Privacy Policy
Last updated: September 7, 2026
This Privacy Policy applies to both the Cuppd website and the Cuppd mobile app (iOS and Android), collectively "the service".
1. Data Controller
The data controller responsible for your personal data is:
2. What Data We Collect
Account data
When you register, we collect your email address. We do not collect your name, phone number, or any other personal information. Your password is hashed and never stored in plain text.
Usage data (analytics)
We use Google Analytics 4 to understand how the app is used. It collects data such as pages visited, session duration, device type, and approximate location derived from your IP address. This data is processed by Google and is subject to Google's Privacy Policy. Analytics are only enabled if you give consent.
Crash diagnostics (mobile app only)
If the Cuppd mobile app crashes or hits an unexpected error, an automatic report is sent to Sentry so we can fix it. The report contains the error message and stack trace, the app version, your device model and operating system version, and a random identifier for the app installation. It does not contain your email address, your account ID, or your IP address, and it is never used to analyse your behaviour or to build a profile.
User-generated content
Reviews and coffee suggestions you submit are stored and associated with your account.
Coffee bag photos (mobile app)
The mobile app lets you photograph a coffee bag — using the camera or your photo library — to look it up in our catalog. The photo is sent to our AI vision provider to read the text on the packaging (roaster, coffee name, origin). We do not store the photo on our servers: it is processed and then discarded. The camera and photo library are only accessed when you actively choose to scan a bag.
3. Purpose and Legal Basis
We process your email address to provide and secure your account (legal basis: performance of a contract, Article 6(1)(b) GDPR).
We process analytics data only with your explicit consent (legal basis: consent, Article 6(1)(a) GDPR). You can withdraw your consent at any time using the controls below.
We process crash diagnostics from the mobile app to keep the app stable and secure (legal basis: legitimate interests, Article 6(1)(f) GDPR). These reports carry no identifiers that let us link them to you.
We process coffee bag photos, including transferring them to our AI vision provider outside the EU, only when you actively choose to use the bag-scanning feature (legal basis: consent, Article 6(1)(a) and Article 49(1)(a) GDPR — see "Data Storage and Third Parties" below).
4. Data Storage and Third Parties
Your account data is stored by Supabase, Inc., our database and authentication provider. Supabase stores data on servers located in the European Union. For more information, see supabase.com/privacy.
If you choose to sign in with Google, Google may collect and process data according to its own privacy policy. We only receive the email address associated with your account from Google.
Analytics data is processed by Google LLC via Google Analytics 4 (web only — the mobile app does not use Google Analytics or any other analytics tool; the only data it sends automatically is the crash diagnostics described below). Google may transfer data to servers outside the EU. No data is shared with advertising networks or sold to third parties by Cuppd.
Crash diagnostics from the mobile app are processed by Functional Software, Inc. (Sentry). We use Sentry's EU data region, so these reports are stored on servers located in the European Union. For more information, see sentry.io/privacy.
If you use the mobile app's bag-scanning feature, the photo is sent to DeepSeek, our AI vision provider, to read the text on the packaging. DeepSeek is based outside the EU/EEA in a country the European Commission has not recognised as providing an adequate level of data protection. We rely on your explicit consent (Article 49(1)(a) GDPR) — given by choosing to use this optional feature — as the legal basis for this transfer. The photo is not stored by Cuppd; DeepSeek processes it to extract the label text and does not receive any other information about you. If you would rather not use this transfer, you can always search the catalog by typing instead.
5. Data Retention
Your account data is retained for as long as your account exists. When you delete your account, your email address and all associated data are permanently deleted immediately. This action cannot be undone.
Crash diagnostics are deleted by Sentry 90 days after the report is received.
6. Cookies
Strictly necessary: We use a single session cookie to keep you logged in. This cookie is required for the service to function and does not require consent.
Analytics (optional):If you consent, Google Analytics 4 sets cookies to measure usage. These cookies are only placed after you click "Accept" in the cookie banner. You can withdraw consent at any time below.
7. Your Rights Under GDPR
As a user in the EU, you have the following rights under the General Data Protection Regulation:
- Access— request a copy of the data we hold about you
- Rectification— ask us to correct inaccurate data
- Erasure— request deletion of your personal data
- Restriction— ask us to limit processing in certain circumstances
- Portability— receive your data in a portable format
- Objection— object to processing based on legitimate interests
To exercise any of these rights, contact us. You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) at naih.hu.
8. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a notice within the service. The date at the top of this page indicates when the policy was last revised.
9. Contact
For any questions or requests regarding this Privacy Policy, please reach out via our contact form.