Privacy

Osmagora is a fragrance discovery library, operated from Saudi Arabia. To have anything on this page acted on, use the form at the bottom of this page — it reaches a person, and unlike an email address it cannot quietly stop working. If you would rather write: hello@osmagora.com.

An email address or a phone number, and optionally your country. Used once — to tell you the site has opened. It is not a newsletter and nothing else is ever sent to it.

Your name, company, role, website, email, country and phone number. Used to reply to your enquiry and to have a business conversation. Nothing else.

If you create an account: your email address, your sign-in method, and what you choose to record — the fragrances you save, own, rate or wear, your preferences, any private notes you write on your own bottles, and two consent switches that stay off unless you turn them on. All of it is yours to take or destroy: Download my data and Delete my account on the account page do exactly what they say, and a deletion leaves only a dated record that counts what was removed — never the data itself.

The browser’s user-agent string is stored beside each form submission, used only to recognise automated abuse of the forms — never to build a profile of you.

The public forms are protected by Cloudflare Turnstile, a challenge that distinguishes people from scripts. When you submit a form, Cloudflare, Inc. processes technical characteristics of your browser to make that call, under its own privacy policy. It does not track you across sites for us, and we receive only pass or fail.

When you open a fragrance, a note or a house, we record that it was opened — not who opened it. Those counts produce the weekly Trending list, so the ranking reflects what visitors genuinely look at rather than who paid us. No payment influences it.

We keep our own simple count of which pages are viewed, using a first-party tool we run ourselves — no third-party analytics service is involved. For each visit we record the page’s address (not anything you typed into it), the website you arrived from if any, a rough device type (phone, tablet or desktop) and your country, worked out at the moment of the request and never stored as an IP address. There is no cookie and nothing that identifies you. It tells us the site is working and what people read — nothing about who you are.

So one person’s repeated clicks cannot distort that count, your browser holds a random token that changes every day. It is not a tracking cookie, is not tied to your identity, cannot follow you to another site, and disappears when you close the tab.

We study these counts in aggregate — which notes, families and seasons people are drawn to — to improve the library and understand the category. That work is done on totals and patterns only. No individual is identified, and no name, email, phone number or address is ever part of it.

One, and it is not about you. Every page sets osm_ix, which holds an expiry date and a signature: no name, no account, no identifier of any kind. Its only job is to prove a request came from someone who actually loaded a page, so the catalogue cannot be downloaded wholesale by a scraper. It lasts seven days, cannot be read by JavaScript, and is not shared with anyone. Signing in adds a session cookie, as signing in must. There are no advertising or analytics cookies of any kind.

We use no advertising cookies, no third-party analytics services, no pixels and no fingerprinting, and we share no behaviour with ad networks. The only counting we do is the first-party, cookieless kind described just above — run on our own servers, never handed to anyone else.

If you are in the UK or EU, the law asks us to name a basis for each thing. Ours are: your consent, for the announcement list. Give an address and we write once; withdraw at any time and we delete it. Taking steps at your request, for a business enquiry and for anything you ask through the form below. Performing our agreement with you, for running an account and the features you switch on. Our legitimate interest, for counting page visits and protecting the site from abuse: a narrow interest, served with data that identifies nobody.

Our hosting, database and email delivery suppliers process data on our behalf, only to do the job we engaged them for, under contractual terms requiring equivalent protection. We do not sell personal data and we pass it to no one else. Those suppliers operate internationally, so your data may be handled outside your own country; where it leaves the UK or EU it does so under the safeguards in our contracts with them.

The announcement list until the announcement has been sent, and then no longer. Business enquiries for as long as the conversation is live, and up to two years after for our records. Trending interaction counts are aggregated weekly and the underlying rows are not kept beyond that. Page-visit rows — which hold no IP and nothing that identifies you — are deleted after 90 days; only aggregate totals inform our work.

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it — and if you ask, we delete it. You may also object to us holding it at all. Use the form below. We will not ask you to justify the request, and we will reply within 30 days.

In the UK or EU you may complain to your national data protection authority. In Saudi Arabia, that is the Saudi Data & AI Authority (SDAIA).

Intended for adults. We do not knowingly collect details from anyone under 16. If that has happened, tell us and we will remove it.

If we change what we collect, we change this page and move the date at the top. We will not quietly start doing something this page says we do not do.