Privacy Policy

Information you provide

• Account information. When you sign in, we collect your email address to send a one-time login code. If you claim a username, we store it as part of your profile.
• User content. Drink ratings (1–5), written reviews, favorites, photos, and other content you contribute.
• Communications. Messages you send to us (e.g., support requests, feedback).

Information collected automatically

• Session identifiers. We assign an anonymous session ID (a random UUID stored in your browser’s localStorage) so you can rate drinks without an account.
• Usage data. Pages viewed, features used, referring URLs, and approximate timestamps.
• Server-side network identifiers. For security, abuse prevention, and rate limiting, our servers may derive your client IP address from request headers. We store HMAC-derived rate-limit bucket keys rather than raw IP addresses, and may forward your client IP address to Supabase Auth when sending one-time login codes.
• Location input. City or ZIP code you enter to find nearby cafes. We do not collect GPS coordinates unless you explicitly grant your browser’s location permission.

Information from third parties

• Cafe and product data. Business names, addresses, photos, and menus from Google Places and similar public sources.
• Map tiles. Mapbox serves map imagery and receives your IP address as part of loading maps.

• Operate, maintain, and improve the Service (including showing you nearby cafes, trending drinks, and personalized favorites).
• Authenticate you via email one-time passcodes.
• Display your ratings, reviews, favorites, and username publicly on your profile and in aggregate rankings.
• Prevent fraud, spam, and abuse, including enforcing rate limits and investigating suspicious activity.
• Respond to your requests, questions, and feedback.
• Comply with legal obligations and enforce our Terms of Service.

CupScope is a community-driven discovery platform. The following information is public by default and viewable by anyone, including search engines:

• Your username and public profile at cupscope.com/myfavs/your-username, which shows the drinks & products you've favorited along with your rating and review for each.
• Ratings, written reviews, and favorites you submit.
• Any photos or other media you attach to a review.

Your email address is not public. Do not include sensitive personal information in reviews or usernames.

We do not sell your personal information. We share it only with:

• Service providers that help us run the Service, bound by confidentiality and data-protection obligations:
  • Supabase — database hosting and authentication.
  • Google (Places API) — cafe discovery and photos.
  • Mapbox — map rendering.
  • Email delivery providers — sending login codes.
• Legal and safety — to comply with law, respond to legal process, enforce our Terms, or protect the rights, property, or safety of CupScope, our users, or others.
• Business transfers — in connection with a merger, acquisition, reorganization, or sale of assets, with notice to affected users where required.
• With your consent — for any other purpose disclosed at the time of collection.

We use browser localStorage and cookies to keep you signed in, remember your anonymous session ID, store your selected theme (matcha / coffee / tea), and remember preferences such as your selected city. We do not use third-party advertising cookies.

You can clear local storage and cookies from your browser settings. Doing so may sign you out and reset anonymous ratings tied to your session.

• Account data is retained while your account is active and for a reasonable period after you request deletion to comply with legal and audit requirements.
• Ratings and reviews remain on the Service unless you delete them or request account deletion.
• Anonymous session IDs tied to anonymous ratings are retained to protect the integrity of public ratings; we may aggregate or anonymize them over time.
• Rate-limit records store HMAC-derived bucket keys rather than raw IP addresses, emails, user IDs, or session identifiers, and are retained only as needed to enforce anti-abuse limits. Stale shared rate-limit buckets are eligible for cleanup after roughly two days of inactivity.
• Logs are typically retained for up to 90 days unless a longer period is needed for security investigations.

Everyone

You can: (a) access the information in your profile, (b) edit or delete your ratings and reviews, (c) request deletion of your account, and (d) unsubscribe from non-essential emails.

California residents (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, to correct inaccuracies, and to opt out of “sales” or “sharing” of personal information. We do not sell or share personal information for cross-context behavioral advertising. You may exercise these rights by contacting us at the address below. We will not discriminate against you for exercising your rights.

EU / UK / EEA residents (GDPR)

You have the right to access, rectify, erase, restrict, or object to our processing of your personal data, as well as the right to data portability and to lodge a complaint with your local data-protection authority. Our lawful bases for processing are: (i) performance of a contract (providing the Service), (ii) our legitimate interests (fraud prevention, improving the Service), and (iii) your consent where required.

To exercise any right, email us at privacy@cupscope.com. We may ask you to verify your identity before responding.

We use industry-standard practices to protect your information, including encryption in transit (HTTPS), database row-level security, and access controls on our production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach that affects your information, we will notify you as required by law.

The Service is intended for users who are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will promptly delete it.

CupScope is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may have data-protection laws different from those in your country. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, notify you by email or via an in-app notice. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

Questions, requests, or complaints? Reach us at privacy@cupscope.com.