Privacy Policy

Data Controller: The HookahDraft Team. For all privacy, data protection, and account inquiries, you can directly reach our team through the built-in 'Profile > Settings > Support & Feedback' screen inside the mobile app or via the feedback system on our website. Requests are processed promptly in accordance with applicable regulations.

We collect only the minimum necessary data to provide a high-quality mixology and community experience: • Account & Identity Data: Email address, securely hashed password, username, and optional display information. • Profile & Community Data: Avatar image, biography, earned badges, and public interactions. • User-Generated Content (UGC): Custom hookah blend recipes, bowl packing configurations, heat management settings, reviews, votes, and favorites. • Digital Tobacco Inventory (My Stash): Tobacco brand names, flavor profiles, and recorded gram balances. • Subscription & Payment Information: Pro or Premium tier status, subscription lifecycle dates, and anonymous subscription identifiers. We NEVER store payment card details on our servers; transactions are encrypted and processed directly by applicable app store platforms and authorized billing providers. • Technical, Diagnostic & Analytics Information: Device OS version, application language, approximate region (country/city level), anonymous crash diagnostics, and aggregated usage metrics collected via Google Analytics and Google Signals subject to your consent.

Your personal data is processed under the following lawful bases: • Account creation, authentication, and security (Performance of Contract), • Synchronizing your recipes, inventory, and gear setups across all your devices (Performance of Contract), • Recommending customized recipes via 'Make with My Stash' (Legitimate Interest), • Preventing spam, fraud, and maintaining community safety (Legal Obligation), • Granting and syncing Pro/Premium subscription tiers via RevenueCat webhooks (Performance of Contract).

To ensure enterprise-grade stability, security, and performance, we collaborate with industry-standard infrastructure providers: • Identity & Cloud Infrastructure Providers: Secure authentication protocols, encrypted cloud databases, and hosting infrastructure. • Subscription Management & Store Verification Services: In-app purchase verification, receipt validation, and cross-platform entitlement synchronization. • Network Defense, SSL & Content Delivery Networks (CDN): Protection against distributed denial-of-service (DDoS) attacks, encrypted data transit, and automated threat mitigation. • System Diagnostics & Reliability Logging: Anonymous crash reporting and diagnostics to maintain application reliability. • Google Analytics (GA4) & Google Signals: We utilize Google Analytics and Google Signals to analyze visitor traffic, page interactions, and platform performance. When Google Signals data collection is enabled, Google Analytics collects visitation information and associates it with Google information from accounts of signed-in users who have consented to this association (which may include end-user location, Google search history, YouTube watch history, and data from sites that partner with Google). This information is used strictly in an aggregated and anonymized form to provide cross-device audience reporting, demographic insights, and interest category analytics. User Data Control & Deletion Rights: You can view, manage, and delete this activity data at any time via Google 'My Activity' (https://myactivity.google.com/). You can also manage ad personalization via Google Ads Settings (https://adssettings.google.com/), install the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout), or adjust your cookie preferences through our on-site Cookie Settings. We NEVER sell or lease your personal data to data brokers or third-party marketing firms. • Google User Data & Limited Use Disclosure: HookahDraft's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you authenticate using Google Sign-In, we only collect your name and email address strictly to authenticate your account and identify your user session. Google user data is never used for advertising, nor is it sold or used to train artificial intelligence (AI) models.

Our website utilizes cookies and local storage technologies to enhance user experience, ensure session security, and collect anonymous usage insights. Cookies are categorized as follows: 1. Strictly Necessary & Security Cookies: Essential for the core operation of the platform, including secure authentication tokens and language preferences. These cookies cannot be switched off and do not require prior consent under GDPR/ePrivacy regulations. 2. Analytics & Performance Cookies: Deployed via Google Analytics (_ga, _ga_*) to measure traffic volume, session duration, and page interactions in order to continuously improve platform speed and usability. 3. Marketing & Google Signals (Audience Insights): Provides aggregated cross-device audience trends, demographics, and interest reports for users who have enabled Google account ad personalization. Managing Your Cookie Preferences: Non-essential analytics and personalization cookies are disabled by default (Google Consent Mode v2) and will only be activated with your explicit opt-in consent via our Cookie Consent Banner. You can review, modify, or revoke your consent at any time by clicking the 'Cookie Settings' link in our website footer or the floating badge.

Under GDPR and applicable privacy laws, you have the right to access, rectify, delete, and restrict processing of your data. You can exercise these rights anytime via the in-app support center or web feedback channel. We may update this policy periodically; significant revisions will be communicated via in-app notices.