Privacy Policy

1. Who we are

Cup & Dial is run by Thomas Nairn, an individual based in the United Kingdom (“we”, “us”). We are the controller of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and you can reach us about anything in this policy at privacy@cupanddial.com.

2. What we collect

Your account

• Email address and password. Sign-in is handled by Google’s Firebase Authentication. Your password goes to Firebase and is never seen or stored by us. We keep your email address with your account so we can sign you in and send messages about your account. Firebase creates verification and password-reset links; Resend normally delivers those emails. If delivery is unavailable, Firebase may send them directly.
• Sign in with Apple or Google. If you choose one of these, Apple or Google confirms who you are and shares your email address and an account identifier with Firebase, and may also share your name and, for Google, a link to your profile picture. We only use the email address and identifier. If you use Apple’s Hide My Email, we receive a private relay address instead of your real one, and Apple forwards our emails to you.
• Account records: an account identifier, when the account was created, when you last used the service, and whether your email address is verified. After a deletion request, we keep a restricted hash of the account identifier and the request time temporarily to prevent recovery copies or old sign-in tokens from restoring the account.

Private testing and correspondence

• During private app testing, we kept a list of invited email addresses. The beta website is browse-only and does not offer account creation or sign-in.
• If you email contact@cupanddial.com with feedback or questions, or email us about anything else, we receive your message, your email address and anything else you choose to include.

Your profile

• The username you choose, an optional display name, and anything you add to your profile spotlight.

Your journal

• Your journal includes your collection, bags, purchase details, wishlist, recipes, brew logs (including their ratings and notes), photos and preferences. Your individual brew logs are not published to other users. You can choose to share details in a brew card or story image, as described in section 4. Selected details from synced brews may be used for the planned recommendations described below, subject to your account preference. Ratings, written reviews and bean tasting notes attached to community records are shared as described below.
• Without an account, the iPhone journal stays on your device and nothing you record in it is sent to us. The beta website is browse-only; account creation, sign-in and personal journals are accessed through the iPhone app.
• Once you sign in to an account with access to the service, new journal records are uploaded to your account so you can use them across devices. Existing records on your iPhone are uploaded only if you choose to import them. Importing also shares ratings, written reviews and bean tasting notes linked to community records, even if you recorded them privately before signing in. Records without a community link are not published when imported. The separate recommendation preference applies to synced brews whether or not you link a record to the community.

What you share with the community

• Coffees, roasters, producers, farms, cafés, recipes, gear, photos and corrections you submit to the shared catalogue.
• Ratings, tasting notes and written reviews of coffees, roasters, gear and cafés.
• Reports you make about reviews, and the accounts you block.

Information from your device

• Camera and photos (iPhone, optional). You can take or choose photos for coffee bags and gear. Guest photos stay on your device; photos you save while signed in are uploaded to your private journal. Community sharing is optional.
• Location (optional). Used to find cafés near you through Apple Maps. We don’t receive or store your location. If you add a café, we store the café’s name, address, map position and Apple Maps place identifier, not your location.
• Crash reports (iPhone, optional). Sharing is off by default. The app asks once, from its second launch, whether to share crash reports, and after a crash asks whether to send that report; reports stay on your iPhone until you answer. If you choose to share, or enable “Share crash reports” in Settings → Diagnostics, Firebase Crashlytics sends us crash reports: the technical details of the crash, your device model, operating system and app version, and a random identifier for the app installation. We do not attach your name, email address or journal to reports. Local-cache failures are reported as a fixed technical message, rather than the underlying error details. You can turn sharing off at any time; this deletes unsent reports on this iPhone. The choice applies to this device, including guest use, and does not affect app features. It does not delete reports already sent.
• Sign-in security and SDK information. Firebase Authentication and Google Sign-In process information needed to operate and secure sign-in, including account identifiers, IP addresses and technical device/app information. Google Sign-In may estimate a general location from your IP address to prevent fraud. Its SDK privacy disclosures also cover account/contact information, device identifiers, service-usage information and other technical information for functionality and analytics. Our app does not request phone access or use phone-number sign-in. Optional Firebase SDK usage telemetry is disabled; necessary authentication processing still takes place.
• Connection information. Like any website, our servers see your IP address and basic request details when you connect. We use these briefly to keep the service secure and to limit abusive traffic. We don’t store them in our database or use them to profile you.

3. Why we use it

The UK GDPR requires a lawful basis for each use of your personal information. Ours are:

You need to give us an email address to create an account; everything else is optional. We only use your information for the purposes described in this policy. We don’t use it for advertising, sell it, or make decisions about you based solely on automated processing that have legal or similarly significant effects. Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 8).

Planned brew recommendations and your choice

We may introduce brewing recommendations in the future, using results achieved with comparable coffees and equipment. The feature may not be introduced. This use has not started. Unless you turn off “Use my brews to improve recommendations” in Settings → Privacy, we plan to use selected details from your synced brews to develop and improve suggestions for you and other users. The setting is on by default and saved to your account across devices. Turning it off will not affect access to features available to your account or your ability to use your journal, and does not delete your brews.

The selected details are coffee characteristics, dose, water amount, brew time, water temperature, structured brewing method, equipment models and grind settings, overall ratings, sensory scores, extraction assessments and recognised tasting descriptors. We exclude timestamps, purchase details, photos and free-text journal notes, including outcome and adjustment notes, personal equipment names, and written method instructions. Custom tasting entries are included only if matched to recognised descriptors.

Recommendations will not show your name, username, account identifier or individual brew log. Removing those identifiers does not necessarily make the underlying information anonymous: we treat information that can still be linked to you as personal information. We may create combined statistics that cannot reasonably be linked back to a person, taking account of other information we hold.

Before this use starts, we will tell you in the app or by email, explain whether it includes existing or imported brews, and give you an opportunity to turn it off. Importing records or accepting our Terms is not consent to this use. We intend to rely on legitimate interests in developing and improving Cup & Dial’s brewing guidance. Before starting, we will assess the necessity of this use and balance that interest against your rights and reasonable expectations.

Turning the setting off will stop your brews being used for this purpose and remove recommendation records that can still be linked to you. Deleting a brew will remove its attributable recommendation records; deleting your account will remove all such records and your saved preference. Combined statistics may remain only where they are genuinely anonymous and we can no longer identify or remove an individual's contribution.

4. What other people can see

• Not published by syncing: your collection, wishlist and purchase details, individual brew logs and their ratings and notes, unlinked evaluations, journal photos you have not shared, your email address, and the accounts you block. Syncing these records does not publish them. You can choose to share details from a brew in an image, as explained below. Selected brew details may inform the planned recommendations described above, subject to your preference; your identity and individual log will not be shown in those recommendations.
• Public once approved: catalogue records and photos you submit.
• Public written reviews: when signed in, written reviews attached to community coffees, roasters, gear and cafés are public unless held or hidden for moderation. They display your username and optional display name, or “Anonymous” if you have no username or enable “Anonymous account” in Settings → Account → Profile privacy. Choosing a username also attributes your previously published reviews to it unless your account is anonymous. This setting applies to existing and future reviews, hides your public profile and spotlight, and disables profile sharing. Turning it off restores your public profile and review attribution without changing your username or spotlight selections. “Anonymous” reviews still have a stable author identifier for reporting and blocking, so reviews from the same account can be linked.
• Community ratings: ratings attached to community records count towards public averages and rating counts. Ratings without a written review appear only as totals, without your name. A rating accompanying a written review appears alongside that review.
• Community tasting notes: bean tasting notes linked to community coffees appear as counts without your name; new terms appear after moderation. Copying tasting notes from a private brew to a linked bean shares the copied notes, without publishing the brew log. The separate recommendation preference still applies to selected synced brew details.
• Your spotlight: your selected currently brewing coffee and optional recipe, all-time favourite and its note, and setup appear on your public profile when linked to public catalogue records. We show the linked catalogue details, not your private journal records, photos or purchase information. Items without a public catalogue link stay private.
• Your public profile: unless your account is anonymous, choosing a username makes a page available at cupanddial.com/@yourusername, even before you use Share. Anyone can open it without signing in through a shared link or your handle on a written review and see your username, optional display name, when you joined, spotlight and up to 100 recent published written reviews. It does not include your email address, Firebase account identifier, private journal or activity totals. Enabling “Anonymous account” makes the profile and existing profile links unavailable and disables profile sharing; you can still view and edit your own spotlight. Changing your username removes the old profile address; deleting your account removes the profile and its reviews. Other people may keep copies of public material they have already seen or shared.
• Reports: the person whose review you report isn’t told who reported it.

Before community photos are published, we re-encode them and remove their embedded metadata, including any location. Photos in your private journal are stored as you upload them.

Brew cards and story images

When you choose Share Brew, the app creates a PNG picture on your device in Card or Story format. We do not upload, host or review the generated image. Saving or sharing it does not publish your brew log or give recipients access to your journal.

Depending on the app, format and options, the picture can show the coffee name, roaster, process and origin, brew date, ratings and sensory scores, measurements, brewer, grinder and grind setting, recipe title, tasting notes, free-text brew notes and your username. Any map coordinates shown identify the coffee’s farm or producer, not your device’s location. Tasting notes, brew notes and your username are included by default when available; you can turn them off before sharing. Check the preview and the inclusion switches before saving or sharing. The username switch is separate from “Anonymous account”: that account setting does not automatically remove your username from a brew image.

The QR code links to the coffee’s public catalogue page, or to the Cup & Dial website if the coffee has no community link. It does not link to your private brew. On iPhone and the web, only the picture is shared: no caption, title or link text is added. The image goes to the people, apps or services you choose. Those services handle it under their own privacy policies and audience settings.

5. Who we share it with

We use these service providers to run Cup & Dial. Their processing includes providing, securing and maintaining the services described below:

• Google (Firebase Authentication and Firebase Crashlytics): sign-in, email verification, password resets and iPhone crash reports.
• Resend: delivers account verification and password-reset emails. It receives your email address and the message content, including the account action link. Firebase creates and validates those links.
• Oracle (Oracle Cloud Infrastructure): hosts our servers and database, where your account, profile, journal and community data are stored.
• Namecheap and Google (Gmail): email sent to our cupanddial.com addresses is forwarded by Namecheap to a Gmail mailbox, where we read and answer it.

Some features connect you directly to other services, which handle that information under their own privacy policies:

• Sign in with Apple and Sign in with Google, if you choose them.
• Apple Maps (iPhone and web): maps, café search, location lookup and directions. Apple receives map and search requests, including your IP address. If you choose “Near me”, your location is used to find nearby cafés.
• The App Store and links to roasters’ and cafés’ own websites.
• Apps and services you choose for brew image sharing: receive the exported picture, and anything you add yourself, when you send it to them through your device or browser’s share feature.

We may also disclose information if the law requires it, to protect someone’s safety, or to enforce our Terms. If Cup & Dial were ever transferred to someone else, your data would go with it under this policy, and we would tell you first.

6. Where your information is stored

Our servers and database are in the United States, and Google may process information in the United States and elsewhere, so your information is transferred outside the UK. These providers process it on our behalf under data processing terms. We protect these transfers with the UK–US data bridge, where the provider is certified to it, or with the UK’s International Data Transfer Addendum to the standard contractual clauses. We remain responsible for your information wherever it is processed.

7. How long we keep it

• While you have an account: we keep your account, profile, journal and recommendation preference until you delete them. The planned recommendation records and any anonymous statistics are handled as described above.
• When you delete your account (Settings → Account → Delete account), we delete your sign-in account, email address, profile and username, your whole journal and its photos, your ratings, tasting notes and reviews (and recalculate the averages), your pending submissions, corrections and photos, your blocks, the reports you made, and reports about your reviews.
• What stays after deletion: catalogue records and photos a moderator has already published, and café records you were first to add. These stay part of the shared catalogue with your account attribution removed. If the content itself identifies you, contact us about removing personal information.
• Saved or shared brew images: copies in your photo library, downloads, messages or other services remain there until removed separately. Editing or deleting a brew, changing your username, enabling “Anonymous account” or deleting your Cup & Dial account does not update or remove those copies. We cannot recall images you have sent; recipients and services may keep or share them further.
• Invitation records from private testing are kept until we retire the invitation list. Deleting your account doesn’t remove you from it, but we will if you ask.
• Emails you send us are kept for as long as we need them to deal with your message and any follow-up.
• Provider retention: deleting your Firebase sign-in account initiates the provider’s deletion process; Firebase states authentication information is removed from its live and backup systems within 180 days after deletion is initiated. Authentication IP logs are kept for a few weeks. Crashlytics keeps crash traces and associated identifiers for 90 days before starting removal from live and backup systems.
• Backups: deleted data may remain in restricted recovery copies until they expire. Nightly database dumps are scheduled to expire after 14 days; manual and release recovery copies after 30 days, with expiry checked hourly. Before bringing a restored copy back into service, we reapply account deletions made after that copy was created.
• Deletion protection: a restricted hash of the account identifier and deletion-request time are kept separately from database backups for up to 36 days to prevent an account being restored. This record is still treated as personal information. It is not used for advertising or recommendations.

8. Your rights

Under the UK GDPR, and wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you (access);
• give you the information you provided in a portable, machine-readable format, or send it to another service (portability);
• correct information that is wrong or incomplete (rectification);
• delete your information (erasure; you can do most of this yourself by deleting your account);
• limit how we use your information while a concern is looked into (restriction);
• stop using your information where we rely on legitimate interests (objection);
• withdraw a consent you gave, at any time, without affecting what we did before.

Email privacy@cupanddial.com from the address on your account. We will respond within one month; if a request is complex we may need up to two more months, and we will tell you if so. If you’re unhappy with how we’ve handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. If you live outside the UK, you may have further rights under your local law, and you can contact your local data protection authority.

9. Cookies and browser storage

The web app uses your browser’s storage only for things it needs to work: keeping you signed in (Firebase Authentication) and remembering display choices, including your brew image format and inclusion switches. The iPhone app also remembers those sharing choices on the device. This storage is strictly necessary for the service you ask for, so it doesn’t need your consent. We don’t use advertising or analytics cookies. Your separate choice about using synced brews for planned recommendations is in Settings → Privacy.

10. Age limit

Cup & Dial is for adults: you must be 18 or older to create an account. We don’t knowingly collect personal information from anyone under 18. If you think someone under 18 has given us personal information, email privacy@cupanddial.com and we will delete their account and information.

11. Security

All connections to Cup & Dial are encrypted (HTTPS). Every request that reads or changes your data must prove who is signing in, and access to our servers and database is restricted. No service can promise perfect security. If a privacy breach is likely to cause you serious harm, we will tell you without undue delay, and we will report breaches to the Information Commissioner’s Office where the law requires.

12. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.