Privacy policy

What we collect & why

Account & sign-in

When you sign in we store your email address to send a magic-link and identify your account. Authentication is handled by Supabase (our database and auth provider).

Profile & taste

Your optional display name and avatar, the beans you rate, and a derived "taste profile" (a summary of your flavour preferences) used to personalise recommendations. You provide this by using the app; it's tied to your account and removed if you delete it.

Ratings & recommendations

Your 1–5 star ratings power both community averages and your personal recommendations. We process them to compute your taste profile and suggest beans you're likely to enjoy.

Privacy-first analytics

To understand which beans and roasters people are interested in (and to show roasters anonymised, aggregate interest), we record page and bean/roaster views, searches, and clicks through to roasters' shops. This works in two layers:

• Anonymous totals — simple counts (e.g. "142 views") with no identifier linking them to a person. This is not personal data and is always on.
• Linked behaviour — to count unique visitors and reconstruct journeys, we use a daily-rotating, anonymised visitor signature (it can't be traced across days) and, for signed-in users, your account. This layer is what the opt-out above turns off.

We do not use cookies for analytics, never store your raw IP address (it's used only momentarily to derive the anonymous signature and an approximate country, then discarded), use no third-party tracking or advertising scripts, and never sell your data. Our legal basis is legitimate interest for the privacy-preserving anonymous layer, and — for signed-in detail — the terms you accept when you create an account.

Campaign links & QR codes

When you arrive from one of our campaign links or a QR code (for example from a business card or a social post), the link carries a short campaign code (like ?c=coffeeconf). We store that code in your browser and attach it to your activity so we can measure which channels bring people to KnowYourBeans. The code identifies the campaign, not you — it is not personal data — and it's part of the linked-behaviour layer, so the analytics opt-out above turns it off. It is cleared from your browser after 30 days.

Cookies & local storage

We use a first-party cookie only to keep you signed in, a small browser-storage flag to remember your analytics opt-out choice, and — if you arrive from a campaign link — a short-lived flag holding that campaign code (cleared after 30 days). We do not set advertising or cross-site tracking cookies.

Who processes your data

Supabase hosts our database and authentication. Cloudflare serves the site and provides an approximate country from your connection. These are infrastructure providers acting on our behalf — not advertisers. We do not share your data with ad networks or data brokers.

How long we keep it

• Raw analytics events are deleted automatically after 90 days.
• Anonymous aggregate counts (no personal data) are kept indefinitely.
• Account, profile, and rating data are kept until you delete your account.
• A campaign code from a referral link or QR is cleared from your browser after 30 days.

Your rights

You can access, correct, export, or delete your personal data. Deleting your account removes your profile, ratings, and taste profile, and unlinks your past analytics (the anonymous counts remain). To exercise any of these, contact us below.

Children

KnowYourBeans is not directed at children under 16 and we do not knowingly collect their data.

Changes

We'll update this page when our practices change and revise the "last updated" date above.

Contact

Questions or requests: privacy@knowyourbeans.app. See also our terms.