Privacy Policy

1What we collect

2How we use your data

We use your data to provide and operate the Service, personalise your coffee recommendations, sync your data across devices, respond to support requests, and improve the Service using aggregated anonymised patterns. We do not use your data for advertising, profiling for third-party purposes, or automated decision-making.

3Who we share it with

We do not sell your data. We share data only with the processors needed to operate the Service: Supabase (database and authentication, US), Expo/EAS (app delivery and diagnostics, US), Cloudflare (R2 storage for photos you upload), Google Places API (location for the map feature), Google Fonts and Fontshare (font delivery — your IP address is transmitted to load fonts on this website), and Apple and Google (email address on sign-in only). Each processor operates under a Data Processing Agreement. We do not share data with any other parties unless required by law.

4Keeping and deleting your data

We retain your account and all associated content for as long as your account is active. You can delete your account yourself in the app (Profile tab, Account, "Delete account"); this permanently deletes your account, your data and the photos you attached to submissions straight away, except where retention is required by law. A photo that has already been published as a coffee's picture belongs to the shared coffee catalogue and is not linked to your account, so it stays on that coffee's page; email us to ask for a specific one to be removed. If you cannot use the app, you can request deletion within 30 days: visit https://www.koffeeapp.xyz/delete-account; to request deletion of specific data without closing your account, visit https://www.koffeeapp.xyz/delete-data. You can also email hi@jannickholm.dk with the subject "Delete my account" or "Delete my data".

5Your rights

To exercise any of these rights, email hi@jannickholm.dk. We will respond within 30 days (GDPR) or 45 days (CCPA).

6Cookies

The Koffee mobile app does not use cookies. The website at koffeeapp.xyz uses only essential session cookies required for authentication. No advertising or tracking cookies are used.

7Security

All data in transit is encrypted with TLS 1.2 or higher. Plaintext passwords are never stored — Supabase Auth stores only a salted cryptographic hash. Access to production data is restricted to authorised personnel only, and Supabase Row-Level Security ensures users can only access their own data.

8International data transfers

Our primary data processor (Supabase) stores data in the United States. If you are located in the EU/EEA, your data is transferred to the US under Standard Contractual Clauses as provided by Supabase's Data Processing Agreement.

9Children

Koffee is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact hi@jannickholm.dk and we will delete it promptly.

10Changes to this policy

We will post any changes to this page and update the "Last updated" date. For significant changes we will notify users via an in-app notice. Continued use of the Service after an update constitutes acceptance of the revised policy.

11Geographic access (EU Geo-blocking Regulation)

Koffee complies with Regulation (EU) 2018/302 on unjustified geo-blocking and other forms of discrimination based on customers' nationality, place of residence, or place of establishment within the EU/EEA. We do not block or restrict access to the Service, apply different general conditions of access, or automatically redirect users based on their location within the EU/EEA. All features, content, and pricing conditions are equally available throughout the EU/EEA.

12Contact

hi@jannickholm.dk — koffeeapp.xyz