This Privacy Policy explains how Craft & Cup (the “Service”), operated by [legal operator name] (“we,” “us,” or “our”), collects, uses, and shares information when you use the Service. By using Craft & Cup, you agree to the practices described here.
1. Information we collect
Account information
You sign in through Google or Discord. When you do, we receive basic account information from that provider - typically your email address, name, a provider account identifier, and (if available) an avatar image. We do not receive or store your password for those providers.
Profile and content you create
We store the content you add to build your journal: your screenname and display name, beans, recipes, tasting notes, scores, brew details, collections, and any photos you upload. Photos you upload are stored in our image storage and served through public URLs, which means an image can be viewed by anyone who has its link. Content you mark as public - including your public profile - may be visible to anyone on the internet.
Social activity
If you use social features, we store your friend connections, items you share, feed activity, and messages you send or receive through the in-app inbox.
Usage and device information
We use Vercel Analytics and Vercel Speed Insights to understand how the Service is used and to monitor performance. These collect aggregated, privacy-conscious information such as page views, referrers, approximate location derived from your IP, and general device and browser type. We use this to improve the Service, not to build advertising profiles.
Local storage on your device
The Service stores small amounts of data in your browser (for example, your theme preference, dismissed prompts, and your sign-in session). This stays on your device and is used to keep the app working and remember your preferences.
2. How we use your information
- To provide and operate the Service - your account, journal, brews, and social features;
- To generate flavor profiles from your tasting notes (see the next section);
- To keep the Service secure, prevent abuse, and troubleshoot problems;
- To understand usage and improve performance and features; and
- To communicate with you about the Service where necessary.
3. AI processing of your tasting notes
When you ask Craft & Cup to build a flavor profile, the relevant text you entered (such as your tasting notes or recipe ingredients) is sent to a third-party AI provider ([name of AI provider]) which processes it and returns a flavor mapping. We send only the text needed for that feature. Please review that provider’s practices for details on how they handle data; you can find their policy at [link to AI provider policy].
4. How we share information
We do not sell your personal information. We share information only as follows:
- Service providers (subprocessors) that run the Service on our behalf: Supabase (authentication, database, and image storage), Vercel (hosting and analytics), your sign-in provider (Google or Discord), and our AI provider for flavor analysis;
- Other users, when you choose to share content, add friends, send messages, or make content public;
- Legal and safety reasons, when we reasonably believe disclosure is required by law or necessary to protect the Service, our rights, or people’s safety; and
- In a business transfer, such as a merger or acquisition, in which case we will take reasonable steps to protect your information.
5. Cookies and local storage
We use browser local storage and the cookies necessary for sign-in and core functionality, plus the privacy-conscious analytics described above. We do not use third-party advertising cookies. You can clear local storage and cookies in your browser settings, though doing so will sign you out and reset your preferences.
6. Data retention
We keep your information for as long as your account is active or as needed to provide the Service. When you delete content or your account, we delete or de-identify the associated personal information within a reasonable period, except where we need to retain it to comply with legal obligations, resolve disputes, or enforce our agreements, and except for content you have already shared with others.
7. Security
We use reasonable technical and organizational measures - including reputable infrastructure providers and access controls - to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
8. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. You can edit much of your information directly in the app, and you can request account deletion or a copy of your data by contacting us at [contact email]. We will respond consistent with applicable law. If you are in the EU/UK, our legal bases for processing include performing our contract with you, your consent (which you may withdraw), and our legitimate interests in operating and improving the Service.
9. Children’s privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.
10. International users
We and our service providers may process and store information in countries other than yours, including the United States. Where required, we take steps to ensure appropriate protections for international transfers of personal information.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after changes take effect means you accept the updated policy.
12. Contact
Questions or requests about your privacy? Reach us at [contact email].