Privacy Policy

• Your email address. Used only to sign you in via magic link. We never send marketing email — only the sign-in link itself and, in future, critical service notices.
• Your brewing data.The bags of coffee you log, the shots you pull, the grinder settings you save, the gear you've registered, the ratings you give. This data is yours; it exists so the app can be useful to you.
• Local preferences on your device.Your theme choice (Roast / Latte), preferred log-shot mode, and your active bag's roast level — cached in your browser's localStorage so the app doesn't have to refetch on every page load. This data never leaves your device.

• No analytics.No Google Analytics, no Mixpanel, no Plausible, no tracking pixels, no heatmaps. We don't know what pages you visit or how long you stay.
• No third-party trackers. No advertising network, no Facebook pixel, nothing.
• No location data. We never ask for it.
• No camera, microphone, photos, or contacts access. We don't ask for any of those.
• No crash reports or device fingerprinting.

Your account email and brewing data are stored in Supabase, a managed PostgreSQL database hosted in the EU (Frankfurt) region. Supabase is the data processor; the underlying infrastructure is Amazon Web Services in Germany.

Each user can only access their own rows. We use PostgreSQL Row-Level Security so that even if there were a bug in the app, your data couldn't be exposed to another user.

The app itself is hosted on Vercel. Vercel sees the URLs you visit (because their servers serve the pages) but does not see what's inside your account.

Sign-in emails are sent via Resend, which routes them through Amazon SES (EU-West-1, Ireland). Resend sees that an email was sent to you but does not see your in-app activity.

Under the GDPR (and equivalent laws elsewhere), you have the right to:

• Access the data we hold about you.
• Deleteyour account and all associated data. By email request for now — we're building self-service deletion into the app (see “What we're building next”).
• Export your data in a portable format. Same as above — by request for now.
• Object to any of the above use of your data.

To exercise any of these rights, email hello@9barsociety.com. We aim to respond within 14 days.

The 9 Bar Society uses one cookie: the Supabase authentication session token, which keeps you logged in between visits. No analytics or advertising cookies are set, ever.

The 9 Bar Society is built for adult home baristas. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

Two changes are coming, both designed with your control in mind:

• Self-service account deletion and data export. Today these require an email; we're building both into the app directly so you have full control without waiting on us.
• Anonymous gear-based recommendations.The 9 Bar Society is meant to be a community. We plan to let users with the same grinder benefit from each other's tuning — if you and another user are both grinding a similar roast on the same model, the app might surface “people on your grinder typically land around 5,4 for this kind of bean.” This will be opt-in: your data won't be included unless you explicitly choose to share it, and shared data will be aggregated and stripped of anything that could identify you. We'll update this policy with the exact mechanics before the feature ships.

The motivation is the bean. Less waste, more adventurous bag choices, faster dial-in.

If we update this policy, we'll change the date at the top. If the changes are material (e.g., we add a new third-party service or start collecting something new), we'll show a prominent notice when you next open the app.

Built and operated by Ísak Winther at Winther Wonderland ehf., Reykjavík, Iceland.

For privacy questions, data requests, or anything else: hello@9barsociety.com