Privacy & Cookies

Who we are

Identifrag is responsible for the personal information processed through this website (the data controller). For privacy questions or requests, use our contact page.

Your account

An account is optional. If you create one, we keep your email address, username, optional name, account identifier, verification status, account dates and the version of the privacy notice shown when you registered. Your saved fragrances and their “Want to try” or “Already own” collection are stored with your account. You can add an optional profile picture; we store a re-encoded square copy without its original file name or photo metadata, and remove it when you replace or remove it, when an editor removes it, or when you delete your account. Profiles are public by default and show your name, username, profile picture, published reviews and your “Want to try” and “Already own” collections. You can make your profile private in account settings. Reviews on fragrance pages remain public and link to your profile; a private profile shows an unavailable message and hides your collections. Photo submission history stays private. Editors can access account details to review photo submissions.

For email sign-in, you choose a password when registering and verify your address before signing in. We store a salted password hash, not a readable password. We use your email for verification, password recovery and essential account messages. Creating an account does not subscribe you to marketing.

We use this information to provide and manage the account you request, relying on contractual necessity where applicable. We rely on our legitimate interests in protecting accounts and preventing misuse for security checks and temporary rate limits. We do not use account information for automated decisions with legal or similarly significant effects.

You can update your username and name, download account data, change an email-account password and delete your account from your account settings. For email corrections or other requests, use our contact page.

Your fragrance reviews

If you publish a review, your username, profile picture (while your profile is public), review text, positive or negative verdict, personal scent ratings and review date are visible to other visitors. Your email is not shown with it. We store the review with your account and fragrance so you can edit or remove it. Your account data download includes your reviews; deleting your account removes them from the active database.

Reporting reviews and profiles

Anyone can report a review or public profile. We store the reason, any details you add, a copy of what you reported and the report date, so editors can review it even if the content changes. If you are signed in, the report is linked to your account and included in your account data download. If you are not, we keep a one-way hashed form of your network address to prevent duplicate reports and abuse, not your address itself.

We never tell a member who reported them. Editors may remove a review or profile picture, or make a profile private, when it breaks our standards. Reports about a member are deleted with their account.

Signing in with Google

When available, Google sign-in is an alternative to an Identifrag password. If you choose it, Google provides your name, email address, verification status and a unique Google account identifier. We use these to create or recognise your account. We do not request your contacts, calendar, emails or files, and never receive your Google password.

The sign-in service briefly processes Google tokens to verify your identity. We do not save Google access or refresh tokens. Google processes your use of its sign-in service under its privacy policy, including its international processing arrangements. No Google sign-in script is loaded while you browse the collection; a Google request begins when you choose Google sign-in.

Deleting your Identifrag account does not delete your Google account. You can also manage Identifrag’s connection in your Google account settings.

Photos you contribute

If you submit a photo for a fragrance with a missing image, we store the processed image, fragrance, your account reference, submission dates and the exact rights-and-permission statement you confirm. We resize the picture and remove embedded metadata, including location data. Please do not include people or personal information in the picture itself.

You must confirm that you own the rights and give Identifrag permission to store, resize and display the picture. A submission is private to you and editors until an editor approves it. Editors can review your account name, email address and submission history through an admin-only profile. Approval makes the picture visible on the fragrance page; it does not change your profile visibility or make your email public.

We use these records to review submissions, document permission and respond to questions about the image. Pending submissions stay in the review queue until an editor decides. Removing an image deletes it from active image storage and detaches it from fragrances, while its submission and rights record remain linked to your account. Deleting your account also deletes your submissions and their images, including approved pictures. Backup retention follows the arrangements described below. Use our contact page about image removal or a rights concern.

Account security and retention

We keep a verified profile while the account is open. Deleting it removes the profile, fragrance reviews, saved fragrance collections, password hash, Google identifier, verification and reset records, sign-in sessions and photo submissions from the active database. Submitted photos, including approved photos, are also removed from active storage and fragrance pages. Separate correspondence may still be needed to resolve an enquiry or meet a legal obligation. Backup copies may remain until the backup retention period ends; that period is awaiting confirmation for this draft.

Unverified accounts are scheduled for deletion after seven days. Email verification links expire after 24 hours, password reset links after 30 minutes and pending Google sign-ins after 10 minutes. Links work once. Expired records are removed by hourly maintenance when the service is running.

Account sessions expire after seven days, or earlier on sign-out, account deletion or password reset. Changing a password signs out other sessions. We store hashed session and email-link tokens, plus security tokens used to protect requests. Temporary sign-in limits use hashed IP addresses and email addresses; limits reset after 15 minutes and expired records are removed during hourly maintenance.

Browsing and analytics

You can browse the fragrance collection without creating an account. We record searches and selected filters, fragrance-page views and buying-link clicks to understand how the collection is used and where it can be improved.

These records include a daily identifier derived from your IP address and browser information. It groups activity during one day and changes the next day. We do not store the original IP address or browser information in these analytics records. The identifier is a privacy measure; we do not treat it as a guarantee of anonymity.

Our analytics do not set cookies. Records are automatically scheduled for deletion after the configured retention period, which is 90 days by default. Our servers also process connection information to deliver pages and protect the service.

Cookies and browser storage

We use browser storage to remember your selected delivery country and help restore your place in the collection. These settings are stored on your device.

• Country preference: local storage remembers your selection between visits until it is changed or cleared.
• Collection browsing: session storage remembers your search and filters for the browser tab’s session.
• Editorial access: a session cookie protects access to the editorial workspace. It expires after one hour for an unsigned-in session or eight hours for a signed-in session, unless cleared earlier.
• Visitor account: the essential identifrag_account cookie keeps you signed in and protects account requests. It lasts one hour before sign-in or seven days after sign-in. Browsing alone does not create this account cookie.
• Google sign-in: the essential identifrag_google cookie connects a sign-in attempt to your browser. It lasts up to 10 minutes and is cleared on return from Google.

You can remove cookies and stored preferences through your browser’s site-data settings. Blocking storage may prevent preferences from being remembered or stop account and editorial sign-in from working. Clearing browser data does not delete records already held on our servers. Necessary sign-in cookies support the service you request; this policy is not consent to optional tracking.

Buying links and affiliate tracking

Some buying links may earn Identifrag a commission if you make a purchase, at no extra cost to you. Our funding and independence information explains how this relates to our editorial work.

When you follow a buying link, we record the retailer, fragrance, selected country and destination link. An affiliate link may pass through an affiliate network before reaching the retailer. The network and retailer receive connection information and may use cookies or similar technologies to attribute a purchase to Identifrag.

Their privacy notices and consent choices explain their processing. Identifrag does not receive your payment details when you purchase from a retailer. A paid-link disclosure does not itself constitute consent to tracking.

When you contact us

We use your name, email address, message and any optional information you submit to respond to enquiries and review fragrance suggestions. Required fields let us understand your request and reply. Messages are delivered to our email inbox; the contact form does not save the message itself in the catalogue database.

To limit spam, we temporarily keep a hashed version of your IP address and a submission count. The limit resets after one hour, and expired records are removed during routine maintenance.

We retain correspondence while an enquiry or related business relationship is active, and afterwards only where needed to keep a record of decisions, resolve disputes or meet legal obligations. The appropriate period depends on the purpose and content of the correspondence.

Why we use information

We rely on our legitimate interests in operating and securing Identifrag, understanding use of the collection, responding to enquiries and reviewing suggestions, balanced against your rights. Where processing is necessary to take steps you request before entering a contract, or to perform that contract, we rely on that basis. We may also process information to meet legal obligations.

Where consent is required for a particular use of cookies or similar technologies, it must be obtained before that use begins. This notice does not give or replace that consent.

Who handles information

People administering Identifrag and service providers supporting its hosting, database and email may handle information as needed to operate the service. We may disclose information where required by law or necessary to establish, exercise or defend legal claims.

Provider identities, processing locations and any required international-transfer safeguards must be confirmed for the deployed service before this draft is finalised. Use our contact page for details. We do not sell account information or share it with retailers as part of a buying-link click.

Retailers and affiliate networks handle information received when you follow their links under their own privacy arrangements, which may include processing outside the UK or European Economic Area. Please review those arrangements before using their services.

Your rights and choices

Depending on the circumstances, you can ask to access, correct or delete personal information, restrict its use, object to processing based on legitimate interests, or receive portable information where that right applies. Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal.

Use our contact page to make a request. We may need information to verify your identity and locate relevant records. Daily analytics identifiers may limit our ability to identify records relating to you.

We aim to respond without undue delay and within one month where UK data protection law applies. Some requests may allow a lawful extension or exemption; we will explain if that affects your request. The account download contains profile information and session dates, not all possible correspondence or server records.

Changes to this policy

We will update this page when our handling of personal information changes and show the new review date. Where required, we will bring material changes to your attention before using your information for a new purpose.