Privacy policy

Who we are

V2S2M, LLC operates Cinder. Contact: jack@v2s2m.com. We are not a cigar retailer.

What we collect

• Account: email, optional name, password hash (never the password itself), authenticator / 2FA status, and session cookies.
• Desk: brands you watch, grades, tasting notes, purchased-stick records you add or import, and alert preferences.
• Purchases you type in, or — on a member plan — paste from a shop confirmation. We do not log into anyone’s inbox. A one-time Gmail read was used only for the operator’s own receipts during setup.
• Payments: if you subscribe, Stripe handles the card. We store Stripe customer and subscription ids, not full card numbers.
• Product analytics (no extra PII): which brands and cigars people open, so we can improve the catalog. Admin tools see email and optional name so we can write to members — not a public dump of your notes.
• Deal emails: only if you opt in (account checkbox or the public form). We store the address, the opt-in time, and an unsubscribe token. Creating an account does not subscribe you.
• Age gate: a 21+ confirmation stored on your device. We do not store a date of birth.

Cookies and sessions

Sign-in uses locked, host-only cookies. Passwords are not kept in the browser store. We do not run third-party ad pixels on Cinder. We do not sell, rent, or share the email list with brokers.

Deal emails

Marketing notes (steep cuts, product news) go only to addresses that asked for them. Every such email includes a working unsubscribe link and this postal line: V2S2M, LLC, Cedar Rapids, Iowa, USA. You can also use Unsubscribe. Transactional mail (password reset, security) is not marketing and is not controlled by that list. Phone / Home Screen banners are a separate opt-in on the desk; they are off until you tap Enable and allow them on the device.

Who else sees data

• Stripe, for member billing.
• Google or X, if you sign in with those providers.
• Nobody else’s mail. Members paste a confirmation if they want those cigars imported. We do not connect to Gmail.
• Retailers, when you click through to their site. Those sites have their own policies. Some click-throughs are affiliate links — see affiliate disclosure.

We do not sell your personal information. We do not rent email lists.

How long we keep it

Account and desk data last as long as the account is open. You can ask us to delete the account by emailing jack@v2s2m.com. Session cookies expire with the session. Local age confirmation stays on your device until you clear site data.

Children

Cinder is 21+ only. We do not knowingly collect information from anyone under 21. If you believe a minor created an account, write jack@v2s2m.com and we will delete it.

Your choices

Sign in to change password, turn on 2FA, or close sessions. Email jack@v2s2m.com to export or delete your account. Refuse phone banners in desk settings. Unsubscribe from deal emails in any message, on Account, or at /unsubscribe. We never ask for access to your inbox. Email import is optional, members only, and is a paste of the confirmation — not a mail login.

Changes

We will date this page when it changes. Continued use after a posted change means you accept the new policy.