Privacy policy

This page covers the Dayscent app and the dayscent.app website.

Effective date: September 29, 2026

Dayscent (“the app”, “we”, “us”) is a fragrance companion app: you keep your collection, and it suggests a scent for today based on the weather, the occasion and your preferences. Dayscent is run by Carlos Alvarez, an individual based in Kansas, USA. Questions: [email protected].

We don’t sell your personal information or share it for advertising, and there are no ads. Below is what we collect and why, who else receives it, how long we keep it, and what you can do about it.

1. What we collect

Your account

• Your email address, used to send you a 6-digit sign-in code. We never show it to other users, and nobody can search for you by email or phone number.
• Basic sign-in records kept by our hosting provider, such as when your account was created, when you last signed in, and technical logs with your IP address and device/app type.

Your profile and settings

• Optional display name, username, profile photo and signature scent.
• Your preferences: temperature unit, scent families you like and notes you want to avoid.

Your collection

• The fragrances you add, when you added them, favorites, ratings and personal notes.
• Optional photos of your own bottles.
• Fragrances you add by hand (the name, brand and details you type).

What you wear and share

• Your wear log: which fragrance, when, the occasion you picked, and a small weather snapshot (temperature, humidity and a condition such as “rain”). It does not include your location.
• If you use Friends: posts you choose to share (with an optional caption, rating, tag, time, weather, occasion or poll), poll votes, reactions, comments, who viewed your posts, your friends and friend requests, people you blocked, and suggestions you dismissed.
• Reports you make, and reports other people make about you (see section 6).

Your location (only if you allow it)

• The app asks for your location only while you use it, to get the weather. On your phone, we round your position to about 1 km before it is used. The rounded position and the city name stay on your phone. We don’t store your location on our servers.

Photos and camera (only if you allow it)

• Only the photo you pick is uploaded. The app re-saves it first, which removes hidden photo data such as the GPS position.

Searches and AI lookups

• The words you type when searching for a fragrance, and the name, brand and concentration you type when you ask for an AI lookup.

We don’t collect your contacts, precise location, microphone, health data, payment details (none today) or advertising identifiers.

2. Why we use it (and our legal bases)

3. Who can see your information

• Only you: your email, collection, ratings, personal notes, bottle photos, hand-added fragrances, preferences, and any wear you didn’t share.
• Anyone signed in to Dayscent: can find you by searching your exact username (the results show only the username).
• People you sent a friend request to (while it’s waiting for an answer): your username, display name and profile photo. They can’t see your posts until they accept.
• Your friends (requests accepted): your username, display name and profile photo; your shared posts (in the Feed for 7 days, and older shared posts on your profile) and the reactions and comments on them. If you or they block the other, this stops.
• People you may know: someone who shares a mutual friend with you may see your profile photo in suggestions for up to 30 days, unless either of you blocked the other or the suggestion was dismissed.
• Post authors see who viewed their post and, for polls, who voted (other viewers see voters only if the author turned that on).
• Us (the app owner): we can access stored data to run the service, handle reports and answer your requests.

4. Services we use (third parties)

We use these providers to run the app. They get only what they need for the purpose listed.

• Supabase (hosting, database, file storage and sign-in). Stores the data described above in the United States.
• Resend (email delivery): receives your email address and the sign-in code so it can deliver the email.
• Anthropic (AI): when you tap “Look it up with AI”, our server sends Anthropic only the fragrance name, brand and concentration you typed. We don’t send your email, username, account id, collection, location or device information. If the AI doesn’t know the fragrance, it may search the web for it using those same words. The result is saved as a shared fragrance entry that other users can find, so please don’t type personal information into those fields.
• Fragella (fragrance database): our server sends only the search words you type. No account or device information is sent.
• Bottle image hosts: fragrance bottle pictures load from the image addresses provided by Fragella, so those hosts see your IP address, like any website image.
• Open-Meteo (weather): your phone sends your rounded location (about 1 km) to get the weather; Open-Meteo also sees your IP address. Planned: we may switch to Apple WeatherKit, called from our server with your rounded location. We’ll update this policy before we do.
• Apple and Google (city name): your phone’s built-in location service turns your rounded location into a city name.
• Apple App Store and Google Play: distribute the app; they handle store accounts and any purchases under their own policies.

Planned services (not in the app yet; this policy will be updated before any of them is added): crash reporting (Sentry), product analytics (PostHog), subscriptions (RevenueCat), and push notifications (Expo push service with Apple and Google).

We may also disclose information if the law requires it, to protect people’s safety (for example, reporting child safety concerns or threats to the authorities), or if the app is transferred to a new owner (who must keep this policy’s promises).

5. How long we keep it

• Your account data (profile, collection, photos, wears, posts, comments, reactions, friends, blocks, preferences): until you delete it or delete your account.
• Photos you replace are deleted after the new one is saved.
• Search cache: search words (without any account link). We stop using an entry after 30 days; it is deleted the next time our server saves a new search, so an old entry can stay stored somewhat longer when searches are quiet.
• Suggestion history (“People you may know”, who was shown to whom): used for 30 days. Older records are deleted the next time your suggestions load, and always when either account is deleted.
• Lookup counts used for daily limits: until you delete your account; after that they stay only as anonymous counts.
• Reports: kept until reviewed and then for 365 days after review, even if an account involved is deleted (see section 6). We delete reports past that point in a monthly clean-up, so one can remain for up to about a month longer.
• Hosting logs and backups: kept by Supabase for their normal, limited period.
• On your phone: the offline copy is kept up to 7 days (weather up to 3 hours). Sign-out and in-app account deletion clear offline data, your setup progress and cached pictures. After deletion by email, this happens when the app reconnects and detects that your session is no longer valid. A marker that remembers the intro was seen stays; it holds no personal data and lets the app reopen at sign-in. You can also clear the app’s storage or uninstall it.

6. Reports and moderation

When someone reports a person, post or comment, we save a copy of what was reported (for example the username, display name, the post’s fragrance name or the comment) and the reason, so we can review it even if it’s later changed. The reported person isn’t told who reported them. Reports are only visible to us. When an account is deleted, its link to a report is removed but the copy stays until the report is deleted (in the first monthly clean-up after 365 days from review).

7. Your rights and choices

Everyone can:

• See and correct most of your data in the app (profile, collection, preferences).
• Delete content in the app (collection items, photos, wears, posts, comments, reactions).
• Delete your account in the app: Profile → Settings (menu at the top) → Account options → Delete account. Or email us: see dayscent.app/delete-account.
• Turn off location, photo and camera access in your phone settings, and turn off “Share what I wear” in the app.
• Ask us for a copy of your data, or anything else about your data, at [email protected]. We’ll answer within 30 days (45 days where the law allows) and may need to confirm you own the account (for example by replying from the account’s email address).

California (CCPA/CPRA): California residents have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; and not to be discriminated against for using these rights. We don’t sell or share personal information for cross-context behavioral advertising, and we don’t use sensitive personal information to infer characteristics. You can use an authorized agent; we may ask them for proof. To make a request, email [email protected].

Other US states: several states (for example Virginia, Colorado, Connecticut, Utah and Texas) give similar rights. We honor the same requests for everyone in the US, and you can appeal a decision by replying to our answer.

EU, UK and similar countries: if you use Dayscent there, you also have the right to object to or restrict some uses, to data portability, and to complain to your local data protection authority. Your data is stored and processed in the United States by the providers above, which rely on standard contractual clauses or similar safeguards where required.

8. Children

Dayscent is not meant for children under 13, and Friends requires you to be at least 13 (or older where the law requires it; see the Community Terms). We don’t knowingly collect data from children under 13. If you believe a child under 13 has an account, email [email protected] and we’ll delete it.

9. Security

• Your data is protected by row-level security in the database: each account can only read and change its own rows; friends only see what the rules above allow.
• Photos are in private storage, reachable only through short-lived signed links (15 to 60 minutes).
• Secret keys for our providers stay on our servers, never in the app.
• Connections use HTTPS. Paid lookups and sign-ins are rate-limited.

No system is perfectly secure. If we learn of a breach that affects you, we’ll tell you as the law requires.

10. This website and the waitlist

This section covers dayscent.app, the website you are reading.

• Hosting: the site runs on Cloudflare (Cloudflare Pages). Like any web host, Cloudflare processes your IP address and basic request details to deliver the pages and protect them from abuse.
• Waitlist: if you join the waitlist, we store your email address and the date you joined in Cloudflare Workers KV (Cloudflare’s key-value storage). We use it only to email you when Dayscent launches. We don’t send any other email, and we don’t share or sell the list.
• Abuse protection: to stop automated sign-ups, we keep a short-lived counter tied to a one-way hash of your IP address and the current hour. It expires after one hour, and we never store your IP address itself, with your email or anywhere else.
• No tracking: the website doesn’t use cookies, analytics or advertising trackers, and its fonts and images come from dayscent.app itself, not from other companies’ servers.
• Leaving the waitlist: email [email protected] and we’ll remove your address. We’ll delete the whole waitlist once the launch email is sent, or after 12 months at the latest.

11. Changes to this policy

We’ll update this page when the app changes what it collects or who it shares with, and change the effective date above. If a change matters, we’ll tell you in the app before it takes effect.

12. Contact

Carlos Alvarez, Kansas, USA. Email: [email protected].