Privacy Policy

1. Introduction

CaféRadar™ (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the “Service”).

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and profile photo (via Google or Apple Sign-In).
• User Content: Reviews, check-ins, journal entries, photos, and other content you create within the app.
• Preferences: Coffee preferences, favorite drinks, roast preferences, and interests you set during onboarding.
• Communications: Messages you send to us for support or feedback.
• Direct Messages: If you and another user follow each other, the content of the one to one messages you send through Coffee Connections, which we store to deliver and display the conversation.

2.2 Information Collected Automatically

• Location Data: With your permission, we collect your precise location to show nearby cafés, enable check-ins, and send proximity alerts. On Android, the proximity alert feature requests background location access (ACCESS_BACKGROUND_LOCATION) so the app can notify you when you walk near a high-rated specialty café even when CafeRadar is closed or not in use. Your location is used on your device to trigger geofence alerts; location samples produced by background geofencing are not sent to or stored on CafeRadar servers. Up to 20 nearby cafés are monitored at a time, refreshed when you next open the app, and the monitoring stops when you disable proximity alerts. You can disable location access at any time in your device settings.
• Device Information: Device type, operating system, unique device identifiers, and app version.
• Usage Data: How you interact with the app, including pages visited, features used, and time spent.
• Analytics Data: We use PostHog for first-party analytics and Sentry for error tracking. No cross-app tracking identifiers are collected.
• Push Notification Tokens: With your permission, OneSignal generates a push notification token tied to Apple Push Notification service on iOS or Firebase Cloud Messaging (FCM, a Google service) on Android. This token lets us deliver notifications to your device.
• Google Play Services (Android only): On Android devices, Google Play Services supports our integration of Google Maps and Firebase Cloud Messaging. Google may collect technical information through these services governed by Google's privacy policy.
• Advertising Identifiers: We do NOT collect or use Apple's IDFA on iOS, Google's Advertising ID on Android, or any cross-app advertising identifier. We do not display advertising in the app and do not share data with advertising networks.

2.3 Merchant Information

If you submit a business inquiry to upgrade to our Enterprise plan or to add additional cafe locations, we collect: the contact email and phone number you provide, your account details (current plan, listing count, requested locations), and the free-text business context you submit. We use this information solely to evaluate, contact you about, and provision your enterprise contract (lawful basis: pre-contract performance under GDPR Art. 6(1)(b) and our legitimate interest in business-customer follow-up under Art. 6(1)(f)). Please do not include payment card data, government identifiers, health information, or other special-category data in your message. Enterprise inquiry records are retained for up to 6 years from contract end for accounting, audit, and dispute resolution; declined or withdrawn inquiries are pseudonymised after 24 months.

3. How We Use Your Information

• Provide and maintain the Service, including finding nearby cafés and personalizing recommendations.
• Process check-ins, reviews, and other user-generated content.
• Send push notifications about nearby cafés and merchant promotions (with your consent).
• Calculate achievements, badges, leaderboard rankings, and other gamification features.
• Improve the Service through analytics and error monitoring.
• Communicate with you about updates, support, and promotional offers.
• Detect and prevent fraud, abuse, or security issues.

4. AI Features

CaféRadar includes AI-powered features that process your data using third-party AI services. We currently use Google Gemini and Anthropic Claude as AI subprocessors. The legal basis for this processing is the performance of our contract with you, meaning it is needed to provide the app features you are using (GDPR Art. 6(1)(b)):

• Barista AI Chat: Your messages, coffee preferences, and check-in history are sent to our AI provider to generate personalized responses. You must provide consent before your first interaction.
• Photo, Drink, and Menu Analysis: When you scan a drink barcode or coffee bag, upload a photo, or scan a menu, the image and any related text are sent to a third-party AI vision provider to read the image and return information such as an estimated description, tasting notes, or menu items. These are AI estimates and can be inaccurate.
• Recommendations: Your preferences and activity are used to generate café and drink recommendations and the short explanations shown alongside them.
• Photo Moderation: User-uploaded café photos are analyzed by AI to detect inappropriate content before publishing.
• Notifications and Content: Your preferences may be used to personalize some notification content, and some content such as blog articles is generated or assisted by AI.
• Personalized Reminders and Offers: We analyze your own check-in activity to send you personalized reminders and, where a café funds one, win-back offers, for example when you have not visited a favorite café in a while. Cafés never learn your identity from this: they only ever see anonymous counts. You can turn these reminders and offers off at any time in your notification settings.

To the extent our agreements with these providers allow, your data is not used to train their foundation AI models, and it is processed only to provide these features to you. You can stop using AI features at any time. Deleting your account removes all AI-related data. Our AI transparency practices are described in full in our AI Transparency Policy.

5. Information Sharing

We do not sell your personal information. We may share information with:

• Other Users: Your public profile, check-ins, reviews, and achievements are visible to other CaféRadar users. Your activity feed is only visible to users who follow you.
• Direct Messages: The users you exchange Coffee Connections messages with can see the messages you send them. Private messages are not shown to any other user, and are shared with staff only where a message is reported to us for review.
• Merchant Partners (analytics): Aggregated, anonymized analytics about foot traffic, engagement, and loyalty for their listings. This includes count-only signals, such as how many of their regular customers have not visited recently. These analytics never include your name or individual visit history, and merchants agree in our Terms not to attempt to identify anyone behind an aggregate number.
• Merchant Partners (your direct interactions): Separately, when you interact with a cafe directly, that cafe can see the interaction and who made it. For example, a cafe can see your booking when you reserve a table, your membership when you join their punch card, your redemption when you use an offer, reward, or win-back code, and your status as a cafe's Regular (its most frequent visitor, shown with a crown) when your public check-ins earn it. These disclosures happen because you used the feature, and check-ins are public activity as described above.
• Service Providers: Third-party services that help us operate the app, including Clerk (authentication), Supabase (database), Sentry (error tracking), PostHog (analytics), OneSignal (notifications), RevenueCat (subscriptions on iOS), Google (Maps SDK and Firebase Cloud Messaging on Android, and Gemini for AI features as described in section 4), Anthropic (Claude for AI features as described in section 4), and Mapbox (café discovery).
• Legal Requirements: When required by law, court order, or to protect the rights, safety, or property of CaféRadar, our users, or the public.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. You can delete your account at any time from the app's Settings, which permanently removes your personal data, check-ins, reviews, and associated content. Direct message content is retained while your account is active and is permanently deleted when you delete your account, which removes your conversations and the messages within them.

7. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correct: Update or correct inaccurate personal data.
• Delete: Delete your account and all associated data from within the app.
• Export: Request a full copy of your personal data at any time, free of charge, by contacting us or using the in-app data request. Premium additionally offers a convenient in-app export of your check-in history, but your right to a copy of your data never requires a subscription.
• Opt Out: Disable location tracking, push notifications, and analytics tracking at any time.

8. Data Security

We implement industry-standard security measures to protect your data, including encrypted data transmission (TLS/SSL), secure authentication via Clerk, Row Level Security (RLS) on our database, and secure storage for sensitive tokens. However, no method of electronic transmission or storage is 100% secure.

9. Children's Privacy

CaféRadar is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the app or via push notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

privacy@caferadar.app