Aromatop — Privacy policy
Version: 2026-10-26
Operator: OOO "Biverlid"
220033, Belarus, Minsk, Sudmalisa 26-26
support@gitch.xyz
info@gitch.xyz
Scope
Aromatop is a personal fragrance catalogue and trial journal operated by OOO "Biverlid". The core works without an account. This policy describes local features and identifies optional online functions separately. Opening a catalogue card does not submit your journal.
Local data
Language, preferences, saved fragrances, candidates, your own fragrances, observations, ratings and archives stay in app or browser storage. A previous local snapshot helps recovery. We use these data to provide your requested features; they are not public reviews. Do not put sensitive information in free-text fields.
Optional services
Email sign-in and the cloud backups you choose to save use Supabase, with the primary database in Ireland. They receive the account and backup data needed for those features; your whole journal is not uploaded automatically. The Aromatop website and recognition service run on Melbicom in Frankfurt, Germany. Store payments and RevenueCat subscriptions are not enabled yet.
Photos and notifications
Recognition processes the photo you choose to submit on our server and through Google's paid Gemini API. Your private journal is not sent to the model. A photo can help identify a bottle, not tell us how it smells. Camera permission alone does not upload anything. Card-ready push notifications use OneSignal only after your permission; local reminders use your device's operating system.
Technical data and sharing
Network services necessarily receive connection information such as IP address and request details. We do not sell or publish your diary. Service providers may process data outside your country only where the enabled feature and lawful safeguards permit. No location or microphone access is needed for the core. Third-party sites have their own policies.
Storage periods
Local records remain until you delete them. Cloud backups and recognition requests remain until you delete the backup, request or account. Submitted photos are removed in the background after completion, cancellation or request deletion; unprocessed photos expire after seven days. Server connection logs and local server backups are kept for up to seven days. Google may retain processing data for safety under its paid API terms; Search grounding data is retained by Google for 30 days. Paid API inputs are not used to train Google's models. Provider infrastructure copies may take longer to disappear; we do not promise instant deletion from every copy.
Deletion and backup
Settings provides local erasure and backup export/import. Account deletion, if available, first clears recognition records and files, then the account and linked cloud backup. A cleanup failure is reported rather than treated as success. A hashed deletion barrier expires after 24 hours. Account deletion does not erase your local journal or cancel a store subscription; manage these separately.
Your rights and requests
Write to info@gitch.xyz to request access, correction, a copy, deletion, withdrawal of consent or information about recipients, subject to applicable law. We may ask only for proportionate information to establish the relevant account; do not send passwords or payment details. Formal requests may require statutory details. We respond within applicable legal deadlines. You may complain to a competent data protection authority, including Belarus’s National Personal Data Protection Centre where applicable.
Security and control
We use access controls and encrypted transport for configured services; native account tokens use system secure storage. The journal has no separate application-level encryption. Browser storage can be cleared by the browser. Keep a personal export, protect your device and check the contents before sharing. This service is not specifically designed for children; a legal representative should contact us about a child’s data.
Contact and changes
Operator: OOO "Biverlid", 220033, Belarus, Minsk, Sudmalisa 26-26. Support: support@gitch.xyz. Privacy requests: info@gitch.xyz. Necessary support correspondence is retained only for handling the request and applicable legal obligations. Material changes, new recipients or new purposes will be explained before the changed optional processing starts; a device permission is not blanket consent.
Notifications
If you opt in, Aromatop uses your current step, activity times and access status to choose messages. Fragrance names, ratings and journal text are not sent for these reminders. 10 am–8 pm in your time zone. At most one message every 48 hours and three a week; offers at most once every two weeks. Your own wear reminders and card-ready alerts are separate. OneSignal receives the subscription identifier and notification content. The profile expires after 90 days without activity; message and activity history are kept for up to 90 days. Turning off both categories deletes these data. Opening a message may be recorded to assess whether the reminders are useful. Purchase signals here come from the app and are not billing records.
Website analytics and ads
On the public website, Google Analytics runs only with your consent. It measures page views, searches, fragrance views, comparisons and app links. We do not send search text, email, journal entries or sign-in links. Google AdSense provides contextual ads without interest-based personalization, only with your consent and when Plus is not active. Google may request regional consent separately. When subscription status is unknown, ads stay off. Change or withdraw your choices in Privacy settings at the bottom of the site. Refusal does not restrict the catalogue. Your choice and Analytics cookies last up to 180 days; GA4 event and user data are retained for 14 months without automatic renewal, while aggregated reports may be kept longer. Google receives technical connection data. Its processing is described at https://policies.google.com/technologies/partner-sites .