Data Policy

Scentsore is a shared-air awareness platform that allows communities to observe and share experiences of the air in publicly accessible places. The platform helps reveal community patterns through user-submitted observations rather than environmental measurements. Scentsore operates under New Zealand law and is committed to responsible data handling.

For any privacy-related questions, contact us at: support@scentsore.com

We collect the following categories of data:

Account Information

• Email address (required to create an account)
• Display name or username
• Profile details you optionally provide (first name, last name, avatar)
• Authentication tokens and session data

Observation Reports

• Location data — the geographic coordinates and place details of observations you submit
• Report category (for example fragrance, cleaning products, smoke, fresh air, or other available categories) and reported intensity where applicable
• Optional body response observations you choose to report (for example head, breathing, skin, or other responses) together with your self-rated intensity
• Date and time of observations
• Optional free-text notes you attach to a report
• Fresh-air acknowledgements and associated reasons

Preferences

• Your saved app preferences (where applicable), stored locally and synced to your account when signed in
• Saved locations
• Onboarding completion status

Technical and Usage Data

• Browser type, device type, and operating system
• Pages visited and features used within Scentsore
• IP address (used for security and fraud prevention)
• Cookies and local storage data (see Section 7)

We use the data we collect to:

• Provide and operate the Scentsore platform
• Display observations about shared-air conditions on the community map
• Remember your saved app preferences where applicable
• Enable you to submit, edit, and review your own reports
• Send account-related emails (verification, password reset, important notices)
• Improve platform performance, features, and user experience through aggregated analytics
• Detect and prevent fraud, abuse, and misuse of the platform
• Comply with our legal obligations

We do not use your data to build advertising profiles, sell to data brokers, or target you with third-party advertising.

Scentsore allows you to optionally record physical responses to shared-air exposures (e.g. headache, breathing difficulty, skin irritation). This information is health-adjacent and treated with additional care.

• Body response data is submitted voluntarily and is never required
• It is used solely to contribute to community awareness of shared-air experiences on the platform
• It may be displayed only as anonymised community summaries or combined with other reports where appropriate
• It is not shared with health insurers, employers, medical providers, or any third party for profiling purposes
• It does not constitute a medical record and Scentsore does not use it to provide health advice

Community observations published through Scentsore are user-submitted reports describing individual experiences. They are not independently verified measurements of air quality or environmental contaminants and should not be interpreted as scientific testing or medical advice.

We collect and process your personal data on the following legal grounds (relevant to users in jurisdictions such as the EU/EEA under GDPR, and New Zealand under the Privacy Act 2020):

• Contract: Processing necessary to provide the service you signed up for (account creation, saving reports)
• Legitimate interests: Platform security, fraud prevention, aggregated analytics, and improving the service
• Consent: Optional features and marketing communications where you have explicitly opted in.
• Legal obligation: Where we are required to process data to comply with applicable law

Scentsore does not sell your personal data. We share data with third parties only where necessary to operate the platform:

Infrastructure and Hosting

• Our backend infrastructure and database are hosted by Supabase (data stored in secure, access-controlled environments)
• Our website and application are deployed via Vercel

Mapping Services

• We use the Google Maps Platform API to display maps and resolve place information. Location searches you perform may be processed by Google under their own privacy policy

Analytics

• We use Google Analytics 4 to understand aggregate usage patterns. This collects anonymised, aggregated data only. You can opt out using browser extensions that block Google Analytics

Payments

• If you make a support contribution, payments are processed by Stripe. Scentsore does not store full card details. Stripe operates under its own privacy policy

All third-party providers are bound by data processing agreements and are required to handle your data securely and in accordance with applicable law.

Scentsore uses the following technologies to store data on your device:

Essential Cookies

• Authentication session tokens — required to keep you signed in
• These cannot be disabled without affecting core functionality

Local Storage

• Your saved app preferences (where applicable), stored locally and synced to your account when signed in
• Onboarding completion flag
• These are stored on your device only and are not transmitted unless you are signed in

Analytics Cookies

• Google Analytics 4 uses cookies to help us understand how the platform is used. We use this information in aggregate to improve Scentsore. Google processes this information in accordance with its own privacy practices.

We do not use advertising cookies, cross-site tracking cookies, or third-party behavioural targeting technologies.

We retain your data for the following periods:

• Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request
• Observation reports: Retained indefinitely as part of the community dataset, unless you delete them. If your account is deleted, reports are anonymised (unlinked from your identity) rather than removed, to preserve community data integrity — unless you explicitly request full deletion
• Analytics data: Aggregated analytics are retained for up to 26 months per Google Analytics default settings
• Support emails: Retained for up to 3 years for customer service record-keeping

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Deletion: Request deletion of your account and associated personal data
• Portability: Request your data in a structured, machine-readable format
• Restriction: Ask us to restrict processing of your data in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at support@scentsore.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

New Zealand users may also contact the Office of the Privacy Commissioner at privacy.org.nz if you believe your privacy rights have been breached.

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• Encryption of data in transit (HTTPS/TLS across all connections)
• Encryption of data at rest within our database infrastructure
• Row-level security policies restricting data access to authorised users only
• Authentication via secure tokens with expiry
• Regular review of access controls and third-party provider security posture

No system is completely secure. If a data breach occurs that is required to be reported under applicable law, we will notify affected users and relevant authorities without undue delay and in accordance with our legal obligations.

Scentsore is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

Users between 13 and 18 should use the platform with parental or guardian awareness.

Scentsore is operated from New Zealand. Our infrastructure providers (Supabase, Vercel, Google) may store or process data in data centres located in multiple countries, including the United States and the European Union.

Where data is transferred internationally, we ensure that appropriate safeguards are in place (including Standard Contractual Clauses where applicable) to protect your data in accordance with New Zealand and applicable international privacy standards.

We may update this Data Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we may also notify you by email or through an in-app notice.

Continued use of Scentsore after changes are posted constitutes your acceptance of the updated policy.

For any questions, concerns, or requests regarding this Data Policy or your personal data, please contact: