Privacy Policy · Cupd app

This policy covers the Cupd app (iOS, Android and my.cupd.app). For the website cupd.app, see the website privacy policy.

Last updated: October 2026

1. Controller

The controller responsible for data processing in the Cupd app is:

Maximilian
Germany

Privacy contact: perfect@cupd.coffee

2. Overview

Cupd is a community app for specialty coffee. We only process the data needed to run the app. We do not sell data, do not use advertising identifiers, do not perform cross-app tracking, and do not embed any third-party analytics SDKs.

3. What Data We Process: Purposes and Legal Bases

3.1 Account Data

When you sign up, we process your email address (sign-in via email/password, Google or Apple login), username, display name, bio, and uploaded avatar and cover photos.

Purpose: providing your account and the app's features.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).

If you sign in with Google or Apple, that provider learns about the login event. Its privacy policy applies in addition. From Google we request only the default scope (email address and basic profile), no other Google data such as contacts, calendar or Drive. From your Google or Apple account we take your name as your display name and, if the provider supplies one, your profile picture as your avatar when you sign in. You can change both in the app afterwards.

Cupd is meant for people aged 16 or older. When you sign up, you confirm with a checkbox that you are at least 16. If you create a new account with Apple or Google without having seen the checkbox, the app asks right after you sign in. We store the time of this confirmation (Art. 7(1) and Art. 8 GDPR) until you delete your account. For email sign-up this is the time of your first sign-in after you confirm your email address.

3.2 Content You Create

This includes: café ratings (stars and text, "Cupping Notes"), posts (articles, recipes, shots), comments, equipment and bean reports, likes, favorites, follows, brew logs, your stash (saved coffees and recipes, also with photos), upkeep entries, event RSVPs, loyalty stamp cards (stamp count and scans at the counter), and your taste profile (preferences).

From your interactions we also derive tag affinities (e.g. "interested in filter coffee") to show you more relevant content.

Purpose: core app features (rating, sharing, personalization).
Legal basis: Art. 6(1)(b) GDPR. For derived tag affinities used for personalization: Art. 6(1)(f) GDPR (legitimate interest in a relevant, useful app).

Note: your public content (ratings, posts, comments, profile name, avatar) is visible to other users of the app.

3.3 Usage Data (Analytics)

We record app events: app open and session duration, views of profiles and café pages, and taps on directions and bean-shop links (affiliate). These events are linked to your account ID.

Purpose: improving the app and providing aggregated statistics only to café and roaster operators (e.g. "your café was viewed 120 times this week"). We never share individual profiles or personal usage data with third parties.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in product improvement and operating the platform).

Objection: you can disable analytics collection at any time via the opt-out toggle in the app settings (see Section 8).

3.4 Location Data

If you grant location permission, the app uses your precise GPS position on your device to calculate distances to cafés, only while the app is in the foreground. Your coordinates are not transmitted to our servers and not stored. You can revoke the permission at any time in your device's system settings.

Legal basis: Art. 6(1)(a) GDPR (consent via the operating system's permission dialog).

Coarse area cell with filters: If you pick a filter on the home screen, we store the filter value, together with a coarse area cell if location permission is granted (geohash, level 5, about 2.4 by 4.9 kilometres). The row carries no account ID. We do not store free-text search terms.

Purpose: aggregated insights into what is searched for where.
Legal basis: Art. 6(1)(f) GDPR. You can object: the toggle in the app settings (Section 8) also switches off this collection.

3.4a Location-based nearby offers (separate opt-in)

In addition to the purely local use described in 3.4, you can separately consent to the app detecting which cafés you come near, so those cafés can offer you discounted coffee during their "Quiet Hours" even if you have not favorited that café. This consent is independent, off by default, and you choose between "Always allow", "Only while using Cupd", or decline.

What is actually processed: not your coordinates, but the IDs of the cafés you came near, each with the time of the last report. That is significantly less information than a stored position, but it remains personal data (pseudonymized, not anonymized): the set of cafés associated with you can narrow down where you are, in areas dense with cafés to a few streets, possibly to your home if a café is within reach there. Only the currently valid set is stored (no location history), automatically deleted after at most 7 days without a new report. Because reports are renewed continuously, they can still show over time where you have been.

Revocation: anytime via the "Coffee deals nearby" toggle in the app's Settings. Revoking deletes all café associations stored for you immediately, independent of the general location permission in your device's system settings.

Legal basis: Art. 6(1)(a) GDPR (separate consent, independent of 3.4). As proof, we store when you agreed to which version of this text, for as long as your account exists.

3.5 Sponsorship and Campaigns (B2B)

For advertising partners (e.g. roasteries) we process business contact details. For sponsored placements in the app, we record impression and click events linked to your account ID, guest ID or session ID, including for frequency capping (so you don't see the same placement too often).

To pay for an approved sponsorship, we create a payment link at Stripe (amount, business name, campaign ID). You enter payment details directly with Stripe. From a payment we store only the event and session IDs and the result. We send the link through Resend to the email address of the owner account.

Legal basis: Art. 6(1)(b) GDPR (towards advertising partners), Art. 6(1)(f) GDPR (campaign measurement and frequency capping). There is no personalized ad targeting based on third-party profiles and no cross-app tracking.

3.6 AI Features (Anthropic)

For several features we send data to Anthropic (Claude), an external AI provider. You always see the result for review before anything is saved to your account.

Your account ID, email address and name are not sent. If you write them into a question or show them in a photo, they are part of the request.

Stored by us: we do not store photos or question texts in our database. For each request we store only one row for the monthly quota (time, status and, for recipe suggestions, bean, method and recipe values).

Purpose: saving manual entry and providing recipe suggestions.
Legal basis: Art. 6(1)(b) GDPR (processing carried out at your request). Anthropic is based in the USA, see Section 4.2.

3.7 Use Without an Account (Guest Account)

Without an account the app creates an anonymous guest account with our sign-in service Supabase (Section 4.1) on first launch and after every sign-out. It is an account ID without email, name or password. Its sign-in data is kept in protected storage on your device. Under this guest ID we store what you do as a guest: beans, equipment and confirmations you report, likes, comments, searches, the sponsored placement you are shown, the topics you tap (tag affinities), the users you block, and usage statistics. We automatically delete guest accounts from 30 days after they were created (the deletion job runs daily and handles a limited number of accounts per run). We delete likes, confirmations, blocks, tag affinities and the frequency-capping counters with them. Usage events, searches and content reports lose their link to the guest ID, and content reports also lose their details. Comments stay public with their text, without name and avatar. Publicly visible contributions to cafés (sightings, equipment reports) stay, without a link to the guest ID.

If you create an account from the guest account (email, Apple, Google), the guest account itself usually becomes your account. Your guest data then stays assigned to your account, and the automatic deletion no longer applies. This is not true in every case: if the guest account cannot be converted (for example because the sign-in service does not allow linking, or the Apple or Google identity already belongs to an account), the app creates a separate account or signs you in to the existing one. The guest account's data then stays under the guest ID and is deleted from 30 days after it was created. If you sign in to an existing account from a guest account, the app deletes the local guest state on your device; the guest account's rows stay on the server until they are deleted.

If the guest account cannot sign in, the app temporarily uses a local guest ID. On iPhone this is the identifier iOS assigns to our apps on your device (identifierForVendor), otherwise a random ID. It is kept in local app storage and is sent to our server: it carries sponsorship events and the frequency-capping counters, reports and confirmations, likes, comments, tag affinities and blocks. Searches and usage events do not carry it. Rows under this ID have no automatic deletion date, because the deletion after 30 days covers guest accounts only; sponsorship events and counters follow the periods in Section 5. If you create an account later or sign in to an existing one, we take over only tag affinities and blocks from this ID, record which account took them over (so that no second account can), and delete the local ID. Older guest reports under this ID stay as café data and are not assigned to your account.

Purpose: providing features without an account, assigning reports and limiting abuse (e.g. frequency capping).

Legal basis: Art. 6(1)(b) GDPR (app features without an account) and Art. 6(1)(f) GDPR (limiting abuse).

3.8 Push Notifications

If you allow notifications, we store your device's push token with its platform (iOS or Android) and an installation ID, linked to your account. Notifications travel through the Expo Push Service to Apple or Google (Section 4).

Purpose: delivering notifications.
Legal basis: Art. 6(1)(a) GDPR (your permission in the operating system).

3.9 Contacting Us

If you write to us through the contact form in the app, we store your message with your account ID and notify ourselves by push.

Purpose: answering requests.
Legal basis: Art. 6(1)(b) GDPR.

4. Recipients and Processors

We use the following service providers. Where they process data on our behalf, data processing agreements under Art. 28 GDPR are in place. We base transfers to the USA on the adequacy decision for the EU-US Data Privacy Framework or on EU Standard Contractual Clauses (Art. 45, 46 GDPR). App stores and map services partly process data under their own responsibility; their privacy policies apply in addition.

4.1 Supabase (hosting)

Data: account and sign-in data (email, password as a hash), all content and settings, uploaded files, push tokens, usage events.
Purpose: database, sign-in, file storage and server functions of the app.
Legal basis: Art. 6(1)(b) GDPR, processing on our behalf under Art. 28 GDPR.
Country: servers in the Central EU (Frankfurt) region, in Germany. The provider is Supabase Inc. (USA).
Retention: as in Section 5.

4.2 Anthropic (AI)

Data: photos of bags, menus and products, plus the details for recipe suggestions and questions, as described in Section 3.6.
Purpose: text recognition and recipe suggestions.
Legal basis: Art. 6(1)(b) GDPR.
Country: USA (Anthropic PBC).
Retention: Anthropic deletes API inputs and outputs within 30 days. If Anthropic flags content as violating its usage policy, it keeps it for up to two years, and longer where the law requires it. Anthropic does not use this data to train its models.

4.3 Expo (push relay)

Data: your device's push token, a random installation ID of the app, title and text of each notification.
Purpose: relaying notifications to Apple or Google.
Legal basis: Art. 6(1)(a) GDPR (your permission), processing on our behalf under Art. 28 GDPR.
Country: USA (Expo, 650 Industries, Inc.).
Retention: only for delivery, then under Expo's terms.

4.4 Apple

Data: Sign in with Apple (Apple learns about the sign-in), delivery of notifications on iPhone, maps via Apple Maps, app distribution through the App Store.
Purpose: sign-in, delivery, maps and distribution.
Legal basis: Art. 6(1)(b) GDPR. Apple partly processes under its own responsibility.
Country: Apple Inc. (USA).
Retention: under Apple's privacy policy.

4.5 Google

Data: Sign in with Google (Google learns about the sign-in). On Android: push through Firebase Cloud Messaging (FCM token, Firebase installation ID, app version, device information, notification content) and maps through the Maps SDK for Android (IP address, device information, a pseudonymous SDK identifier, crash reports, map interactions such as panning and zooming). When operators claim a café, we fetch photos from the Google Places API on the server, using the café's Place ID and no user data. Google Play is used for app distribution; no payments run through Google Play.
Purpose: sign-in, delivery, maps, café photos and distribution.
Legal basis: Art. 6(1)(b) GDPR. Google partly processes under its own responsibility.
Country: Google Ireland Limited (Ireland) or Google LLC (USA).
Retention: under Google's privacy policy.

4.6 Stripe (payments, sponsorship customers only)

Data: amount, business name and campaign ID for the payment link. You enter payment details directly with Stripe.
Purpose: paying for booked sponsorships.
Legal basis: Art. 6(1)(b) GDPR.
Country: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA).
Retention: under Stripe's terms and statutory retention obligations.

4.7 Resend (email delivery)

Data: your email address and the content of the email. That is the confirmation code, notices about your account (for example password resets or changes to your password or email address) and, for sponsorship customers, business name, time window, price and payment link.
Purpose: delivering emails about your account and the payment link for an approved sponsorship.
Legal basis: Art. 6(1)(b) GDPR, processing on our behalf under Art. 28 GDPR.
Country: USA (Resend, Inc.).
Retention: under Resend's terms.

4.8 Cloudflare (public live menu)

Data: when you open a café's live menu via QR code, a Cloudflare Worker and our hosting process your IP address and browser identifier as a technical necessity. There is no account and there are no cookies. We only count views of the menu.
Purpose: delivering the page.
Legal basis: Art. 6(1)(f) GDPR.
Country: Cloudflare, Inc. (USA), global network.
Retention: we do not store an IP address for this in our database. The providers' technical logs follow their own retention periods.

4.9 OpenStreetMap

Data: when a café operator changes the address, we look up the coordinates on the server with the Nominatim service. The café's address is sent. When someone suggests a new café, we look up the coordinates on the server with the Geoapify service. The café's address, city and country are sent, not your name and not your note. Map motifs and café locations are based on OpenStreetMap data.
Purpose: converting an address into coordinates.
Legal basis: Art. 6(1)(f) GDPR.
Country: OpenStreetMap Foundation (United Kingdom).
Retention: we store only the result.

Affiliate links: tapping shop links (e.g. to bean shops) opens external websites. Once you leave the app, the respective provider's privacy policy applies; we do not transmit any personal data to the shop.

5. Retention Periods

Statutory retention obligations (e.g. for B2B contract records) remain unaffected.

6. Your Rights

Under the GDPR, you have the following rights:

Right to lodge a complaint: you may complain to a data protection supervisory authority (Art. 77 GDPR), in particular the authority of your habitual residence or the German state data protection authority responsible for the operator (Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin).

7. User-Generated Content and Moderation

You can report other users' content directly in the app, and you can block users. We generally review reports within 24 hours and remove content that violates our rules. We have zero tolerance for offensive or abusive content. For moderation purposes, we process the reported content and the associated account data (legal basis: Art. 6(1)(f) GDPR, protecting the community and the platform).

8. Analytics Opt-Out

In the app settings you will find a toggle to disable the collection of usage events. The toggle also covers the filter events (3.4). Functionally necessary data (e.g. your content, favorites) is not affected.

9. Changes to This Policy

We will update this privacy policy when the app or the legal situation changes. The current version is always available in the app. We will notify you in the app of any material changes.

10. Use in the Browser (my.cupd.app)

Cupd is also available as a web app at my.cupd.app. This policy applies there with the following differences: