Privacy Policy

Last updated: August 12, 2026

Plain-language note: this policy describes exactly what Cup Cartel actually collects and does with your information — no boilerplate copied from somewhere else. If you have questions, email us at privacy@cupcartel.app.

Who we are

Cup Cartel ("Cup Cartel," "we," "us") operates a mobile and web app that helps people discover independent coffee shops, verify visits, and earn loyalty rewards, and helps coffee shop owners manage their listing, loyalty program, and customer engagement through an Owner Portal.

Information we collect

Account information. When you create a customer account, we collect your first name, email address, and password (handled by our authentication provider, Supabase — we never see or store your raw password). Shop owner accounts additionally provide a business email and, during onboarding, shop details (name, address, website, phone).

Location. With your permission, we use your device's location to verify you're actually at a shop when you check in (GPS-based check-in) and to show you nearby shops. We only access location in the foreground, while you're actively using the app — we do not track your location in the background or store a continuous location history.

Camera. The app requests camera access to scan a shop's QR code for check-in. We do not record, store, or upload camera footage or images from this feature — the scan happens locally on your device.

Photos you choose to upload. If you add a profile photo or attach photos to a review, we store those images to display them in the app.

Usage and activity data. We record real product activity tied to your account — check-ins, stamps earned, rewards redeemed, reviews you write, shops you save, and similar in-app actions — so the app and your rewards work correctly.

Device and log data. Like most web and mobile apps, our infrastructure automatically logs basic technical data (IP address, browser/device type, request timestamps) for security and reliability purposes.

Shop owner data

If you're a shop owner, we additionally process your business's Google/Square-connected point-of-sale data if you choose to connect Square — this is used only to match real purchases to loyalty activity for your own shop and is never shared with other businesses.

How we use your information

To operate the core features of the app — check-ins, rewards, reviews, and shop discovery
To verify that check-ins and reviews reflect genuine visits, protecting shops from fraud
To communicate with you — account notifications, streak reminders (if enabled), and support
To improve the app based on real, aggregated usage patterns
To keep the platform secure and prevent abuse

How we share information

We do not sell your personal information. We share it only in these situations:

With the shop you visit — when you check in, redeem a reward, or leave a review, the relevant shop owner can see that activity as part of managing their own store.
With service providers who host and run the app on our behalf: Supabase (authentication and database), Cloudflare (hosting), and, for shops that connect it, Square (point-of-sale integration).
If required by law, or to protect the rights, safety, and security of Cup Cartel, our users, or the public.

Data retention and deletion

We keep your information for as long as your account is active. You can permanently delete your account and associated personal data at any time from Settings → Account Management → Delete Account in the app, or via our account deletion page. Some information (like anonymized reviews, or records a shop needs for legitimate business/legal purposes) may be retained in a form that no longer identifies you.

Children's privacy

Cup Cartel is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we'll remove it.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing. You can exercise most of these rights directly in the app, or by emailing privacy@cupcartel.app.

Security

We use industry-standard measures — encrypted connections (HTTPS), access controls, and a reputable authentication provider — to protect your information. No system is perfectly secure, but we take reasonable steps to safeguard your data.

Changes to this policy

We may update this policy as the app changes. We'll update the "Last updated" date above, and for significant changes, we'll make a reasonable effort to notify you directly.

Contact us

Questions about this policy or your data? Email privacy@cupcartel.app.