version	text
0.12.9	Security fixes for payments: subscription terms only change after a confirmed payment, plan changes cancel the old subscription, refunds stay final, and Stripe amounts are checked
0.12.8	Photo identify can use the self-hosted recognizer service (image + OCR) where enabled, with the built-in matcher as fallback; disabled by default
0.12.7	Inline i18n QA fixes: legacy texts archived before the 0.11.39 move, CSV formula guard aligned with export, API text import needs a single-use preview token, staged imports cleaned up hourly
0.12.6	Privacy page: confirmed identify photos are used as training material for Purofolio's own image recognition models; stored privately, not shared with third parties, subject to retention, deletable on request
0.12.5	Identify photos of unconfirmed attempts are now deleted after 90 days by default (keep forever only when an admin sets 0); member-confirmed identify photos no longer count toward the 5-photo limit and never block admin uploads
0.12.4	Deploy 5.1.0: VPS runner mode (systemd job, release tags X.Y.Z only on PROD, snapshots), destructive DB steps locked on productive environments (typed OVERWRITE <ENV>), DB credentials from server.env, identify-rehash after every deploy
0.12.3	Scan button: on phones it opens the camera directly (plus "Choose from gallery"), on desktops with a webcam a live camera dialog; photos are resized to 1600 px JPEG without metadata in the browser before upload
0.12.2	Photo identify follow-ups: old public identify-pending photos move to private storage, iPhone HEIC photos are converted in the browser, generic stock photos stay out of the matching index, new privacy page in all 6 languages
0.12.1	Photo identify Phase 0: every catalog photo counts with all its fingerprints (same type compared only), OCR/HEIC skip cleanly without proc_open, "Is it this cigar?" with yes / pick another / none, confirmed photos become private reference photos
0.12.0	Release iteration: docs consolidated, schema baseline and one reference seeder, dead code out, CSP-safe confirmations, HTTP hardening, self-hosted fonts, lighter images, Markdown editor with toolbar, upload icons, SEO (titles, meta, JSON-LD, sitemap)
0.11.40	UI texts and content as CSV: export all or one language, import with a dry run (new, changed, conflicts, errors) and confirm; keys and placeholders validated, formula-injection guard, same rights; old language pack removed from import packages
0.11.39	Inline text & language management: every UI text and the managed descriptions of shops, brands, manufacturers and cigars are editable in place (edit dock, edit mode, copy to languages, undo, rollback); edits are audit-logged and publish immediately

Privacy policy

This page explains which personal data Purofolio processes, why, and how long it is kept. It describes what the app actually does with the current settings.

Who is responsible

Creabyte is responsible for this website. (Bern, Switzerland)

Address and legal details are in the legal notice. Legal notice

For questions about your data, corrections or deletion, write to us via the support form. Support form

Your account

When you register we store your username, your email address (encrypted, plus a keyed hash so you can sign in with it) and your password (only as a one-way hash). Your profile settings (language, units, visibility, notifications) are stored with your account.

Optional, only if you enter them: first and last name, date of birth and country of residence (used to check the legal age for tobacco content), shipping address and phone number, and a profile picture.

For security we store the time and IP address of your last sign-in and the IP address with each rating and humidor change. Security-relevant actions (for example sign-ins, password changes and administrative changes) are recorded in an audit journal with your user ID, username and IP address; email addresses are kept there only as a hash.

While you are signed in, your session (including IP address and browser identifier) is stored on our server.

Your content

Your humidor, wishlist, ratings, tasting notes and friends are stored with your account. Who sees your ratings, cellar and wishlist follows the visibility you choose in your profile and on each rating.

Search terms you enter while signed in are logged with your user ID for catalog statistics.

Photos and photo identify

Photo identify is only available when you are signed in. Each photo you send is stored privately on our server and linked to your user ID. It is not published.

Matching runs on our own server (image fingerprints and, if installed, text recognition). Photos are not sent to external recognition services.

If you confirm which cigar is shown, the photo is kept as an internal reference image for that cigar. It helps recognise the cigar in later identify requests and is visible only to catalog administrators.

Confirmed photos (yes or "pick another") are also used as training material to build and improve Purofolio's own image recognition models; a recognition service for this is being developed. They are stored privately on our server and are not shared with third parties. They are kept as described under "How long data is kept". You can ask us to delete your identify photos at any time; deleted photos are no longer used for future training. Support form

A photo you send to the catalog desk with a new cigar is stored with that submission and may be used as a public catalog photo.

Rating photos are shown according to the visibility of the rating. You can remove them yourself at any time.

Uploaded photos are re-encoded on our server. Embedded metadata such as camera details or GPS location is not kept.

How long data is kept

Identify photos that were never confirmed with a cigar are deleted after 90 days. Confirmed photos are kept until your account is deleted.
Audit journal entries: 366 days.
Hidden or replaced ratings: deleted 30 days after they were hidden.
Search log: only the most recent 999 searches across all members are kept.
Sign-in sessions end after 120 minutes of inactivity.
When you delete your account in your profile, it is deactivated immediately. An administrator then deletes it permanently, including your photos, identify attempts and confirmed reference photos. A minimal record of the deletion (email address and dates) is kept as proof.

Cookies

Necessary cookies: the session cookie (purofolio-session) and a security token (XSRF-TOKEN) keep you signed in and protect forms. If you tick "Remember me" when signing in, a remember cookie keeps you signed in longer.

Your cookie choice is stored for 180 days in the purofolio_consent cookie.

Your age confirmation is stored for one year in the purofolio_age cookie.

No analytics or marketing tools are active.

You can change your choice at any time: Cookies

Emails

We send emails for your account (address confirmation, password reset), friend invitations you trigger, and the notifications you have switched on. They are sent by the mail system of our own server; no newsletter service is involved.

Shops and payments

When you order from a shop, that shop receives your order and your email address so it can process it.

Messages you send through a shop's contact form are emailed to that shop together with your username.

External services

Maps load map tiles from OpenStreetMap servers, which see your IP address. Shop addresses are converted to map positions on our server via OpenStreetMap Nominatim.

Some forms (for example registration or the support form) use Cloudflare Turnstile to block automated abuse. It runs in your browser and contacts Cloudflare.

Fonts, scripts and the photo converter are served from this website itself.

Your choices

In your profile you can correct your data, change visibility and notifications, remove rating photos and delete your account. For anything else, such as a copy of your data or deleting identify photos, contact us via the support form. Support form

Release history