfect; if a breach ever affects your information, we’ll tell you promptly.

Sepia Ledger is for adults 21 and over. We don’t knowingly keep information about anyone younger. If you believe someone under 21 has an account, tell us and we’ll delete it.

If we change how we handle your information in a way that matters, we’ll tell you by email or in the app before it takes effect. The date at the top shows when this policy last changed.

Questions? Write to sepialedger@gmail.com. The rules for using the service are in our terms of service.