Privacy policy
Last updated 1 October 2026
Who we are
Layer is made by North Common Studios, operated by Max Tyrrell, Cooleven, Manor Avenue, Greystones, Co. Wicklow, Ireland ("Layer", "we", "us"). We are the data controller for the personal data described in this policy.
Contact for anything about your data: layer@northcommonstudio.com.
This policy covers the Layer iPhone app and the Layer website at https://layer.northcommonstudio.com. Because we are based in Ireland, the EU General Data Protection Regulation (GDPR) and Irish data protection law apply.
The short version
- Layer has no accounts. You never give us your name, email address or a password to use the app.
- Your collection — every bottle, photo, cut-out, price, wear, Top 5, wishlist item and setting — is stored on your iPhone, not on our servers. We cannot see it.
- A few features need to send something over the internet to work: fragrance search, weather and the subscription. Each one is explained below, including exactly what is sent.
- Layer does not send your photos or your collection to any AI service.
- Layer has no advertising SDKs, no analytics and no cross-app tracking. We do not sell or share your data for advertising.
What stays on your iPhone
Photographs of your bottles, the background-removed cut-outs, which fragrances you own, what you paid and the bottle size, every wear you log (with the occasion and the weather at the time, if you added them), your Top 5, your wishlist, the city you typed for weather, and your settings.
This is kept in the app's private storage on your device. Background removal uses Apple's Vision framework and runs entirely on your iPhone. Deleting the app, or using Settings → Delete all my data, erases it from your iPhone.
iCloud Backup. If you use iCloud Backup, iOS may include Layer's data in your device backup. That backup is held by Apple under your Apple ID, not by us, and we cannot see it or access it. It lets you restore your collection on a new phone. Backups made after you delete your data no longer contain it; to remove an older backup, delete it in your iPhone's iCloud settings.
Because this data never reaches us, we do not process it and cannot recover it for you. If you change phones, restore from your iCloud or computer backup, or use Settings → Export my data first.
When data leaves your iPhone
1. Fragrance search and fragrance details
When you search for a fragrance, or open a fragrance's page, the app sends your search text (or the house and name of the fragrance) to Layer's server, which is hosted by Supabase in Ireland. Our server asks Fragella, a fragrance database service, for matching fragrances and passes the results back.
- What is sent: the words you typed, or a house and fragrance name. Nothing else about you. Fragella sees only our server, never your device.
- What we keep: a shared catalogue. Our server saves the fragrance details Fragella returns, and the search words that fetched them, so the same search does not have to be asked of Fragella again. This catalogue is not linked to you: it holds no name, device identifier or network address, and it does not record who searched. Like any web service, Supabase also keeps short-lived technical logs (such as the time of a request and the network address it came from) for security and to keep the service running. To stop one person from overloading the service, we also keep short-lived request counters tied to a one-way scrambled (hashed) version of the network address, never the address itself. They are deleted within a few days.
Lawful basis: performance of our contract with you — providing the search you asked for (GDPR Art. 6(1)(b)); keeping the service secure and available (our legitimate interests, Art. 6(1)(f)).
2. Weather (only if you turn it on)
To base today's pick on the weather, the app needs to know roughly where you are. You can either allow approximate location or type a city.
- With location: the app sends approximate coordinates, rounded to about 1 km, to the Norwegian Meteorological Institute (MET Norway) (api.met.no) and receives the temperature and conditions.
- With a typed city: your iPhone's own location lookup, provided by Apple, turns the city name into coordinates. Only the rounded coordinates are then sent to MET Norway.
- What is never sent to MET Norway: any identifier, your collection, or anything else. As with any web service, its servers see the network address of the request.
- What is kept: the result is cached on your phone for an hour.
If you do neither, the app still works and today's pick is based on the season.
Lawful basis: your consent for device location, which you can withdraw at any time in iPhone Settings → Privacy & Security → Location Services → Layer (Art. 6(1)(a)); performance of our contract for a typed city (Art. 6(1)(b)).
3. Layer Privé subscriptions
If you subscribe, Apple takes the payment and manages the subscription. RevenueCat tells the app whether your subscription is active.
- What RevenueCat receives: a random identifier created for this app, your purchase and renewal history, and basic technical details such as your app and iOS version, country and network address.
- What it never receives: your name, your email, your payment card or anything about your collection.
- What is kept: RevenueCat keeps subscription records for as long as we need them to provide the subscription and to prevent fraud. Apple handles the payment itself under Apple's own privacy policy, as a separate controller.
Lawful basis: performance of our contract with you (Art. 6(1)(b)); preventing fraud (our legitimate interests, Art. 6(1)(f)).
4. Notifications
If you turn on the daily notification, it is scheduled by your iPhone itself. We do not run a notification server, and no notification token is sent to us.
5. Share cards
When you make a share card, it is created on your iPhone. It is only shared when you choose where to send it, and then the app or service you pick handles it under its own terms.
6. Retailer links
If Layer shows links to retailers, tapping one takes you out of Layer, and that retailer's own privacy policy applies. Some links may be affiliate links; see our affiliate disclosure.
7. When you email us
If you contact support, report a suggestion or suggest a correction, the app opens your own mail app with the message filled in so you can see what is being sent before you send it. We receive whatever you include, such as your email address and your message, through our email provider, Google (Gmail).
We keep support emails for up to 24 months after the conversation ends, then delete them.
Lawful basis: our legitimate interests in answering you and improving Layer (Art. 6(1)(f)).
The Layer website
- Waitlist: if you join the waitlist, we collect your email address to send you one email when Layer launches, which includes your founders' lifetime offer (see the Terms). The form is run by Netlify, which hosts the website. Netlify may check submissions with a spam filter. We delete the list within 30 days of sending the launch email, or sooner if you ask. Lawful basis: consent (Art. 6(1)(a)); you can withdraw it at any time by emailing us or using the link in the email.
- Hosting logs: Netlify records technical information such as your network address and browser type to deliver the site securely. Lawful basis: our legitimate interests in running a secure website (Art. 6(1)(f)).
- Bottle images: the fragrance bottle pictures on the website are loaded from Fragella's image server (cdn.fragella.com), so your browser connects to it and shares your network address with it, as with any image on the web. Lawful basis: our legitimate interests in showing the fragrances we describe (Art. 6(1)(f)).
- Fonts: the website's typefaces are served from our own hosting, so your browser does not contact Google or any other font provider.
- Cookies: the website does not set cookies and does not use analytics, advertising or tracking scripts, so there is no cookie banner. Nothing on the site is stored in your browser.
Permissions the app asks for
| Permission | Why | If you say no |
|---|---|---|
| Camera | To photograph your bottles | Choose a photo, or add a bottle by search or by hand |
| Photo library | To add bottles you have already photographed | Use the camera, or add by search or by hand |
| Photo library (add only) | To save a share card | Use the share sheet instead |
| Location (approximate, while using) | To base today's pick on local weather | Type a city, or skip weather |
| Notifications | One daily message at a time you choose | Layer simply never notifies you |
Every feature works with every permission denied, except the one that permission is for. Layer asks for each permission only when you first use the feature that needs it.
Who receives data
| Service | What it does for Layer | Where |
|---|---|---|
| Supabase | Runs Layer's server for fragrance search and details | Ireland (EU) |
| Fragella | Fragrance information, from our server only; bottle images on the website, loaded by your browser | United States |
| MET Norway | Weather | Norway (EEA) |
| RevenueCat | Subscription status | United States |
| Apple | Payments and subscription management (separate controller) | Ireland and United States |
| Netlify | Website hosting and the waitlist form | United States |
| Google (Gmail) | Support email | Ireland and United States |
We have contracts with the services that process data for us that require them to protect it and use it only to provide their service to Layer.
Transfers outside the EU. Where a service is in the United States, the transfer is protected by the EU–US Data Privacy Framework where the company is certified, or by the European Commission's Standard Contractual Clauses. MET Norway is in Norway, which is part of the European Economic Area.
Your rights
Under the GDPR you can ask to access, correct, delete, restrict or move your personal data, object to how we use it, and withdraw consent at any time. For data on your iPhone, two of these are buttons:
- Access and portability — Settings → Export my data creates a file of everything Layer holds on your phone, with your photographs, and hands it to the share sheet. The temporary copy it makes is removed when you finish sharing.
- Erasure — Settings → Delete all my data erases the database, every photo and cut-out, the temporary image caches, your notification schedule and your settings, then returns the app to its first screen. It cannot be undone, and it does not change an iCloud backup Apple already holds (see above).
You can correct anything in your collection directly in the app. For anything we hold — support emails, the waitlist, or subscription records — email layer@northcommonstudio.com. We reply within one month. Because Layer has no accounts, we may ask for details such as the email address you wrote from, so we only act for the right person.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission in Ireland (dataprotection.ie), or to the data protection authority where you live.
Automated decisions
Layer's daily picks and layering ideas are suggestions for you to take or leave. Layer makes no automated decisions that have legal or similarly significant effects on you.
Children
Layer is for people aged 16 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email layer@northcommonstudio.com and we will delete it.
Security
Your collection stays in the app's private storage, protected by your iPhone's own security. Data sent over the internet is encrypted in transit. No provider key is stored in the app. If a breach affecting personal data we hold ever happened, we would notify the Data Protection Commission and, where required, you.
Changes to this policy
If this policy changes in a way that affects you, the app will tell you the next time you open it, and the date at the top will change. The current version is always in the app under Settings → Privacy Policy and at https://layer.northcommonstudio.com/privacy.