Legal
Privacy Policy
This policy explains what CigarFlux (“we,” “us,” or “our”) collects, why we collect it, how it is shared and retained, and the choices available to you when you use cigarflux.com.
- We do not sell personal information. Following an affiliate link may let our affiliate network set a cookie on the retailer’s site; you can opt out at any time.
- We do not sell tobacco. CigarFlux compares prices published by third-party retailers.
- We store a ZIP code to define a search area. We never request or receive precise location.
- The age check does not store your date of birth. Only the fact that the check passed is retained.
- CigarFlux is built for the United States market. The retailers and prices it shows are United States ones.
1. Scope and territory
CigarFlux is a price-comparison and local-availability service built for the United States market, for persons aged 21 or older. People in other countries can view the site, but it is not directed to them or tailored to their laws. This policy is written to United States federal and state law and is not a GDPR or UK GDPR notice.
2. Information we collect
| Category | Detail |
|---|---|
| Account and authentication | Email address, display name, password hash, role, session records, and password-reset events. Passwords are stored only as salted scrypt hashes; plaintext passwords are never written to disk or logged. |
| Location preference | A five-digit ZIP code and any additional ZIP codes saved to define a search area. CigarFlux does not request, receive, or store precise geolocation, and does not use browser location services. |
| Age verification | A flag recording that an age check was completed and the time it was completed. The date of birth or birth year supplied at the check is evaluated in the moment and discarded; it is not stored and cannot be recovered from the flag. |
| Local alert sign-up | When you use Find it near you without an account, the email address and ZIP code you enter and the product you asked about are held in a short-lived, HTTP-only cookie on your device for up to thirty minutes, so the sign-up form can be prefilled. They are not written to our database unless you complete sign-up, and the cookie is deleted once it has been used. |
| Product and availability activity | Products added to a watchlist, notification preferences, availability reports submitted about a retailer, price corrections, catalog corrections, discussion posts, and ratings. |
| Discussion moderation | Whether a discussion post was published or held for review, reports other visitors make about a post, and the moderator's decision. Posts are screened automatically when submitted for markup, contact details, and threatening language. |
| Outbound referral records | The offer selected, the destination retailer, the price displayed at the time, the referring page, and the account identifier where the visitor is signed in. |
| Device, log, and security information | IP address, user-agent string, timestamps, requested paths, rate-limit counters, and authentication failures, retained for security, abuse prevention, and diagnosis. |
| Correspondence | Messages sent to our published contact addresses, and the notification email we send in response to activity you have subscribed to. |
3. How we use information
To operate the service and maintain your account; to display prices, package formats, and local availability; to send the notifications you have subscribed to; to prevent fraud, abuse, and automated attack; to reconcile referral commissions; and to comply with legal obligations.
Local demand is reported to participating retailers only in aggregate, and only once at least 3 distinct people are represented. Retailers are never shown who watched a product, who reported availability, or any identifier that would allow an individual to be recognized.
4. Service providers
We disclose information as needed to providers that support hosting, databases, security, email delivery, and error monitoring. Some elements load directly from a provider in your browser, which means that provider receives your IP address and basic device information at the moment they load.
| Provider | Purpose | What they receive |
|---|---|---|
| Hosting provider | Running the service and storing its database | IP address and request metadata, as any web host receives |
| Google Fonts | The two typefaces this site is set in | Loads in your browser. IP address and basic device information. No cookie is set |
| Cookieless analytics (Plausible-compatible) | Counting visits and page use in aggregate | No cookie and no stored identifier. The page address, referrer, and coarse browser and country information, used for aggregate counts only. It receives no account identifier, email address, or ZIP code and does not follow you across other sites |
| Email provider | Delivering notifications you subscribed to | Your email address, only where you hold an account |
| Sentry | Error monitoring | Server side only. The error and the path on which it occurred, configured to receive no request body, headers, cookies, or account identifier, and with query strings removed |
No session-recording or behavioral-advertising tool operates on this site. Our analytics sets no cookie.
5. Retailer links and affiliate relationships
CigarFlux does not sell tobacco and processes no orders. Selecting a retailer takes you to that retailer’s own website, where their privacy policy governs.
We record that the referral occurred, which offer and retailer it concerned, the price displayed at the time, and, where you are signed in, that it was you. That record is ours and is used to verify that published prices match the prices visitors reach.
CigarFlux participates in affiliate marketing programs. Certain retailer links are affiliate links, and where a qualifying transaction follows we may receive a commission from the retailer or the network administering that program. Commission is paid by the retailer, does not affect the price you pay, and does not influence editorial ordering. Results are ordered by observed price and availability evidence; placement is not available for purchase.
Current affiliate programs: Famous Smoke Shop and Cigars International.
Affiliate tracking is administered by the CJ Affiliate network, whose privacy notice is published at cj.com. When you follow such a link the network may set a cookie on your device so the retailer can attribute the visit. That cookie is set by the network and read on the retailer’s site, not on ours. We do not transmit your name, email address, ZIP code, account identifier, or any other information by which the network could identify you.
Affiliate tracking is on by default. You may opt out at any time using the notice on this site or the Privacy choices page (also linked in the footer as “Do Not Sell or Share My Information”), and we treat the Global Privacy Control browser signal as an opt-out. When you opt out, retailer links go to the retailer with nothing added. You may also delete cookies in your browser. Opting out does not change what CigarFlux shows you.
6. Retention
| Record | Period |
|---|---|
| Account and profile | For the life of the account. Deleted or de-identified following a valid deletion request, subject to the exceptions described under Deletion. |
| Local alert sign-up cookie | Up to thirty minutes, or until sign-up is completed, whichever comes first. |
| Availability reports, discussion posts, and corrections | Retained after account deletion in de-identified form, because other visitors have relied on them and withdrawing them would make local availability less accurate. Posts held for moderation are retained with the moderation record. |
| Outbound referral records | Up to twenty-four months, for commission reconciliation and dispute resolution. |
| Security, rate-limit, and audit records | As reasonably necessary to protect the service and to document enforcement, and longer where an investigation, dispute, or legal obligation requires it. |
| Server logs | Rotated on the ordinary schedule of our hosting provider. |
7. Your choices and rights
You may access and correct your profile at any time, adjust or disable notifications, export the information associated with your account, and request deletion. Residents of California, Virginia, Colorado, Connecticut, Utah, and Texas hold additional rights under state law, including the right to know, to correct, to delete, and to opt out of sale or sharing. We do not sell personal information. Affiliate tracking when you follow a retailer link may be treated under some state laws as sharing for targeted advertising, so we provide an opt-out on the Privacy choices page and honor the Global Privacy Control signal.
Requests should be sent to [email protected]. We do not discriminate against anyone for exercising a privacy right.
8. Deletion
Deleting an account removes the profile, watchlist, notification history, and saved ZIP codes. Availability reports, reviews, and corrections are retained in de-identified form, because other visitors relied on them when deciding where to travel and removing them would degrade the accuracy of the record. Security, audit, and referral records are retained for the periods described above.
9. Eligible Users
CigarFlux is available only to persons aged 21 or older. Use of the service requires completion of an age check, and creating an account represents that you meet that requirement. We do not knowingly collect information from anyone under that age; where we learn that we have, the account and its associated records are deleted.
10. Security
Access is authorized on the server for every operation that changes data. Passwords are stored as salted scrypt hashes and compared in constant time. Session cookies are HTTP-only and transmitted only over HTTPS in production. Rate limiting is applied to authentication and to visitor-submitted content, including discussion posts, which are also limited per account and screened when submitted. No system is perfectly secure, and we make no guarantee that unauthorized access will never occur.
11. Changes
Material changes will be announced on the service and reflected in the version and effective date above. Continued use following an update constitutes acceptance of the revised policy.
12. Contact
Privacy enquiries and rights requests: [email protected]. General enquiries: [email protected].