Privacy policy

Effective October 20, 2026

This policy explains what personal information Where's the Coffee? ("we", "us") collects, why, where it is kept and what you can do about it. We are based in Alberta, Canada. Questions go to info@whereisthecoffee.com.

You can use the brew guides, grinder pages and the grind setting suggestions without an account. We only collect personal information when you create an account, log cups, or send us feedback.

What we collect

Account: your email address and your password. The password is stored only as a one-way hash by our sign-in provider (Supabase Auth). We never see it in plain text. The sign-in provider also keeps basic sign-in records, such as the time and IP address of a sign-in, for security.
Gear: the grinders and brewers you add to your account, any nicknames you give them, and a calibration offset for each grinder if you set one.
Bags of coffee: if you track your beans, the details you enter for each bag (roaster, coffee name, roast, process, decaf, roast date, origin, variety, producer, weight, opened and finished dates, price and notes). Bags are private to your account and aren't shared with other people.
Cup logs: for each cup you log, the brewer, grinder and grind setting, roast, process, dose, water and water temperature, taste, strength and star rating, brew time and the guide's target time, notes you type, and the date. If you use the advanced tasting log, also the intensity and flavour notes you pick, your overall score and any tasting notes you write. Optionally, the bag you brewed from, the recipe you used and whether you followed the app's suggestion.
Recipes: if you save your own recipes, their name, brewer, dose, water, water temperature, target time, grind, steps, notes, and the grinder setting and bag you pin to them. Recipes are private to your account and aren't shared with other people.
Cupping sessions: if you run a cupping session, its name, date, cup size and notes, whether it's blind, the coffees in it (a name you type or one of your bags) and your scores for each (acidity, sweetness, mouthfeel, flavour groups, notes as it cools, overall score and ranking). A session is private to you unless you invite friends with a code. People in a shared session see the session, everyone's display name and how far each person has got; they see the coffee names once a blind flight is revealed, and everyone's scores and notes once the host shows results. Leaving a session (or being removed) deletes your scores in it.
Display name: if you add one (Profile → Settings), it's shown to people in cupping sessions you host or join. Your email is never shown to them.
Preferences: your units (metric or imperial), your preferred grinder for each brew method, whether How it works shows on Home, whether you use the advanced tasting log, and whether you share anonymous brew data (see below). You choose units, the tasting log and sharing when you create your account.
Feedback: if you use the feedback form, the message you write, your email address if you choose to give it, and a one-way hash of your IP address. The hash is used only to limit how many messages one connection can send, so the form isn't flooded. We don't store the IP address itself.
Technical data: our hosting provider handles every request to the site and keeps standard server logs (such as IP address, browser type and the page requested) for operating and securing the service.

Why we use it

To run the app: sign you in, save your gear, logs and preferences, and show them back to you.
To give you personal recommendations: your best-rated cups and your last cup's taste shape the next grind setting we suggest.
To improve recommendations for everyone (crowd-tuned settings). See the next section. You can opt out.
To read and reply to feedback, and to keep the service secure and working.

We don't use your information for anything else without asking you first.

Crowd-tuned recommendations

When enough people have logged good cups with the same grinder and brewer, we use their settings to tune the suggestion for everyone. Only grouped numbers are used: how many people contributed, how many cups, and the middle range of their grind settings. A suggestion is only tuned when at least 5 different people contributed, so no one person's setting can be picked out. Your email, notes and individual cups are never shown to anyone else.

This is on by default. You can turn it off when you create your account, or at any time under Profile › Settings, "Share anonymous brew data". When it's off, your cups are left out of the grouped numbers from then on.

Consent and the law

We handle personal information under Alberta's Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). By creating an account and using these features you consent to the collection and use described here. You can withdraw consent at any time (see Your choices and rights). Some features, like saving cup logs, can't work without the related information.

Service providers and where your data is stored

We use a small number of providers to run the service. They only process data to provide their service to us.

Supabase runs our database and sign-in. The database is hosted in Canada (AWS ca-central-1, Montreal).
Netlify hosts the website and delivers it through a global network. Requests may be processed outside Canada, including in the United States.
Resend delivers the emails we send, such as account emails and notices about feedback you send us. It is based in the United States.

When information is processed outside Canada, it is subject to the laws of that country, and authorities there may be able to access it.

What we don't do

We don't sell or rent your personal information.
We don't show ads.
We don't use third-party analytics or tracking cookies.

Cookies and local storage

When you sign in, we set cookies that keep your session so you stay signed in. They are needed for the account to work. Your browser also stores your light or dark theme choice in local storage on your device. If you hide How it works on Home, we set a cookie (wtc_hide_how, kept for 1 year) so it stays hidden. That's all we store in your browser.

How long we keep it

Account, gear, bags, recipes, cupping sessions, cup logs and preferences: until you delete them or ask us to delete your account.
Feedback messages: up to 2 years, then deleted (sooner if you delete your account while signed in).
Server and sign-in logs: for the short periods our providers keep them.

Crowd-tuned numbers are worked out fresh from the logs each time, so once your cups are deleted they no longer count.

Your choices and rights

Access and correction: you can see and edit your gear, cups and preferences in the app. You can ask us for a copy of the personal information we hold about you, or to correct it.
Withdraw consent: turn off "Share anonymous brew data" in Profile › Settings, or ask us to stop using your information.
Deletion: you can delete individual cups, bags, recipes and cupping sessions in the app. To delete your whole account and everything linked to it (gear, bags, recipes, cupping sessions, cups and any feedback you sent while signed in), use Profile → Settings → Delete account. It happens straight away and we email you a confirmation. You can also email info@whereisthecoffee.com from the address on the account and we'll do it for you.

We reply to requests within 30 days.

How we protect it

Data is encrypted in transit (HTTPS) and at rest by our database provider. Each person's gear and cups are locked to their account by database access rules, so other users can't read them. Passwords are hashed. Access to the systems is limited to the people who run the service. No system is perfectly secure, but we take reasonable steps for the kind of information we hold.

If there is a breach

If personal information is lost, accessed or disclosed without authorization and there is a real risk of significant harm to anyone, we will notify the Office of the Information and Privacy Commissioner of Alberta and the people affected, as Alberta's PIPA requires, and keep a record of the incident.

Children

Where's the Coffee? is not meant for children under 13, and we don't knowingly collect their information. If you think a child under 13 has made an account, email us and we'll delete it.

Contact and complaints

For questions, requests or complaints about privacy, email info@whereisthecoffee.com. If you're not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll tell you in the app or by email before it takes effect. See also our Terms of use.

See also: Privacy policy · Terms of use