What we collect, and who we send it to
Your brewing log is yours. Nothing in it — no coffee, no roaster, no tasting note — is ever sent to anyone else. A handful of companies do receive something, and this page names every one of them, what each gets, for how long, and why.
Sentry
Tells us when the app throws an error, and shows us enough to reproduce it.
What it receives
- The error itself — its message, its stack trace, and the page you were on when it happened.
- A random id for your account, if you were signed in when it happened.
- Your browser and operating system, and which environment of ours you were using.
- A sampled trace of how long a page load, a navigation, or a request took.
- A masked replay of the seconds before an error, and only then — see below.
What it never receives
- Your name, your address, or anything else that says who you are. The random account id is the only thing we attach that is about you at all.
- Cookies, request bodies, or authorization headers. These are stripped from every report before it is sent.
- Any extra value we attach to a report under a key that looks like a password, a token, a secret, or an address we could contact you at. This filter covers the values we attach ourselves, not the text of the error message itself — so we keep error messages free of your data at the point they are written.
How long it is keptSentry keeps errors, traces and replays for up to 90 days, then deletes them.
Why we are allowed to send itOur legitimate interest in keeping the app working. An app that cannot see its own errors cannot fix them, and the reports are stripped of anything that names you.
Sentry's privacy policyPostHog
Counts how many people reach each step of the app, so we know which parts are worth building on.
What it receives
- A random id for your account, and which plan you are on.
- One page view per navigation, carrying the shape of the route — /coffees/edit rather than the coffee you edited.
- Six events marking the path from visitor to subscriber: signing in, creating a coffee, logging a brew, dialing one in, registering interest, and starting a checkout.
- The brewing method, plan, billing period, or place on the page a step applied to, and which environment of ours you were using.
- What the PostHog library adds to every event by itself: your browser, operating system, device type, screen size, and the site that referred you.
- Your approximate location — country, and often region and city — which PostHog derives from your IP address at its end.
What it never receives
- Any coffee, brew, roaster, tasting note, or piece of equipment — not its content, and not its id.
- Anything that identifies you outside our own system: no address we could contact you at, and no display name.
- What you type, click, or see. Session recording and autocapture are turned off at boot, and every URL we send is cut short of its query string.
How long it is keptPostHog keeps events for a year, then deletes them. A PostHog person profile has no expiry until it is deleted in PostHog.
Why we are allowed to send itOur legitimate interest in understanding how the app is used. What is sent is a random id, a route pattern, and six counted steps — enough to see where people stop, not enough to describe anyone.
PostHog's privacy policySigns you in. Coffee Companion has no password of its own, so Google is how you prove who you are.
What it receives
- The fact that you are signing in to Coffee Companion, at the moment you press the button.
What it never receives
- Anything you keep in the app. Sign-in is the whole of the exchange, and it runs on Google, not here.
- Any further contact after sign-in. We do not read your mail, your contacts, or your calendar.
How long it is keptGoogle keeps its own record of the sign-in under its policy. We keep your name, address, and avatar as it returns them, for as long as you have an account.
Why we are allowed to send itPerforming the contract you asked us for. Without this the feature you pressed cannot happen at all.
Google's privacy policyStripe
Takes the payment. Stripe is the merchant of record and sells through its Link brand, so the sale is between you and them, and we never hold a card number.
What it receives
- Your name and the address we can contact you at, so it can send a receipt and manage the subscription.
- Which plan and billing period you chose.
- Your payment details, typed on Stripe’s own checkout page and never on ours.
What it never receives
- Any coffee, brew, roaster, tasting note, or piece of equipment.
- Anything at all, unless you start a checkout. Someone who never subscribes is never sent to Stripe.
How long it is keptStripe keeps payment records for as long as the law requires it to, which is years rather than months.
Why we are allowed to send itPerforming the contract you asked us for. Without this the feature you pressed cannot happen at all.
Stripe's privacy policyResend
Delivers the one email we send, confirming you registered interest in a plan.
What it receives
- The address we send to, and the first name we greet you by.
What it never receives
- Any coffee, brew, roaster, tasting note, or piece of equipment.
- Anything at all unless you register interest. No other email is sent from the app.
How long it is keptResend keeps the sending record and its content under its own policy, not under a setting of ours.
Why we are allowed to send itPerforming the contract you asked us for. Without this the feature you pressed cannot happen at all.
Resend's privacy policyCookies and device storage
The only things we write on your device are strictly necessary for a page you asked for: the sign-in session you asked for— the cookie that keeps you signed in after you press the button — and, only if a page fails to load after we ship a new version, one short-lived key so the router can reload once and show you that page. PostHog and Sentry keep their state in memory for the current page and forget it when you reload. There is no consent banner, because nothing else is stored: those writes are strictly necessary for the service you pressed, and the two monitoring tools never write to the browser at all.
Session replay
Sentry can record what happened in the browser just before a crash, so a bug report comes with the steps that caused it. We use it only when the app throws an error, and never for an ordinary visit. If nothing goes wrong, nothing is sent and the recording is discarded as you go.
A replay is not a video of your screen. Every piece of text on the page is masked, every field you type into is masked, and images and video are blocked outright. What survives is the shape of the page and where you clicked — boxes and timing, not their contents.
Your own data
Everything the app holds about you can be exported from your account page, on any plan and whatever a plan hides from view. You can delete the account from that same page. If you delete your account, we keep your account data for 30 days so you can restore it, then delete it. Deleting cancels a live Subscription immediately, and unused prepaid time is not refunded. The PostHog profile has no expiry until it is deleted in PostHog.