Privacy Policy

Account information

When you create an account, Scentena stores an account record containing your email address, an optional display name, your plan (free or pro), the sign-in method you used, your remaining AI credits, and creation and update timestamps.

• If you register with an email address and password, the password is never stored in readable form. Only a bcrypt hash of it is saved, and that hash is what a later login is checked against.
• If you sign in with Google or GitHub, no password exists for the account. Scentena stores the provider name, the account identifier that provider returned, and the profile name and avatar URL it supplied. Only a verified email address is accepted from a social provider.

Social sign-in is only available when the operator of the site has configured that provider, so one or both options may be absent on the login page.

How signing in works

Scentena does not keep server-side login sessions. When you log in successfully, the server issues a signed JSON Web Token (JWT) that contains your account identifier, email address, and plan, and that expires after a fixed period. Your browser sends that token in an Authorization header on requests that need your identity, such as loading your saved formulas or using an AI feature.

The token and a cached copy of your basic account details are held in your browser’s local storage, not in a login cookie. Logging out deletes both of them from your browser immediately. Anyone with access to your browser profile could read those values, so use a trusted device and log out on shared computers.

During a Google or GitHub sign-in, the server sets one short-lived, HTTP-only cookie named oauth_state. It exists only to confirm that the redirect coming back from the provider matches the request that started it, and it is cleared as soon as that check runs.

Formulas you save

A formula is only stored on the server when you choose to save it to your library. The saved record contains the name you gave it, the generation options behind it, the full calculated result, your account identifier, and timestamps. Saved formulas are private to your account: every read, update, delete, and export query is restricted to the account that owns the row, and the library page is marked so search engines do not index it.

Formulas you generate but never save are not written to the database. CSV and PDF files you export are produced for your download and are not retained by Scentena as a separate copy.

AI briefs and generated formulas

The AI features in the AI Lab are optional, require an account, and consume AI credits. When you use them, the text of your prompt is sent to Anthropic’s Claude API together with Scentena’s own instructions and material catalogue, and the model returns a structured brief or a material selection that Scentena then converts into a formula.

Your prompt text is not written into Scentena’s formula database; what is recorded is the change to your AI credit balance. The generated result is only stored if you save it as a formula. Anthropic processes the request under its own terms and privacy practices, which Scentena does not control, so do not put confidential or personal information into an AI prompt.

AI generation is a feature the site operator can switch off. When it is disabled, no prompt leaves the server because the endpoints refuse the request outright.

Payments and subscriptions

Paid plans are handled by Stripe. Scentena does not receive, process, or store your card number, expiry date, or security code. Checkout and subscription management happen on Stripe’s own hosted pages.

What Scentena stores is a Stripe customer identifier against your account and your current plan. Your email address and account identifier are sent to Stripe so it can create and match the customer record. When you open billing settings, the server reads your subscription status from Stripe and may display the card brand and last four digits Stripe returns; those details are shown from Stripe’s response and are not saved in Scentena’s database. Billing is only active when the site operator has configured Stripe.

Security and abuse-prevention records

To protect accounts against password guessing, the server records login attempts: the email address used, the originating IP address, whether the attempt succeeded, and the time. Repeated failures from the same email address temporarily lock further attempts. Successful logins clear the earlier failures for that address. Request-rate limits also apply to authentication, formula generation, and AI endpoints.

The API writes standard server logs for requests, which include technical details such as IP address, request path, user agent, response status, and timing. These are used for security, debugging, and keeping the service running, not for building profiles of individuals. Traffic is served over HTTPS.

Analytics

Scentena uses Vercel Analytics to measure aggregate page views and traffic patterns across the site. It is used to understand which pages are useful and where the product needs work. Scentena does not use it to identify you personally and does not connect it to your saved formulas.

Cookies and browser storage

Scentena does not use a tracking cookie of its own. Most of what the site keeps in your browser is local storage, which stays on your device and is only read by the application itself. The values written are:

• perfume_auth_token — your signed session token, written when you log in and removed when you log out.
• perfume_auth_user — a cached copy of your basic account details (identifier, email, name, plan, provider, avatar URL, AI credits) so the interface can render immediately on load. Removed when you log out.
• scentena_advertising_consent_v1 — a legacy advertising choice from Scentena’s retired local consent control. A stored rejection remains an additional block until you continue to Google’s privacy choices.
• theme — your light or dark appearance preference.

The only cookie Scentena’s own server sets is the temporary oauth_state cookie described above. If you allow advertising, Google may then set its own cookies as described in the next section. Clearing site data in your browser removes all of these; if you clear the session values you will simply be logged out. Google’s certified consent platform separately manages advertising choices where it applies.

Google AdSense and advertising cookies

Scentena can show advertising from Google AdSense. Advertising fails closed unless the site operator has configured a valid publisher ID and explicitly enabled Google’s certified consent management platform after publishing its European regulations message. Google’s platform collects, stores, and honours the visitor’s advertising choices where applicable. If either configuration is absent, the AdSense script and ad units are not loaded.

Google’s advertising library is loaded from pagead2.googlesyndication.comonly on individual, manually curated articles in the Learn library. It is not loaded on the home page, Learn index, account, private formula library, pricing, builder, AI Lab, authentication, or policy pages; it is also disabled in Scentena’s packaged mobile applications and for accounts on the Pro plan. Leaving an ad-supported article starts a clean document so the advertising library does not persist onto an ineligible page.

Once loaded, Google receives the request directly from your browser. Google and its partners may use cookies or similar technologies to serve and measure ads, and may use information such as your IP address, the page you are viewing, and their own advertising identifiers. That processing is governed by Google’s policies, not by Scentena, and Scentena does not receive your Google advertising profile or share your account details, saved formulas, or AI prompts with Google for advertising.

Third party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to Scentena and/or other sites on the internet.

You can change your mind at any time using the privacy control shown by Google’s consent platform. Clearing cookies and site data in your browser removes data stored there, and your advertising choice never restricts any part of Scentena. You can also control advertising directly with Google and its partners:

• How Google uses information from sites or apps that use our services — what Google collects through partner sites like this one.
• Google Ads Settings — opt out of personalised advertising from Google.
• aboutads.info choices — opt out of third-party vendor cookies used for personalised advertising.

Service providers

Scentena does not sell your personal information. Data is shared only with the providers needed to run the service:

• Hosting and infrastructure. The web application and the API are hosted by infrastructure providers that necessarily process requests to the site, and account and formula records are held in a managed database.
• Vercel Analytics. Aggregate traffic measurement.
• Stripe. Payment processing and subscription management, for users on a paid plan.
• Anthropic. Processing of AI prompts, only when you use an AI feature.
• Google. AdSense consent and advertising only under the conditions and on the pages described above. Google is also involved if you choose Google sign-in, as GitHub is if you choose GitHub sign-in.

Scentena may also disclose information where it is legally required to, or where it is necessary to investigate abuse or protect the service and its users.

Messages you send us

The form on the contact page does not transmit anything to a Scentena server or a third-party form service. It assembles the message locally and opens it in your own email application, so nothing is sent until you press send there. Once you email us, we hold that message and your email address for as long as needed to deal with your request. Please do not include passwords, session tokens, or full card numbers in it.

How long data is kept

Account records and saved formulas are kept for as long as your account exists. Deleting your account removes the account record, and the saved formulas attached to it are removed with it.

Login-attempt records and server logs are short-lived operational data kept only while they are useful for security and troubleshooting. Stripe keeps its own transaction and invoice records under its own retention rules, which Scentena cannot shorten, and backups or logs held by infrastructure providers may persist briefly after deletion before being cycled out.

Your choices

• Use Scentena without an account. The generator, builder, and Learn library do not require one.
• Delete a single formula. Removing a formula from your library deletes that record.
• Delete your account. Account settings include account deletion. It asks you to confirm, and to re-enter your password if the account uses a password. Deleting cancels any active Stripe subscription, removes your account record, and removes the saved formulas belonging to it. This cannot be undone.
• Log out. This clears the stored session token and cached account details from your browser.
• Change your advertising choice. Reopen it at any time from the privacy control shown by Google’s consent platform. A visitor with a stored rejection from Scentena’s retired local control can also use the footer control to release or keep that additional block.
• Use browser controls. You can clear site data, block cookies, or block third-party scripts. Blocking advertising or analytics scripts does not break the formulation tools.

To ask about the information held about you, or to request a correction or deletion you cannot make yourself, email contact@scentena.com from the address linked to your account so the request can be matched to it.

Children

Scentena is not directed to children. Accounts should not be created by anyone under 13, or under the minimum age at which they can agree to an online service where they live. If you believe a child has created an account, contact us and it will be removed. Perfume materials are not safe for unsupervised use by children in any case, as explained in the Terms of Service.

Changes to this policy

This policy will change as the product changes — for example if a feature, provider, or integration is added or removed. The revised version is published on this page with a new “last updated” date, and continuing to use Scentena after that means the updated policy applies to you.

Contact

Questions about this policy, or about the data held for your account, can be sent to contact@scentena.com or through the contact page. Related reading: the Terms of Service, the FAQ, and about Scentena.