Privacy Policy
Last updated: October 31, 2026
This Privacy Policy applies to both the Cuppd website and the Cuppd mobile app for iOS, collectively "the service". The website has no user accounts: registration, ratings, reviews and lists exist only in the app.
1. Data Controller
The data controller responsible for your personal data is:
2. What Data We Collect
Account data
When you register in the mobile app, we collect your email address. If you sign in with Apple and choose to share your name, we store that too. We do not collect your phone number or any other personal information. Your password is hashed and never stored in plain text.
Usage data (analytics)
We use Google Analytics 4 to understand how the website is used. It collects data such as pages visited, session duration, device type, and approximate location derived from your IP address. This data is processed by Google and is subject to Google's Privacy Policy. Google Analytics is only enabled if you give consent.
Visit counts (Cloudflare Web Analytics)
On the website we also count page views with Cloudflare Web Analytics, for every visitor. It sets no cookies, stores nothing on your device and does not fingerprint your browser. It records the page visited, the referring page and basic browser and device type; Cloudflare does not store your IP address. We see only aggregate counts and cannot identify individual visitors.
Crash diagnostics (mobile app only)
If the Cuppd mobile app crashes or hits an unexpected error, an automatic report is sent to Sentry so we can fix it. The report contains the error message and stack trace, the app version, your device model and operating system version, and a random identifier for the app installation. It does not contain your email address, your account ID, or your IP address, and it is never used to analyse your behaviour or to build a profile.
User-generated content
Reviews you submit in the mobile app are stored and associated with your account. Coffee suggestions, data error reports and review reports are sent as an email from your own mail app to cuppdapp@proton.me; we receive your email address with them and use it only to reply. We do not store them in our database.
Coffee bag photos (mobile app)
The mobile app lets you photograph a coffee bag — using the camera or your photo library — to look it up in our catalog. The photo is sent to our AI vision provider to read the text on the packaging (roaster, coffee name, origin). We do not store the photo on our servers: it is processed and then discarded. The camera and photo library are only accessed when you actively choose to scan a bag.
3. Purpose and Legal Basis
We process your email address to provide and secure your account (legal basis: performance of a contract, Article 6(1)(b) GDPR).
We process Google Analytics data only with your explicit consent (legal basis: consent, Article 6(1)(a) GDPR). You can withdraw your consent at any time using the controls below.
We count page views with Cloudflare Web Analytics to know how much the website is used (legal basis: legitimate interests, Article 6(1)(f) GDPR). The counts are aggregate and carry no identifiers that let us link them to you.
We process crash diagnostics from the mobile app to keep the app stable and secure (legal basis: legitimate interests, Article 6(1)(f) GDPR). These reports carry no identifiers that let us link them to you.
We process coffee bag photos, including transferring them to our AI vision provider outside the EU, only when you actively choose to use the bag-scanning feature (legal basis: consent, Article 6(1)(a) and Article 49(1)(a) GDPR — see "Data Storage and Third Parties" below).
4. Data Storage and Third Parties
Your account data is stored by Supabase, Inc., our database and authentication provider. Supabase stores data on servers located in the European Union. For more information, see supabase.com/privacy.
If you choose to sign in to the mobile app with Google, Google may collect and process data according to its own privacy policy. We only receive the email address associated with your account from Google.
If you choose to sign in to the mobile app with Apple, Apple processes your sign-in according to its own privacy policy. We receive an email address, an identifier Apple creates for Cuppd and, if you choose to share it, your name. If you choose "Hide My Email", that address is a private relay address from Apple, and we never see your real one. Your name is stored with your account data and is not shown to other users.
Analytics data is processed by Google LLC via Google Analytics 4 (web only — the mobile app does not use Google Analytics or any other analytics tool; the only data it sends automatically is the crash diagnostics described below). Google may transfer data to servers outside the EU. No data is shared with advertising networks or sold to third parties by Cuppd.
Website visit counts are processed by Cloudflare, Inc. via Cloudflare Web Analytics. Cloudflare may process your request on servers outside the EU and is certified under the EU–U.S. Data Privacy Framework. For more information, see cloudflare.com/privacypolicy.
Crash diagnostics from the mobile app are processed by Functional Software, Inc. (Sentry). We use Sentry's EU data region, so these reports are stored on servers located in the European Union. For more information, see sentry.io/privacy.
If you use the mobile app's bag-scanning feature, the photo is sent to DeepSeek, our AI vision provider, to read the text on the packaging. DeepSeek is based outside the EU/EEA in a country the European Commission has not recognised as providing an adequate level of data protection. We rely on your explicit consent (Article 49(1)(a) GDPR) — given by choosing to use this optional feature — as the legal basis for this transfer. The photo is not stored by Cuppd; DeepSeek processes it to extract the label text and does not receive any other information about you. If you would rather not use this transfer, you can always search the catalog by typing instead.
5. Data Retention
Your account data is retained for as long as your account exists. When you delete your account, your email address and all associated data are permanently deleted immediately. This action cannot be undone.
Crash diagnostics are deleted by Sentry 90 days after the report is received.
6. Cookies
Strictly necessary:The website has no sign-in and sets no cookies of its own. It remembers your theme, your cookie choice and a dismissed app banner in your browser's local storage; these never leave your device. The mobile app keeps you signed in with a session stored on your device, not with a cookie.
Analytics (optional):If you consent, Google Analytics 4 sets cookies to measure usage. These cookies are only placed after you click "Accept" in the cookie banner. You can withdraw consent at any time below.
Visit counts: Cloudflare Web Analytics uses no cookies or other on-device storage, so it runs without the cookie banner.
7. Your Rights Under GDPR
As a user in the EU, you have the following rights under the General Data Protection Regulation:
- Access— request a copy of the data we hold about you
- Rectification— ask us to correct inaccurate data
- Erasure— request deletion of your personal data
- Restriction— ask us to limit processing in certain circumstances
- Portability— receive your data in a portable format
- Objection— object to processing based on legitimate interests
To exercise any of these rights, email us at cuppdapp@proton.me. You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) at naih.hu.
8. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a notice within the service. The date at the top of this page indicates when the policy was last revised.
9. Contact
For any questions or requests regarding this Privacy Policy, please email us at cuppdapp@proton.me.