Privacy Policy

A clear view of your data.

This policy describes how Ash & Tell ("Ash & Tell", "we", "us") handles information when you use our mobile journal and this website. Contact support@ashandtell.com with privacy questions.

Ash & Tell is a private cigar journal for adults aged 21 or older. It is not a public social network. A guest journal is kept on your device; signing in enables cloud sync. AI recognition and cigar-name lookups involve sending content to our service and Google Gemini.

What we collect.

The information we receive depends on the features you use. Optional data still reaches our servers when you choose to use those features.

We do not request your phone contacts, payment-card details, health records, microphone recordings, or access to your wider photo library. Avoid including other people or unrelated personal information in a cigar-band photo.

Why we use it.

• To create and authenticate accounts, send signup or password-recovery messages, and keep the service secure.
• To save your journal, display your entries and sync account content and confirmed photos across devices.
• To identify cigar bands and retrieve AI-written information about a cigar you name.
• To attach an optional place to a journal entry. Your device's geocoding service may process coordinates to resolve a place name.
• To provide support and process privacy and account-deletion requests.
• To understand recorded journal activity, cigar preferences, review responses and shared locations through internal administration and reporting.

Authorized operators can access synced account, journal, photo and location data to operate the service, provide support and review internal reports. The cloud journal is not end-to-end encrypted.

We do not sell your personal information, run advertising in the app, or use the app's data for cross-company targeted-advertising tracking.

AI recognition and Google Gemini.

Scanning sends the framed image through our recognition service to Google's Gemini API. Entering or correcting a cigar name may send that name for a details lookup or an AI-written profile. Location metadata, your account identifier and the rest of your journal are not included in those Gemini requests.

Our current Gemini project uses an active paid billing account. Under Google's paid-service terms, inputs and responses are not used to improve Google's products. Google may retain prompts and responses for a limited period for safety, abuse prevention and required disclosures. The service also processes technical usage information.

See the Gemini API terms and Google Privacy Policy. AI-generated content can be inaccurate. Confirm a suggested cigar name and check information that matters. Do not submit passwords, verification codes or sensitive personal information to recognition.

If we change the provider or its data handling, we will update this policy and the applicable store disclosures.

Who helps deliver the service.

We use hosting and infrastructure providers for the app's servers, database and this website; email infrastructure to deliver account messages; Apple and other enabled sign-in providers for authentication; and Google Gemini for recognition and cigar information.

Our account and journal services use self-hosted authentication software and PostgreSQL. Using that software does not mean your journal is stored in a public community or on a third-party social feed.

Service providers receive the information needed for their functions under their applicable terms. Your device's location and geocoding providers may also process data under their policies. We may disclose information if required by law or reasonably necessary to protect users, security and legal rights.

Providers may process information outside your country. Where applicable, transfers must use the protections required by local law.

Storage, security and retention.

The mobile journal uses encrypted on-device storage. Network communication uses HTTPS. Access to cloud data is controlled by account authentication and server access controls. No security system can guarantee protection against every risk.

Account and cloud journal content is retained while your account is active. Removing a cigar, photo or account moves retained server data into a private recovery archive. AI profile responses may be cached by cigar name to avoid duplicate requests; the recognition cache is not an account search-history feed. Technical and abuse-prevention information is retained as needed for security and service operation.

Deleting a photo or cigar removes it from your active diary. Deleting an account removes its sign-in identity and active cloud journal. Before removal, a private server archive retains available account details, synced cigar records, photos, locations, review answers and operation history for recovery. These archives are restricted to authorized server operators, are not shown in the app or available from public download links, and have no automatic expiry. Authentication passwords and sign-in tokens are not included in this archive. To request permanent removal of archived personal data, contact support from your account email; we verify ownership and address requests according to applicable privacy rights. Separate recovery backups have a seven-day rotation period.

Other devices may hold offline copies until they reconnect or their local data is removed. A guest journal remains on its original device; uninstalling the app can remove that data. We cannot restore guest-only content that was never synced.

Your controls and rights.

You can use a guest journal, turn off location or reminders in the app, revoke permissions in your device settings, delete journal records, and delete a signed-in account from Profile & settings. See Privacy choices for the available controls and Delete account for in-app and email instructions.

Depending on where you live, you may have rights to access, correct, receive a copy of or delete your information, object to certain processing, restrict processing, or withdraw consent. Contact us to exercise those rights. We verify account ownership before providing private data or deleting an account.

Where applicable, we process data to provide the service you request, with permission for optional features, and for legitimate interests such as security, support and internal service analysis, subject to your rights. You may also raise a concern with the appropriate privacy authority.

This website.

This website does not include advertising or third-party analytics scripts. We serve fonts and brand assets from the site itself. Hosting and security services receive technical connection information needed to deliver and protect the pages.

The account-deletion form prepares an email in your own email app. It does not submit data to a website database, and a request is not sent until you send that email. Support correspondence is used to address your request and may be retained as needed to document its resolution.

The mobile store buttons are marked "Coming soon" until the app's public listings are available. They do not install software, collect payment, or add you to a mailing list.

Adults, updates and contact.

Ash & Tell is intended for adults aged 21 and older. We do not knowingly seek personal information from children. If you believe an underage person has supplied information, contact us so we can investigate and take appropriate action.

We may revise this policy as the service changes. The date at the top identifies the current version. Significant changes will be communicated where required.