Fanning the coals
Clearing the stem.
18+Reference resource. Nicotine is addictive. Tobacco use harms your health.
Clearing the stem.
Legal information
What the site collects, why, and what you can do about it.
Revision of 16 August 2026.
This document describes data processing on hookahhub.pro. The site holds reference material about hookahs, tobaccos and mix recipes, sells nothing and is intended for people over 18.
Listed below is only what the site actually collects and stores.
Reading the material requires no account. Without an account the site stores nothing about you beyond what is described under technical data.
Registration stores an email address, a display name and a password hash produced by bcrypt. The password itself is not stored and cannot be recovered from the hash. The record also holds the creation date, whether the address has been confirmed, and the site role.
Interface language and colour theme are kept in the profile so the choice applies on any device, not only where it was made.
A rating is five numeric values on a five-point scale: taste, smoke, strength, heat resistance and overall. There are no written reviews or comments on the site at all. Recipes you create, your favourites list and earned achievements are also stored.
The IP address is used for rate limiting — during registration, password recovery, search and the recipe generator. It sits in temporary storage for the length of the limit window, from a minute to an hour, and is then removed. Application errors go into the server log.
The site takes no payments and asks for no payment details, documents, phone number or precise location. It collects nothing about health or smoking frequency.
Account data keeps login working and ties ratings and recipes to their author. The email address is also used to confirm registration and to reset the password.
Ratings feed the averages shown on tobacco, hookah, accessory and manufacturer pages.
Technical data keeps forms and search from becoming a brute-force tool and from taking the site down.
Account data is processed at your initiative: registration is voluntary and all site material is available without it.
Analytics and advertising services are loaded only after explicit consent, and that consent can be withdrawn at any time.
Required cookies keep the site working and are always set. Analytics and advertising cookies appear only after consent.
| Name | Purpose | Lifetime |
|---|---|---|
| authjs.session-token | Login session. Appears only after signing in. | 30 days |
| NEXT_LOCALE | Selected interface language. | 1 year |
| hh-age-confirmed | Age confirmation, so the dialog does not return on every visit. | 1 year |
| hh-cookie-consent | Your answer to the cookie banner. | 1 year |
| theme (browser local storage) | Colour theme for a visitor without an account. | Until browser data is cleared |
| Google cookies (_ga, _gid and others) | Visit statistics and ad delivery. Appear only with consent. | Up to two years, set by Google |
Required cookies are not used for tracking and are not shared with anyone.
With consent, Google Analytics 4, Google Tag Manager and Google AdSense are loaded. These services belong to Google LLC and receive visit data: page address, referrer, device and browser type, IP address.
These services receive the IP address, browser and device details, and the address of the page being viewed. Google processes them under its own rules.
If you decline, none of the three scripts load — the code is not executed at all, rather than executed in a reduced form. Declining restricts nothing: every section works the same.
Data is not sold and is not passed on for marketing mailings. Only services without which the listed features would not work are involved.
Address confirmation and password reset messages are sent through Resend. It receives the recipient address, the name and the body of the message. Its infrastructure is located outside Russia.
Analytics and advertising — only with your consent, as described above.
Interface fonts are loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which therefore learn your IP address. This happens regardless of your answer to the banner, because the page does not render without the fonts.
The site and the database run on a server rented by the project owner. No third-party contractor is given access to the database.
Account data is kept for as long as the account exists. Deleting the account also deletes ratings, recipes, favourites, achievements and sign-in records — they are linked to the user record by cascade.
Address confirmation and password reset links are stored as hashes and expire. Rate-limit records are removed automatically once the window ends.
The connection runs over HTTPS and the domain is declared reachable only over the secure protocol. The password is stored as a bcrypt hash, not in the clear.
Administrative sections are restricted by role, and the sign-in and password recovery forms are rate limited. No site can guarantee full security, and promising it here would be untrue.
Everything listed here is available in the interface itself, without contacting the owner.
What is stored about you — name, email address, language, theme, ratings, recipes, favourites — is shown in the profile and its settings.
Name, language, theme and password can be changed in profile settings. Your own ratings and recipes can be edited or removed.
The delete-account button is in profile settings. Deletion is irreversible and removes all related content along with the record.
Consent for analytics and advertising can be changed in the block below at any time.
If any of this is unavailable, or you need a substantive answer, write to the address in the Contact section.
Your choice
No choice made yet — analytics and advertising are not loaded.
The page reloads after the change: scripts that already ran cannot be unloaded from the document.
The material is intended for people over 18. The site is not aimed at minors and does not knowingly collect their data. If an account is found to belong to a minor, it will be deleted on request.
This text is updated as the site itself changes; the revision date is given at the top of the page. Changes that affect consent for analytics will require confirming it again.
Questions and requests about data processing go to:
This is the only channel for data requests: there is no contact form on the site yet.