Contents6 sections
Privacy
You can use this entire site without telling us who you are. We hold personal details in three cases: you type them into one of our forms, you create an account, or you use that account (the wardrobe and taste features described below). We do not sell data, and we run no advertising trackers.
Who we are
Who is holding this, and how to reach a person about it.
Osmagora is a fragrance discovery library, operated from Saudi Arabia by Saed Alali. He is the person responsible for the data described here, which is what UK and EU law calls the controller. To have anything on this page acted on, use the form at the bottom of this page, because it reaches a person, and unlike an email address it cannot quietly stop working. If you would rather write: hello@osmagora.com.
What you give us
The three moments you can hand us a detail, and what each one is used for.
Tell me when it opens
An email address or a phone number, and optionally your country. Used once, to tell you the site has opened. It is not a newsletter and nothing else is ever sent to it.
For business
Your name, company, role, website, email, country and phone number. Used to reply to your enquiry and to have a business conversation. Nothing else.
Your account
If you create an account: your email address, your sign-in method, and what you choose to record: the fragrances you save, own, rate or wear, your preferences, any private notes you write on your own bottles, and two consent switches that stay off unless you turn them on. All of it is yours to take or destroy: Download my data and Delete my account, in My information on your profile, do exactly what they say, and a deletion leaves only a dated record that counts what was removed, never the data itself.
About you
My information on your profile also asks, all optional and all blank until you fill them in: your name, your gender, your date of birth, your country and your mobile number. These tell us who the library is for, so we know the audience we have. They are not sold, they are not shared, and they change nothing about what the site recommends to you: your picks are driven by the taste questions and by your own shelf. Leave every one of them empty and the site works exactly the same.
What we count by ourselves
What the site records without being asked, and the line it does not cross.
What you search for
The words you type into the search box, once they are three characters or more, with how many results they found. It is how we learn what the library is missing: a search that comes back empty is either a fragrance we do not have or one we hold under a name nobody uses. It is stored against the same rotating daily code as everything else on this page, never against you or your account, and it is never shown to anyone outside Osmagora. Anything that looks like a personal detail is thrown away before it is written: an address with an @ in it, a long run of digits, a pasted link.
Abuse protection
The browser’s user-agent string is stored beside each form submission, used only to recognise automated abuse of the forms, never to build a profile of you.
What we count
When you open a fragrance, a note or a house, we record that it was opened, not who opened it. Those counts produce the weekly Trending list, so the ranking reflects what visitors genuinely look at rather than who paid us. No payment influences it.
Page visits
We keep our own simple count of which pages are viewed, using a first-party tool we run ourselves. No third-party analytics service is involved. For each visit we record the page’s address (not anything you typed into it), the website you arrived from if any, a rough device type (phone, tablet or desktop) and your country, worked out at the moment of the request and never stored as an IP address. There is no cookie and nothing that identifies you. It tells us the site is working and what people read, nothing about who you are.
The daily token
So one person’s repeated clicks cannot distort that count, your browser holds a random token that changes every day. It is not a tracking cookie, is not tied to your identity, cannot follow you to another site, and disappears when you close the tab.
Coming back
A second value, osm_visit, is kept in your browser’s own storage rather than in a cookie. The daily token above is born with the date inside it, which left one plain question, did anyone come back, impossible to answer. This one is a random value stamped with the day it was made. It carries no IP address, no account and nothing about your device, it is replaced 30 days after it is made, and unlike the daily token it survives closing the tab, which is the whole point of it. Clearing your browser’s site data removes it.
Research
We study these counts in aggregate, which notes, families and seasons people are drawn to, to improve the library and understand the category. That work is done on totals and patterns only. No individual is identified, and no name, email, phone number or address is ever part of it.
Cookies
One, and it is not about you. Every page sets osm_ix, which holds an expiry date and a signature: no name, no account, no identifier of any kind. Its only job is to prove a request came from someone who actually loaded a page, so the catalogue cannot be downloaded wholesale by a scraper. It lasts seven days, cannot be read by JavaScript, and is not shared with anyone. Signing in adds a session cookie, as signing in must. There are no advertising or analytics cookies of any kind.
No tracking
We use no advertising cookies, no third-party analytics services, no pixels and no fingerprinting, and we share no behaviour with ad networks. The only counting we do is the first-party, cookieless kind described just above, run on our own servers, never handed to anyone else.
Bot challenge
The public forms are protected by Cloudflare Turnstile, a challenge that distinguishes people from scripts. When you submit a form, Cloudflare, Inc. processes technical characteristics of your browser to make that call, under its own privacy policy. It does not track you across sites for us, and we receive only pass or fail.
The legal side
Why we are allowed to hold any of it, who touches it, and for how long.
Why we are allowed to
If you are in the UK or EU, the law asks us to name a basis for each thing. Ours are: your consent, for the announcement list. Give an address and we write once; withdraw at any time and we delete it. Taking steps at your request, for a business enquiry and for anything you ask through the form below. Performing our agreement with you, for running an account and the features you switch on. Our legitimate interest, for counting page visits and protecting the site from abuse: a narrow interest, served with data that identifies nobody.
Who processes it
Our hosting, database and email delivery suppliers process data on our behalf, only to do the job we engaged them for, under contractual terms requiring equivalent protection. We do not sell personal data and we pass it to no one else. Those suppliers operate internationally, so your data may be handled outside your own country; where it leaves the UK or EU it does so under the safeguards in our contracts with them.
How long
The announcement list until the announcement has been sent, and then no longer. Business enquiries for as long as the conversation is live, and up to two years after for our records. Trending interaction counts are aggregated weekly and the underlying rows are not kept beyond that. Page-visit rows, which hold no IP and nothing that identifies you, are deleted after 90 days; only aggregate totals inform our work.
What you can do about it
Your rights over everything above, and how to use them.
Your rights
Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. If you ask, we delete it. You may also object to us holding it at all. Use the form below. We will not ask you to justify the request, and we will reply within 30 days.
Complaints
In the UK or EU you may complain to your national data protection authority. In Saudi Arabia, that is the Saudi Data & AI Authority (SDAIA).
Children
Intended for adults. We do not knowingly collect details from anyone under 16. If that has happened, tell us and we will remove it.
Changes
If we change what we collect, we change this page and move the date at the top. We will not quietly start doing something this page says we do not do.
Ask us something about your data
Anything on this page can be acted on. This reaches a person, not a mailbox.
Access, correction, deletion, or just a question. This is the route the notice above refers to.