Privacy Policy

1. Scope and controller

This policy applies to the CigarMind mobile app, CigarMind account and sync services, and the official website at cigarmind.souldigger.cn. CigarMind is operated by Shanghai Souldigger Information Service Co., Ltd., which is responsible for the processing, support, and legal notices described here.

CigarMind is intended only for adults who have reached the legal age for tobacco use where they live. The product does not sell tobacco or encourage anyone to begin or increase tobacco use.

2. Data we process

3. On-device storage

CigarMind stores seven categories of user facts in on-device SQLite: cigars, inventory lots, inventory events, tasting entries, humidors, humidor readings, and recognition history. After you confirm a recognition result, the app may keep a JPEG copy that was re-encoded and stripped of EXIF/GPS in its private application-support directory and store that device-file reference in SQLite; SQLite itself does not store photo binaries.

Language, currency, temperature unit, target ranges, notification preferences, and consent choices use SharedPreferences. The random installation identifier and signed-in session use system secure storage—Keychain on iOS.

You can export versioned JSON plus collection and tasting CSV files. Exports never contain image binaries; recognition media paths are redacted by default and included only if you explicitly choose that option. “Remove from this device” transactionally deletes the seven SQLite fact categories and app-managed recognition photos, but preserves preferences and the cloud account. To remove the secure session, sign out or delete the account before uninstalling the app.

4. Optional location and Open-Meteo weather

Location weather is off by default. After consent, CigarMind requests system location access only when you open the relevant feature or refresh it. The location is used only for the current operation: the app immediately rounds latitude and longitude to two decimal places (about a 1 km scale) before requesting current conditions from Open-Meteo. A city or region label is produced through device geocoding.

CigarMind does not write either raw or rounded location to the collection database or use it for advertising or cross-app tracking. The operating system, device geocoding service, and Open-Meteo may process permissions, network address, request coordinates, and service logs under their own policies. You can turn location access off in CigarMind or iOS settings.

5. AI image recognition and advisor

Image recognition

After adult confirmation and AI-image consent, you can capture or select a photo. The app re-encodes the image as JPEG, limits its dimensions, removes EXIF/GPS, and sends it through api.cigarmind.souldigger.cn to the CigarMind service, which uses the HY‑Vision model through Tencent Cloud TokenHub. The service returns up to three candidates; only a candidate you confirm is saved to your collection and linked to the sanitized on-device copy.

The CigarMind API is designed not to write photos to disk, cache, or request logs. Base64 image data is decoded and validated only for the current request before being sent to the vision service. Service logs may include request ID, route, status, duration, model, usage, and error code, but not the original image, Base64 payload, authorization token, or request body. The third-party model service may still process requests under its applicable terms.

In-inventory advisor

When you actively request advice, CigarMind may send the inventory summary you provide, weather, coarse location, local time, and preferences to the CigarMind API, then use a DeepSeek text model through Tencent Cloud TokenHub to rank choices. The design prohibits precise GPS, private notes, and unnecessary identity fields and limits selection to inventory you provide.

AI output can be wrong. A “confidence” label or advisor score is not an authenticity probability, health conclusion, or valuation. Verify brand, line, box code, vintage, and provenance yourself.

6. Apple sign-in, Keychain, and MySQL sync

Local core features do not require an account. If you choose Sign in with Apple, the app sends an Apple identity token, one-time authorization code, login nonce, and optional Apple-user consistency identifier to the CigarMind API. We never receive your Apple password.

After verifying Apple’s signature, the server stores a non-reversible server-HMAC representation of the Apple account subject and, if Apple provides it, the verified email or private-relay indicator. The server stores only a SHA‑256 hash of each session token and encrypts the refresh credential needed to revoke Apple authorization during account deletion. The raw session token remains in device Keychain.

If you choose cloud sync, structured collection, tasting-journal, and humidor records are stored in a CigarMind-operated MySQL database. Versions, changes, deletion tombstones, and short-lived idempotency records support multi-device conflict handling. Sync is designed not to upload recognition photo binaries.

When you buy or restore Premium, the app supplies the signed-in account's random UUID to Apple as appAccountToken to prevent a transaction from being attached to the wrong account. The server verifies Apple's signature, queries the App Store Server API for current status, and stores product, transaction and original-transaction identifiers, purchase/expiry/grace/revocation dates, auto-renewal state, environment, entitlement state, and verification time. Apple's Server Notifications V2 also supplies a notification UUID, type, signed date, and transaction references; the server stores only a SHA‑256 hash of the signed payload, not the full notification payload.

7. Purposes and choices

• Provide collection, inventory, tasting-journal, humidor, and personal-statistics features;
• Retrieve weather, produce AI candidates, or rank in-inventory guidance when you request it;
• Authenticate accounts, secure sessions, sync selected data, and honor deletion requests;
• Verify purchases, grant or revoke Premium, prevent a subscription from being reused across accounts, and process renewal, refund, and billing-grace events;
• Prevent abuse, diagnose faults, and maintain service security and availability;
• Respond to support email you send and comply with applicable legal obligations.

Location, AI images, and cloud sync are not required to maintain a local collection. You may decline consent, revoke system permission, sign out, or stop using a feature. We do not sell personal data, use collection, photo, location, or tasting data for third-party targeted advertising, or place analytics trackers or advertising cookies on this website.

8. Service providers

• Apple for identity, system permissions, Keychain, app distribution, in-app purchases, subscription status, and refunds;
• Open-Meteo for current weather when you enable it;
• Tencent Cloud TokenHub / HY‑Vision for cigar-image candidate processing you request;
• Tencent Cloud TokenHub / DeepSeek for in-inventory ranking you request;
• CigarMind hosting and MySQL infrastructure for accounts, session hashes, sync, and API security logs.

These providers may act as independent services or processors and may process data outside your region under their own terms, privacy policies, and applicable law.

9. Retention, export, and deletion

• On-device facts and recognition photos: kept until you remove them in the app, delete the corresponding collection item, or uninstall. “Remove from this device” also deletes recognition photos in the app-private directory. Keychain items may survive uninstall under system behavior, so sign out or delete the account first.
• Preferences: kept until changed, app data is cleared, or the app is uninstalled. “Clear local data” does not reset these settings.
• AI request content: the CigarMind API does not intentionally persist photos or advisor request bodies; minimized operational metadata is retained only as reasonably necessary for security, troubleshooting, and service operations.
• Account and sync: kept until account deletion or for as long as needed to provide the sync service you request. Expired or signed-out sessions become invalid.
• Subscription records: transaction bindings, transaction state, and entitlement are kept as needed to deliver purchased benefits, handle refunds or disputes, prevent credential rebinding, and meet applicable tax, legal, or platform duties. Account deletion removes the active user link to transactions and entitlement. Minimal Apple-notification anti-replay metadata—notification UUID, event type, date, transaction reference, and payload hash—may remain for the necessary period without the full signed payload.
• Support correspondence: kept until the matter is resolved and reasonable dispute, security, and compliance periods expire; you may request deletion.

Before a cloud-account deletion succeeds, the service requests revocation of CigarMind’s Apple sign-in authorization. If revocation is temporarily unavailable, deletion is not represented as complete and you can retry. On success, the active MySQL user, sessions, encrypted Apple credential, current sync values, change log, tombstones, idempotency records, and user-bound subscription transactions and entitlement are cascade-deleted; the Apple subscription is not automatically cancelled. Restricted disaster-recovery backups, if any, expire through their secure rotation and are not reused to provide a deleted account.

See the Account Deletion Guide for exact steps.

10. Security and international processing

We use HTTPS, least privilege, request-size limits, rate limits, session hashing, Apple-subject HMAC, encrypted refresh credentials, and database foreign-key isolation. No system is absolutely secure. Never email a session token, Apple authorization code, or unnecessary private photo to support.

Apple, Open-Meteo, Tencent Cloud, or model services may process requests across regions. We apply reasonable minimization, contractual, and security measures as required by applicable law. If you disagree with an optional service’s data flow, do not enable it; local features remain available.

11. Your rights and adult restriction

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing and to withdraw consent. You can directly export or clear on-device facts, manage system permissions, sign out, and delete the cloud account in the app, or contact support. We may take reasonable steps to verify the requester’s identity.

CigarMind is only for adults who have reached the legal age for tobacco use where they live. We do not knowingly collect accounts or tobacco-preference data from minors. Contact us if you believe such data exists.

12. Website, policy updates, and contact

This website has no accounts, advertising or analytics trackers, or marketing cookies. Standard server access logs may record IP address, time, path, status, and browser technical information for security and reliability.

If this policy changes materially, we will update the effective date and provide an app or website notice when appropriate. Review the current version before continuing to use optional network features.