Privacy policy
Humido is a personal journal for adult cigar aficionados: cellar, tastings, catalogue, community. This policy explains what data we process, why, for how long, and how to exercise your rights. We do not sell any data and do not display any advertising.
1. Data controller
Lucas Boisseval, sole proprietor (entrepreneur individuel, Moodboard), publisher of Humido
8 rue Abel Antoune, 33110 Le Bouscat, France – SIREN 838 335 487
Contact for your data: privacy@humido.app
Humido has not appointed a data protection officer (DPO), because its processing does not require one. All requests relating to your data are handled by the publisher at the address above.
2. Data we process
Your account
- Email address and password (stored encrypted), or the identifier provided by Apple, Google or Facebook if you sign in with them.
- Username, display name, profile photo, short bio, language.
- Age declaration and acceptance of the terms of use, with their date and version. We do not ask for your date of birth.
- Guest mode: an anonymous account without an email address, to browse the app before signing up.
Your cellar and your journal
- Humidors (name, freely described location, settings, maintenance), humidity and temperature readings.
- Cigars in stock: quantity, purchase price and date, shop, notes.
- Tastings: rating, date and time, duration, occasion, pairing, aromas, comment; wish list, gifts.
- Tastes and habits inferred from your ratings and your “likes”, to personalize suggestions.
This information concerns your cigar consumption. It remains private unless you choose to share it.
The community (only if you make your profile public)
- Posts (text, photos, city or establishment, never GPS coordinates), comments, “likes”, follows, reviews of establishments.
- Blocks, mutes, reports and moderation decisions.
- Posts viewed, so as not to show you the same thing twice in the feed.
Photos
Before upload, photos are resized and re-encoded on your device, which removes their metadata, including the GPS location.
Premium subscription
Plan, status, payment provider (Apple, Google or Stripe), subscription identifiers, dates, and, for a purchase on the website, the date on which you requested immediate access. We never receive your bank details: they are entered with Apple, Google or Stripe.
Communications with us
Contact form (name, email, company, message), requests from establishments, feedback on the app, reports of errors on a listing, cigar suggestions.
Technical data
- Connection logs (IP address, date, event type), kept as the law requires of hosting providers.
- App errors (message, screen, version, platform).
- Your device's notification token.
Data received from other sources
- Apple, Google or Facebook: your identifier and your email address, if you sign in with them.
- Apple, Google or Stripe: the status of your subscription (active, renewed, cancelled, refunded).
- Other members: a report may concern you, or mention your username.
Location
“Near me” asks for your location once, with your device's permission, to sort tobacconists by distance. Your location stays on your device and is never sent to our servers.
3. Why and on what basis
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Creating and managing your account, syncing the app and the website, keeping your cellar and your journal | performance of the contract (terms of use) |
| Showing your profile and what you share to the community | performance of the contract, according to the visibility choices you make |
| Personalizing the “For you” feed, cigar suggestions and the Premium advisor | performance of the contract; you can use the “Following” feed, which is chronological and not personalized |
| Identifying a cigar from a photo (scan) | performance of the contract, at your request |
| Managing the subscription, the free trial, cancellation and billing | performance of the contract; accounting obligations |
| Moderating published content and handling reports | legal obligation (Digital Services Act) and legitimate interest in protecting members |
| Checking that members are adults | legal obligation and legitimate interest |
| Security, abuse prevention, connection logs | legal obligation and legitimate interest |
| Fixing app errors | legitimate interest |
| Sending notifications (humidor, ageing, releases) | your consent, given in your device settings |
| Answering your messages and requests from establishments | legitimate interest or pre-contractual measures |
| Displaying the website map (Esri base map) | your consent, via the cookie banner |
Mandatory data. To create an account, the email address (or an Apple, Google or Facebook sign-in), a password, the age declaration and acceptance of the terms are required: without them, the account cannot be created. All other information (username, photo, cellar, ratings, location, notifications) is optional: without it, the corresponding features are simply not available. In the website forms, mandatory fields are marked with an asterisk.
Our legitimate interests, explained.
- Moderation and security: protecting members from illegal content, harassment and abuse, and protecting the service against attacks.
- Fixing errors: knowing what does not work in order to repair it. Only the useful technical information is kept, for 6 months.
- Answering your messages: handling the request you send us.
In each case, we limit the data to what is strictly necessary, and you can object to it (section 6).
Personalization (profiling). The “For you” feed, the suggestions and the advisor rely on your ratings, your “likes”, your cellar and your interactions to estimate what may interest you. This has no legal effect and does not influence the price or access to the service. You can use the “Following” feed, which is chronological and not personalized, and delete your ratings or your “likes” at any time.
No decision producing legal effects concerning you is made in a fully automated way. Automatic moderation may put a post on hold, but a refusal can always be challenged before a person.
4. Who receives your data
Your data is neither sold nor rented. It is accessible to the publisher and to the following providers, only for what concerns them. These providers act as processors, on our instructions. Exception: for in-app purchases and for signing in with their account, Apple, Google and Facebook act as separate controllers, under their own policies. Stripe does the same for payment fraud prevention.
| Provider | Role | Data | Location |
|---|---|---|---|
| Hostinger | hosting of the server, the database and the photos | all | Germany (EU) |
| Scaleway | sending emails | email address, language, email content | France (EU) |
| Stripe Payments Europe | payment of the subscription on the website | email, account identifier, payment | Ireland (EU); parent company in the United States |
| Apple, Google | payment of the subscription in the app, sign-in with Apple or Google, push notifications | purchase identifier, sign-in identity, notification token | EU and United States |
| Facebook (Meta) | sign-in with Facebook, if you choose it | sign-in identity | EU and United States |
| Expo | relaying push notifications to Apple and Google | notification token, notification text | United States |
| Anthropic | cigar scan, Premium advisor | scan photo (Humido does not keep it, only the result is kept); for the advisor, the contents of your cellar, your latest ratings and your taste profile, without your name or your email | United States |
| OpenAI | automatic moderation | text and photos of posts, profile photos | United States |
| Esri | website base map, after your consent | IP address, area displayed | United States |
| Photon (Komoot) | suggesting cities when you enter a place in a post | text entered | Germany (EU) |
| jsDelivr, Cloudflare (cdnjs) | loading website libraries (cookie banner, map) | IP address | worldwide network |
In the app, the map uses your phone's map service (Apple Maps or Google Maps).
Transfers outside the European Union. For providers established in the United States, transfers rely on the EU–US Data Privacy Framework when the provider participates in it, or otherwise on the European Commission's standard contractual clauses, included in our contracts with them. You can obtain a copy by writing to privacy@humido.app.
We may also disclose data to authorities, where the law requires us to.
5. How long
| Data | Duration |
|---|---|
| Account, cellar, journal, posts, photos | as long as the account exists; everything is erased as soon as it is deleted |
| Inactive account | deleted after 3 years without signing in, after a warning email |
| Guest account | deleted after 6 months without activity |
| Connection logs | 1 year |
| App errors, notifications, posts viewed | 6 months |
| Scan results, advisor usage | 13 months (the advisor is then anonymized) |
| Contact messages, requests from establishments, feedback | 3 years |
| Processed reports, rejected posts | 1 year |
| Invoices | 10 years (accounting obligation); kept by Stripe, Apple or Google |
6. Your rights
You can at any time:
- access your data and obtain a copy of it, which you can also download in JSON format from your account on the website (Settings);
- rectify it, directly in the app or on the website;
- erase it by deleting your account, from the settings of the app or the website. The Stripe or Google Play subscription is cancelled automatically. An App Store subscription is cancelled with Apple;
- object to processing based on our legitimate interest, or request its restriction;
- withdraw your consent (notifications, location, map) at any time, in your device settings or via the “Manage cookies” link;
- set directives on what happens to your data after your death.
Write to privacy@humido.app. We reply within one month. We may ask you to prove your identity if we have any doubt.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, 75007 Paris).
7. Visibility of your profile
By default, your profile and your tastings are private. You choose to make them public:
- in the settings (“Public profile”, “Share my tastings by default”);
- on each tasting (“Share my review with the community”);
- when you first publish.
A public profile makes your name, your photo, your bio, your posts and the tastings you share visible to members. You can go back at any time. Blocking a member hides everything, in both directions.
8. Minors
Humido is reserved for adults according to the law of their country (18 years old, 21 in the United States). We do not knowingly collect data from minors. If an account belongs to a minor, we delete it as soon as we become aware of it.
9. Security
Encrypted exchanges (HTTPS), encrypted passwords, access to data limited by database rules (each member only reads what belongs to them or what has been made public), hardened server, backups. In the event of a data breach presenting a risk to you, we notify the CNIL within 72 hours and, if necessary, the people concerned.
10. Cookies
See the cookie policy.
11. Changes
We may change this policy. In the event of a significant change, we will notify you in the app or by email before it takes effect.
Last updated: 26 October 2026.