Privacy policy

• Your account — name, email address and a password (stored only as a one-way hash). If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• Your profile — the username you choose and a profile photo, if you upload one.
• Your brewing — the coffees you add, every brew's recipe, your taste ratings, tasting notes and scores, and your equipment and water settings.
• Photos — a coffee bag photo when you use the camera to add a coffee, a coffee image you take or choose from your device, and your profile photo.
• Sign-in and security — when you last signed in, and your IP address while a request is being checked against our rate limits.
• Error reports — when something breaks, a report of the error and the page it happened on.

Once you've scored 3 brews of a coffee, or marked one dialled in, that coffee's brewing journey appears on the public site: the coffee, your recipes, scores and tasting notes, your username (or first name, if you haven't chosen one) and your profile picture. If you haven't uploaded one, the picture comes from Gravatar, which is looked up with a hash of your email address.

Your email address is never shown publicly. Your other coffees and brews stay private.

To have a public journey taken down, contact us (below).

• To run the app — your recipes, brew history, and the suggestion for your next brew.
• To improve the suggestions for everyone. We analyse brews across all users together — what was changed between one brew and the next, and what that did to the taste — to learn which changes actually fix which problems. What comes out is aggregate patterns, like how much a coarser grind tends to reduce bitterness; nothing in them identifies you, and no one else can see your private brews.
• To send the emails the account needs — verifying your address, resetting a password, and confirming changes to your account.
• To keep the service secure and working — rate limiting, and diagnosing errors.

These services process data on our behalf, only to run Cuplift:

• Vercel — hosts the app and stores uploaded photos.
• Neon — our database.
• Anthropic — reads the coffee product pages you import, and coffee bag photos, to fill in the coffee's details.
• Resend — sends our emails.
• Sentry — collects error reports.
• Upstash — rate limiting, which uses your IP address.
• Google — only if you choose to sign in with Google.
• Gravatar — supplies a profile picture from a hash of your email address when you haven't uploaded one.
• Jina — when a coffee product page can't be read directly, we fetch it through Jina's reader. It receives the page address, not anything about you.

We use a session cookie to keep you signed in and a cookie that remembers your light or dark theme. Both are needed for the site to work.

Vercel's anonymous analytics only run if you choose Accept all on the cookie banner. There's no advertising and no cross-site tracking.

We keep your data while you have an account. You can delete your account at any time from Settings: that removes your account, profile photo, brews and coffee list, and takes your public journeys down.

A coffee photo you uploaded may stay on as that coffee's image, since coffees are shared between everyone who brews them. Aggregate patterns already learned from brews (see above) don't identify you and aren't removed.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it, and you can object to how we use it. Contact us and we'll respond.

Questions or requests: message us on Instagram at @cuplift_.

If this policy changes, we'll update it here and change the date at the top.