FragDNA / Privacy policy
Privacy policy
Short version: we store as little as we can get away with, we do not sell anything about you, and you can have all of it deleted by sending one email.
Last updated 22 October 2026
Who we are
FragDNA is an independent fragrance comparison site run by Synthetic White AB, a company registered in Sweden, which is the data controller for everything described here. For anything on this page, write to marco@fragdna.com. A person answers, not a form.
What we store if you never sign in
When you first arrive, a cookie banner asks what you allow. Until you answer, and if you choose "Only necessary", nothing optional is set: no Google Analytics, no AdSense, and no cookie that recognises you on a later day. You can change your answer at any time with "Cookie settings" at the foot of every page.
If you accept analytics, we set one cookie of our own, fd_v. It holds
a random identifier — a string of letters and numbers. Not your name, not your
email, nothing you typed. It lets us group the pages you looked at, the
searches you ran and the shop links you followed into a single anonymous
visit, so we can see how the site is actually used — which pages help, which
searches come back empty, where people give up. That is a profile of a
browser's behaviour on this site, and we would rather say so plainly than hide
it behind the word "analytics".
It is tied to a random id, never to your name or your email, even if you later sign in. It is not shared with anyone, not sold, not used to show you advertising, and not used to follow you onto any other website. If you clear the cookie, the link is broken and the next visit starts fresh.
Your saved matches, favourites, language, currency preference, course progress, votes cast and a flag recording that you have already seen the "create an account" prompt are kept in your browser's local storage. None of it leaves your device unless you sign in.
What our own visit log records
We keep our own record of how the site is used, so we can see which pages help, where people give up, and what they go on to buy. For each visit it records:
- A shortened form of your IP address — the network part only (for example 81.23.45.0), never your full address — and what the connection implies: an approximate location (city, region and country, and that city's rough map position, to about 10 km) and the name of the network or organisation it comes through. Even the shortened address is deleted after 90 days; the rest of the record stays, without it.
- Your device type, operating system, browser, screen size and language.
- Which pages you opened and in what order, the site you arrived from, what you clicked (including outbound shop links), how far down each page you scrolled, and how long each page was on screen.
Pages in one visit are linked by a random visit identifier, which starts afresh
after 30 minutes without activity. Unless you accepted analytics it is kept for
the open tab only and disappears when you close it; if you accepted, it is kept
across tabs, and your visits on different days are linked by the fd_v
cookie above. Neither contains your
name or email. This record is not sold, not shared with advertisers, and not
used to follow you onto any other website. If your browser sends a
"Global Privacy Control" or "Do Not Track" signal, we honour it: the
visit is counted as a page view and nothing more — no visit identifier, no
clicks, no scrolling, no time on page. You can also stop it by clearing or
blocking this site's cookies and storage, and you can ask for it to be deleted
at any time (see below).
One more thing we would rather say than leave out: in our own reports, visits
that carry no fd_v cookie may be estimated to belong together
when they share a network, device type, screen size and city. That is a rough guess
used for counting, it often merges different people, and it is never used to work
out who anyone is.
What we store if you do sign in
Signing in is optional and uses Google. Google confirms your identity to us and we receive three things: an account identifier, your display name, and your profile picture URL. We store those, plus your email address, so we can tell accounts apart and contact you if something goes wrong.
We also store what you save, how you vote, and how far through the course you have read — so that those follow you between your phone and your computer, which is the entire reason accounts exist here.
We never see your Google password. Google verifies you and tells us the result; the password is never sent to this site.
Reviews and the forum
If you write a review or post in the forum, what you write is public, shown with your first name and the initial of your last name (and your Google profile picture, on reviews). Your email address is never shown. Your votes on a fragrance — rating, longevity, projection, season, and how close a dupe gets — are shown only as averages.
We keep what you post so the conversation stays readable. You can delete your own reviews; for forum posts, write to us and we will remove them. Before anything is published, it is checked automatically — by simple rules and by an AI safety classifier run on Cloudflare's own infrastructure — for spam, threats, hate and personal details; nothing you write is used to train any model. Moderators can hide anything that breaks the rules (spam, abuse, other people's personal data); hidden posts are no longer published. To limit spam we count how often each account posts, and we keep reports you send us.
Emails
We only email you if you asked to hear from us. When you sign up for the newsletter or ask to be told about a price, we store your email address, where on the site you signed up, the fragrance you are watching (for a price alert), the country your connection came from, and when. An address you send us in an Instagram message is not added to our list until you click the confirmation link we send. Every newsletter carries a one-click unsubscribe link (and the standard unsubscribe header your email app shows as a button); once you unsubscribe, we never email that address again — we keep the address only on a do-not-email list so that promise holds.
If you email us — a correction, a question, a collaboration — we keep the conversation in our mailbox so we can reply and follow up, and delete it on request.
If you comment on our Instagram posts or send us a direct message, Meta passes us the message and your Instagram username so we can answer. An automatic check, run on Cloudflare's infrastructure, decides whether one of our standard replies fits; anything else is read by a person. We keep these messages to keep the conversation going and delete them on request. Meta's own policy covers what Instagram does with them.
Advertising
Some pages have space for advertising. No advertising script loads unless you allow ads
in the cookie banner ("Accept all", or "Ads" under "Choose"). If you allow them, Google AdSense loads on the pages
that carry an ad space and may set its own cookies, governed by Google's policy. If you choose
"Only necessary", nothing from an advertising network is fetched; we remember your choice in your
browser (fd_consent, fd_ads). Sponsored placements we sell ourselves are always labelled and never
change the order of the alternatives.
What we do not do
- We do not sell or rent your data.
- We do not load advertising networks unless you allow ads, and we run no cross-site trackers of our own.
- Visit counting also uses Cloudflare Web Analytics, which is cookieless and does not identify you.
- We do not send anything about your visit to a third-party analytics company unless you accept analytics — then Google Analytics receives it under Google's policy.
- We do not email you unless you have asked us to.
- We do not track you across other websites ourselves.
Retailers you click through to
When you follow a link to a shop, you leave FragDNA and that shop's own privacy policy applies. Some of those links carry an affiliate tag identifying the visit as coming from us — see the affiliate disclosure. We do not pass your name, email or account to any retailer.
Why we may use it (legal basis)
| What | Why | Basis under the GDPR |
|---|---|---|
| Running the site, keeping it secure, stopping spam and abuse | So the site works and stays safe | Legitimate interest |
| Our own visit log (one visit at a time) | To see which pages help and fix the ones that don't | Legitimate interest — switched off by Global Privacy Control |
fd_v, Google Analytics |
Measuring use across visits | Your consent (cookie banner) |
| Google AdSense | Showing ads that keep the site free | Your consent (cookie banner) |
| Your account, saved matches, votes, reviews, forum posts | Giving you what you signed up for | Performing our agreement with you |
| Newsletter and price alerts | Sending what you asked for | Your consent, confirmed by email |
| Emails and Instagram messages you send us | Answering you | Legitimate interest |
Where we rely on consent you can withdraw it at any time — "Cookie settings" at the foot of every page, or the unsubscribe link in any email — and withdrawing is as easy as giving it. Where we rely on legitimate interest you can object, and we will stop unless we have a compelling reason we can explain to you.
How long we keep it
| What | How long |
|---|---|
| Shortened IP address in the visit log | 90 days, then deleted automatically |
| The rest of the visit log (pages, clicks, device, rough location) | While it is useful for statistics, never with the IP address |
| "Who is on the site now" presence | About 15 minutes after you stop browsing |
Sign-in session (fd_s) | 60 days, or until you sign out |
| Account, saved matches, votes | Until you ask us to delete the account |
| Reviews and forum posts | Until you delete them or ask us to |
| Newsletter and price-alert address | Until you unsubscribe; then only on the do-not-email list |
| Emails and Instagram messages you send us | As long as the conversation is useful, or until you ask |
Who helps us run it
A small number of companies process data on our behalf, under written terms that oblige them to protect it and use it only for us:
| Company | What for |
|---|---|
| Cloudflare | Hosting, database, security, cookieless visit counts, the automatic checks on posts and messages |
| Sign-in with Google; Google Analytics and AdSense only with your consent; our own email account | |
| Resend | Delivering the newsletter, price alerts and confirmation emails |
| Meta | Instagram comments and messages you send us (Meta also acts under its own policy) |
Some of these companies are based in the United States or route data through it. Where data leaves the EU/EEA it is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
How we protect it
Everything travels over HTTPS with strict transport security, our pages run under a strict content-security policy, sign-in cookies are HttpOnly and cannot be read by scripts, the admin area is limited to named people, and IP addresses are shortened before they are ever stored. No system is perfectly safe; if a breach ever put your data at risk we would tell you and the Swedish authority, as the law requires.
Google user data
When you sign in with Google we ask only for your basic profile — an account identifier, name, email address and profile picture — and use it only to sign you in and run your account as described above. We do not ask for access to your Gmail, Drive, contacts or anything else in your Google account.
FragDNA's own team also connects FragDNA's own Google accounts to our admin tools — our mailbox, to draft and send our correspondence, and Google Search Console, read-only, to see which searches bring people to the site. Those connections touch only our own accounts, never a visitor's.
FragDNA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models, and no person reads it except where you ask us to, for security, or where the law requires. You can remove FragDNA's access at any time in your Google account under "Third-party apps & services".
Your rights
Under the GDPR you can ask us for a copy of what we hold about you (including in a portable, machine-readable form), ask us to correct it, delete it, or restrict how we use it, object to us using it, and withdraw any consent you gave. Email marco@fragdna.com — you do not have to justify the request, it costs nothing, and we answer within one month. We may ask you to confirm the request from the email address involved, so nobody else can ask for your data.
If you are unhappy with how we handled it, you can complain to your national data protection authority — in Sweden, the Integritetsskyddsmyndigheten (IMY, imy.se).
Signing out clears your saved list from the device you are using. To delete the account itself and everything attached to it, email us.
If you live in California or another US state with a privacy law: we do not sell your personal information, and we do not share it for cross-context behavioural advertising unless you allow ads in the cookie banner. Global Privacy Control is honoured as an opt-out. You have the same rights to know, correct and delete described above, and we will not treat you differently for using them.
Decisions made by machines
The only automatic decision we make about you is the check that holds back posts that look like spam, abuse or someone's personal details. If it holds back something you wrote and you think it got it wrong, write to us and a person will look at it.
Children
This site is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us their details, tell us and we will delete them.
Changes
If this policy changes materially we will say so on this page, with a new date at the top, rather than change it quietly. If the change affects how we use your email address we will tell subscribers before it takes effect.