Privacy

What we collect, in full.

NOSE has no advertising and no third-party trackers. Accounts are optional, and the matcher works without one. This page lists everything that leaves your device, because a site that promises honesty about terpenes should be equally exact about data.

What changed, and when

Until recently this page said NOSE had no accounts and collected no email addresses. That was true, and it is no longer true: NOSE now offers optional accounts. We said we would tell you plainly rather than quietly widening the wording, so here is the change in one paragraph.

If you never create an account, this change does not touch you. The matcher is free, unlimited, and still runs entirely in your browser. Your palate is still stored only on your device, and we still never receive it.

If you create an account, we store your email address and, if you press Save to account, a copy of the jars saved in that browser. Sessions use a cookie. Those three things were not true before. Everything below spells out what that means.

A second change, in the same spirit. This page used to say that lab reports went nowhere. That changed on September 22, 2026: NOSE now keeps a store of what our server reads from reports fetched through lab links. This page described that store in full before it was switched on, as it promised to, and the section on lab reports below states exactly what it keeps and why — including that we intend to earn money from it.

A third, smaller change. The store now also keeps a copy of each lab report’s PDF file, not only what our server read from it, so that when our reader improves, old reports can be read again from the original. It also records two more things read from each report — the date the laboratory reported and the business it tested the product for — and, until the fourth change below, it kept a file that called itself a certificate of analysis even when our parser recognised neither the laboratory nor any terpene in it. That changed on September 23, 2026. This page described the PDF copies and the certificate rule before they were switched on, as it promised to; the two readings are taken from report text the store already kept. The section on lab reports below covers all three in full.

A fourth change, in October 2026, in the other direction: we keep less. A file is now kept only when it shows at least two of three signs of a lab report — a laboratory we recognise, the words “Certificate of Analysis”, and a terpene panel — where one sign used to be enough. A receipt or a label that only names a laboratory, or a letter that only mentions a certificate of analysis, is no longer kept. And something we kept can now be taken back out: the section on lab reports below says how to ask, and what a removal leaves behind.

A fifth change: dispensaries. A licensed dispensary can now show NOSE’s flavor match on its own website, beside its menu. The section on dispensaries below sets out what a dispensary sends us, what we keep, what its pages ask us for and what a shopper’s vote holds. In short: a shopper’s list of purchases goes from the dispensary to the shopper’s own browser, and never to us. That changed on October 9, 2026. This page described it in full before it was switched on, as it promised to.

A sixth change: smell words on a vote. When you press “Matched” or “Didn't match”, you can now also pick up to three words for what you smelled, from a fixed list — gas, skunk or hay, say — and they are sent with your vote. They help us learn which smells our matching misses: a lab report measures terpenes, not everything a jar smells of. You pick them with buttons; nothing you type is sent. That changed on October 14, 2026, and this page changed in the same update, not after it. The section on match feedback below lists everything a vote carries.

A seventh change: since October 15, 2026, a dispensary’s batch readings also keep the day the laboratory finished testing — a date printed on the lab report, about the product and not about anyone.

Without an account

Jars you save are written to your browser's local storage. The terpene values, the names you give jars, and the profiles themselves are never uploaded. Clearing your browser data deletes them permanently — we hold no copy and cannot restore them.

You can export your palate to a JSON file, import one back, or delete everything from the matcher at any time. No email address, no cookie, and nothing that links one visit to another.

What an account stores

Named specifically rather than summarised:

Your email address.
A hashed version of your password, held by the company that handles our logins (named below). Your password passes through our server on its way to them and is never stored or logged by us. We cannot recover it — only reset it.
The date the account was created.
Your subscription status.
The date and time you confirmed you are 21 or over. This is your own attestation, recorded as you gave it. It is not verification, and we do not describe it as verification anywhere.

We do not ask for your name, address, phone number, date of birth, or anything about what you buy or consume.

Nor does a dispensary that uses NOSE send us what its shoppers buy: a shopper’s list of purchases goes from the dispensary to the shopper’s own browser, and never to us. See Dispensaries that use NOSE.

Palate sync, if you use it

Your saved jars live in this browser. Two buttons in the matcher let you save a copy to your account and load it back on another device. Nothing moves unless you press one: there is no automatic syncing, and a copy exists on our side only if you put it there. Loading replaces what is in the browser you are using, so it will ask before it does that.

This is a real reversal of the promise we made before accounts existed, and it deserves stating flatly: a synced palate is a record, held by us, of cannabis products associated with your email address. Consider whether you want that before you use it. The matcher works exactly the same without sync, and the export button still moves a palate between devices by hand.

Synced palates are kept in file storage run by Netlify, the company that hosts this site, separately from your account credentials, and the company that handles our logins never receives them.

Who else receives your data

Logins are handled by Supabase, the same company that hosts the lab-report store described below. When you sign up or log in, our server passes them your email address and your password over an encrypted connection, because checking a password is their job. They keep your email address and a hashed form of the password, never the password itself. They do not receive your palate, your jars, or your match results.

Your browser never talks to them while you use this site; our server does. The exception is the emails they send for us, to confirm a new account or to reset a password: the link in them points at Supabase’s own site, not ours. Clicking it takes your browser there first, so Supabase sees your IP address and browser, as any website you visit does, and may keep them in its logs, before it sends you on to NOSE. An earlier version of this page left that out.

The site is served by Netlify, which keeps standard server logs including IP addresses for security and abuse prevention. That applies to any website you visit and is outside our control; see Netlify's own privacy documentation for their retention practices.

Nobody else. No advertisers, no analytics vendors, no data brokers.

Cookies and sessions

Before accounts, NOSE set no cookies at all. It now sets exactly one, and only after you log in.

The cookie is named nose_session. It contains a random string and nothing else — no email address, no name, no readable information of any kind. That random string points at a session record on our side holding your user id, your email address, when the session began and when it expires. An earlier version of this sentence left out the email address and the start time. The cookie cannot be read by JavaScript, is only sent over HTTPS, and is not sent when another site links to us.

It lasts fourteen days, and expires sooner if you log out. Logging out destroys the session on our side as well, so the cookie cannot be reused. There is no tracking cookie, no advertising cookie, and no cookie at all until you sign in.

Match feedback stays anonymous — including after accounts

When you press “Matched” or “Didn't match” on a result, we receive: the similarity score, its confidence band, how many jars were in your palate, which built-in sample jars were involved, a timestamp, and up to three smell words you picked from a fixed list.

Jars you created yourself are reported as the single word custom. Names you typed never leave your browser.

These votes carry no account identifier, and we made a deliberate decision to keep it that way. Your session cookie is not read when a vote is sent. Signing in does not attach your identity to anything you rate. We could have linked them and chose not to: testing whether a shared aroma shape predicts shared enjoyment does not require knowing who voted.

Because these votes are anonymous, they may inform aggregate research or published findings about how well the matching method works. Nothing in them identifies you or can be traced back to you.

Error reports — automatic

If the site's JavaScript fails, your browser sends us the error message, the script and line it came from, which page you were on, your browser's user-agent string, and a timestamp. It is capped at three reports per page load.

This contains no palate data and nothing you typed. Like match feedback, it carries no account identifier — an error report from a signed-in user looks the same as one from anybody else. Error reports are deleted after 90 days.

Camera, files, and lab links

QR scanning runs entirely in your browser. The camera stream is never transmitted or recorded, and the camera stops when you leave the tab. Permission is only requested when you choose to scan.

Report files you upload are checked for type and size locally, and are still not sent anywhere.

A scanned or pasted lab link is different. We check that it is an ordinary https address and that it does not point inside a private network, and then our server fetches that report itself.

We do not check the address against a list of approved laboratory domains. This page previously said we did, and that was wrong — the check was removed some time ago and the sentence describing it was left behind. It was removed deliberately: real reports reach people through whoever sold the jar rather than from the laboratory’s own website, so a list of lab hostnames turned away genuine reports while doing nothing about a convincing fake hosted on an approved one. What stands in its place is that the file must be a real PDF, and the figures inside it must add up to the total the laboratory printed itself. A fabricated report fails that test whatever address it arrived from.

Lab reports, and what we keep from them

Switched on September 22, 2026. Nothing was kept before that day. The PDF copies and the rest of the third change noted at the top of this page began on September 23, 2026, and the fourth change — the stricter rule below, and removals — in October 2026.

When a report is fetched from a scan or a link, we keep a copy of the PDF file itself and of what we read from it: the text pulled out of the PDF, the address it first came from (with everything after a “?” removed, because one-off links can carry codes there that point back at whoever received them), its size, a fingerprint of the file, and everything our parser found in it — laboratory, strain, batch, batch identifier, product class, the date the laboratory reported, the business it tested the product for, the terpene values, a note of anything in it our parser did not recognise, and, where we refused to trust a reading, the reasons we refused. We record the day a report was first fetched and the day it was read, never the time of day. That is not enough to keep our records from being lined up against the server logs our host keeps: each record is numbered in the order it arrives, so the order of a day’s reports survives, and an order can narrow down which request brought which report. An earlier version of this sentence said our records could not be lined up at all. The PDF copy is filed under its fingerprint and labelled with nothing but that address and that day. One thing is outside our control: the file storage our host provides may note on its own when each copy was saved, as file storage generally does. We never read that time or copy it anywhere.

We keep a file only when it shows at least two of three signs of a lab report: a laboratory we recognise, the words “Certificate of Analysis” anywhere in it, and a terpene panel — terpene results, a terpene total, or a line saying whether terpenes were tested. Every lab report we test our reader against shows at least two. A file that shows fewer — a receipt or a label that only names a laboratory, a letter that only mentions a certificate — may be somebody’s own document, linked by mistake, so we keep nothing from it: not the file, and not anything read from it. There is also a ceiling: once a day, counted in UTC, has added 100 new reports from scans, nothing more is kept until the next day.

None of it is about you. There is no account, email address, IP address, device information, session or palate of yours anywhere in it. A report scanned by a signed-in person is stored identically to one scanned by somebody who has never made an account, and afterwards the two cannot be told apart. This is not only a promise: the store holds nothing about the person who scanned. There is no column for anything about them, and the database itself refuses, before anything is written, any reading that carries a field for an account, an email address, an IP address, a device, a browser, a session, a phone number or a palate, at any depth. That is not the same as holding no names at all: lab reports routinely name people — the laboratory director who signed off, for instance, and sometimes a contact at the business that sent the sample — and the text we keep is the report as printed, those names and contact details included. An earlier version of this paragraph said no column could hold anything that identifies a person; the report text always could.

Records are only ever added. Once written, nothing in the store is edited or deleted by the application, and a stored PDF is never replaced: if our parser later reads a report differently, the new reading is added beside the old one. We do not count how many times a report is fetched — this page briefly said we would, and a count is exactly the kind of thing an add-only store does not keep. Things leave the store only by hand: a second copy of a report it already holds, and anything removed on request, as the next paragraph describes.

Taking something back out. If we kept something that should not be here — a file that is not a lab report, or a report you would rather we did not hold — email contact@nose-app.com with the link you scanned or a copy of the file. We do not need to know who you are, and nothing from your message is added to the store. We remove the file and everything read from it by hand. What remains is a record of the removal — the day, and one word from a short fixed list saying why — and two kinds of fingerprint: codes computed from the file and from its text, from which neither can be rebuilt. We keep them so that the same file is not stored again if someone scans it later; the scan itself still works.

What we read is kept in a Postgres database hosted by Supabase in its East US (North Virginia) region, and the PDF copies in file storage run by Netlify, the company that hosts this site. Only our own server code and our own maintenance scripts can reach either one — not your browser, not the public website, and not Supabase’s public data interface, which is refused access to the database. Your IP address never reaches the store, because reports are saved to it by our server, not by your browser. Netlify handles every request to this site under its own privacy policy, and nothing from its request logs is copied into the store.

Why we keep it, both reasons. The first is that our parser is occasionally wrong in ways that only become visible across many reports read side by side, and keeping them is how those faults get found and fixed. The second is commercial: we intend to study this collection — how terpene profiles differ between batches, between growers, and between laboratories reading the same material — and we may sell that analysis to growers. Nothing is for sale today and no such product exists yet. We are saying it now rather than once it has happened.

Our reasoning is that a lab report is a published document about a jar, not a document about the person holding it. If you would rather not take part, the matcher works without scanning anything at all — terpene values can be typed in by hand, and a jar entered that way never touches our server.

Dispensaries that use NOSE

Switched on October 9, 2026. Nothing in this section was collected before that day. This page described it in full first, as it did for the lab-report store.

A licensed dispensary can place NOSE’s flavor match on its own website. For a shopper who agrees, it lists the dispensary’s in-stock products whose terpene panel is closest to what that shopper has bought there before, and shows which purchases it used. After an order, it can ask whether a product’s flavor was close. It asks first, with one button, and the dispensary records the answer, not us.

A shopper’s purchases stay between the shopper and the dispensary. The dispensary already knows what its shoppers have bought. When a shopper agrees, the dispensary’s page hands that list — which batches, and on which days — to the shopper’s own browser, and NOSE’s code builds the shopper’s palate and sorts the menu there, in the browser. The list never reaches us: no request the code makes carries it, and none of our stores holds it. Nor are we told the shopper’s name, account with the dispensary, contact details, patient or card number, address, or which group of a test the dispensary has put them in. What the dispensary does with its own records is for the dispensary to say, not this page.

What a dispensary sends us. When a dispensary signs up, we record its name, the web addresses its pages are served from, how many months back its products stay in its list (twelve unless agreed otherwise) and, if it wants one, a limit that keeps suggestions near the THC and CBD of what a shopper bought. We give it two keys, a secret one for its own server and a public one its pages use, and keep only a fingerprint of each, from which the key cannot be rebuilt. Its server then sends us its catalog whenever the catalog changes: one line per batch it lists, holding the dispensary’s product and batch identifiers, the category (flower, pre-roll, vape or concentrate), the route (smoking or inhalation), the product’s name and brand, whether it is in stock, the address of its product page, its THC and CBD percentages, and the address of that batch’s lab report. A file with any other column is refused whole, before any line of it is read, and so is a file with a column whose name looks like it is about a person.

Before it signs up, a dispensary can send us its catalog once, so we can show it how many of its products have a terpene panel we can read. That file is read in our own maintenance workspace, the run writes nothing but a report, and the file and the report are deleted there once the report has been sent.

What we read and keep. We keep each batch the dispensary lists — its line from the catalog, where it came in the catalog, and the first and last days it was listed — and we go on keeping it after it sells out or leaves the catalog, because a shopper’s past purchases are usually sold out and the comparison still needs them. We fetch each listed batch’s lab report from the address the catalog gives, read it with the same reader as the scanner, and keep one reading per batch: the laboratory, the product form, whether we trusted the reading and, if not, why; the terpene values, the total the laboratory printed, and moisture and water activity, only when we trusted it; the harvest date, the day the laboratory finished testing and the report date; the batch and lab identifiers the report printed; any warnings; whether its layout was new to us; which of our readers read it; and the address we read and the day we read it. If an address gives no report, we keep the reason and try again later. Unlike the lab-report store above, this store changes: each catalog updates its batches, and a reading is replaced when its report is read again. The report itself is not kept — not the file and not its text, so not the names printed in it either — and reports read from a catalog never enter the lab-report store above.

What a dispensary’s page asks us for. The page loads one fixed version of NOSE’s code from this site, and the shopper’s browser checks it byte for byte against a fingerprint the page names, so a change to our code reaches the page only when the dispensary chooses a new version. On the dispensary’s site, that makes NOSE’s code a third-party script. Until a shopper says yes, it asks us for nothing but its own code and its styles. Once they have, it asks for the dispensary’s list, naming the dispensary by its public key and nothing more. The reply is the same for every visitor: the dispensary’s window and THC and CBD limit, and each batch it listed within that window, in stock or not, with its identifiers, name, brand, category, route, stock, product page, THC and CBD, and from our reading the laboratory, the report dates, whether we trusted it and, only if we did, the terpene values and total. It is given only to requests that say they come from one of the dispensary’s own web addresses. The code’s own requests carry no cookie and no referrer, so the address of the page the shopper is on — an order page, say — is not sent, and our guide for dispensaries asks them to load the code the same way.

What a vote holds. After an order, the dispensary’s page can ask about one product the shopper bought: was its flavor close? A vote holds the dispensary, that product, the score and band the shopper was shown, how many batches the palate behind that score was made from, up or down, and the day, counted in UTC. So it carries two facts about the shopper’s buying: that they bought that product, and how many other batches went into their palate — never which ones. It never holds who voted, their list of purchases, the palate itself, an IP address, browser or device details, a cookie or a time of day. At most 100 votes a day are kept from one dispensary. We keep votes to test whether a closer score means a closer flavor.

A vote is filed under its day and a random code, never a time, so votes cannot be put back in the order they arrived. That is not enough on its own: on a day with very few votes, a vote could still be matched with its request in our host’s logs, described below. The file storage that holds votes may also note when each was saved, as file storage generally does. We never read that time or copy it anywhere.

What stays in the shopper’s browser. The code keeps two short lists there, in the dispensary’s own site storage: the batches the shopper took out of their palate, and the products they have voted on, so each gets one vote. Neither is sent to us. Clearing the dispensary’s site data in the browser clears both.

Where it is kept, and for how long. Dispensaries, their keys, their batches and their readings are kept in a separate part of the same Postgres database at Supabase, in its East US (North Virginia) region, behind a login of their own that cannot read or change the lab-report store, just as the lab-report store’s login cannot reach this one. Votes, and the fixed versions of our code, are kept in file storage run by Netlify, apart from the lab-report PDFs and from the matcher’s votes. A dispensary’s records and votes are kept for as long as its license to use NOSE lasts, with no earlier deletion schedule: its list shows only the batches listed within its window, but older ones stay until then. The versions of our code are kept indefinitely; they are the same for everyone and hold nothing about anyone.

Netlify, which runs this site, logs each request it serves, these included, under its own privacy policy: among other details, the address asked for, the IP address and browser it came from, a country and the time. A request for a dispensary’s list names that dispensary’s public key, and the code asks for the list only once its shopper has said yes, so a line in those logs can show that someone at an IP address said yes on that dispensary’s site, and when. Nothing from those logs is copied into our stores.

When a dispensary stops using NOSE. When its license to use NOSE ends, we delete its records by hand with one command: first, in a single step, its readings, its batches, its keys and its own record, so its keys stop working at once; then every vote kept under its name. If the file storage stops answering part way, running the same command again finishes it. A copy of its list can stay in Netlify’s cache, and in browsers that had loaded it, for up to a minute. What remains afterwards is what never belonged to the dispensary: the versions of our code, and Netlify’s own request logs, which follow Netlify’s schedule.

Deleting your account

There is a delete button in your account settings. It is not a request queue and not a deactivation flag. Pressing it, in this order:

erases your synced palate;
destroys every active session, on every device;
deletes your account and email address from our authentication provider.

If any step fails, you are told so rather than shown a success message, and we finish it manually.

Two things survive deletion, and both are things that were never attached to you: anonymous match-feedback votes, and anonymous error reports. There is no identifier in either one, so there is nothing in them to erase. Netlify's server logs are outside our control and follow their retention schedule.

Deleting your account does not touch the palate stored in your own browser. That is yours, and it stays until you clear it.

How long we keep things

Account and synced palate: until you delete the account. Deletion is immediate, not scheduled.
Sessions: fourteen days, or until you log out.
Error reports: 90 days, then automatically purged.
Match feedback: kept indefinitely. It is anonymous, and the whole point of collecting it is to see whether the method holds up over time.
Lab reports and what we read from them: kept indefinitely, with no deletion schedule and no plan to introduce one, unless removed on request (see “Taking something back out”, above). They describe cannabis products, not people.
A dispensary’s records, readings and votes: until its license to use NOSE ends, then deleted by hand (see Dispensaries that use NOSE, above).

If there is a breach

If your email address or account information is exposed in a security incident, we will notify you and the relevant authorities as required by law. Florida law sets specific obligations here and we intend to meet them.

We will say what happened and what was exposed, rather than issuing something vague.

What we still do not do

This list is shorter than it used to be. It used to begin with “no cookies” and end with “no accounts.” Both of those lines are gone, and pretending otherwise would be worse than losing them.

No advertising, and no selling of your personal information. We do intend to sell analysis of lab reports, which is set out in full above; your palate, your account and your use of this site form no part of that and are not for sale at any price.
No analytics suites, session recording, or fingerprinting.
No account required to use the matcher — it is free and unlimited either way.
No third-party scripts running in your browser. Logins are handled entirely by our own server, so no outside code loads on this site. The Content Security Policy blocks it at the browser level, not merely by policy.
No claims about effects — and so no health data collected or inferred.

Honest status of this document

This describes the current build. If we later collect something we do not collect today, this page changes before that ships, not after, and the “what changed” note at the top gets rewritten rather than removed.
NOSE is for adults 21+ and is an educational aroma tool. It is not medical advice.
Questions, a deletion request, or something to take out of the lab-report store: contact@nose-app.com.