Your Privacy Matters

This policy explains what Brew Routes collects, why we collect it, and how you can control your data.

Last Updated: October 13, 2026

Who is responsible:

Brew Routes Technologies Inc., Jordan Alexander Canham
16335 Rush City Rd, Newington, ON K0C 1Y0, Canada
support@brewroutescoffee.com

1. Data We Collect

Account and profile data: name, email, username, avatar, and account identifiers.
Authentication data: sign-in provider account linkage metadata for Apple, Google, and credentials auth.
Credential security data: for password accounts, we store a one-way password hash (never plaintext passwords).
Location data: precise location only when you grant permission while using the app, used to power near-me and distance features.
User content: posts, ratings, comments, photos, favourites, bucket list, and bean vault entries.
Café visits (stamps): when you scan a café's QR code, we store the café, the time, whether the visit was confirmed, and your answers, such as whether you'd go back, your rating, and what could be better. To stop duplicate or fake stamps we also store a random device ID in a cookie, a daily-changing hash of your connection, and the country and rough distance from the café worked out from your connection. We don't ask for your precise location for this.
Hearing from cafés: if you choose to hear from a café, we store that choice until you mute it.
Reward reminders: if you collect stamps at a café and haven't been in for a week, we send at most one notification per reward when it's ready or one or two stamps away. You can turn this off under Visit follow-ups in Settings.
Café payments: when a café pays for a plan, Stripe handles the card details. We never see full card numbers.
Usage analytics: only if you agree, we record how the website is used, such as pages viewed and buttons tapped.
Operational data: request diagnostics, device/browser metadata, and error logs needed for reliability and security (IP addresses and user agents are hashed; URLs are stored without query strings).
Waitlist/marketing consent: email and consent flag when you explicitly opt in.

2. Why We Use It (US + GDPR Baseline)

To provide the service: account login, profile features, discovery, map/list experiences, and saved shops.
To secure accounts and platform integrity: fraud prevention, abuse prevention, and service monitoring.
To improve product quality: troubleshooting, stability, and performance optimization.
To send requested communications: password reset and support interactions.
Lawful bases (where applicable): contract (GDPR Art. 6(1)(b)) for your account, stamps, and saved cafés; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, error monitoring, reward reminders, and the visit totals cafés see; consent (Art. 6(1)(a)) for usage analytics, location access, and hearing from cafés; legal obligations (Art. 6(1)(c)) for tax and accounting records. You can withdraw consent at any time for the future.

3. Service Providers and Sharing

What cafés see: cafés that use Brew Routes see totals: visits, new and returning people, regulars, ratings, how many would go back and why, and comments on what could be better. Those comments are shown without your name. Cafés never see your name, email, or profile through these tools. Notes from a café are sent through Brew Routes only to people who chose to hear from it, and the café never receives contact details.

We use vetted providers to run Brew Routes, including:

Authentication: Apple and Google sign-in providers.
Database: PostgreSQL infrastructure accessed through Prisma (Supabase-backed database setup).
Media: Cloudflare R2 storage and Brew Routes media proxy processing path.
Maps: OpenFreeMap map styles rendered through MapLibre.
Email: Resend for operational messaging flows.
Hosting: Vercel to run the website, plus cookieless page view counts.
Analytics: PostHog, only with your consent.
Error monitoring: Sentry, to find crashes and errors.
Payments: Stripe for café plans.

Transfers outside the EU: Our database and most providers are in the United States. For these transfers we rely on the providers' data processing terms, including the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where they apply.

We do not sell your personal information. We only share data as needed to operate the service, satisfy legal obligations, or enforce our terms.

4. Cookies and Local Storage

Session cookies: used for secure authentication and account sessions.
Local and session storage: used for app preferences, cached UI state, and performance smoothing.
Stamp device cookie: a random ID set when you scan a café's QR code, so one phone can't collect several stamps for one visit.
Analytics cookies: only set if you agree. Your choice is remembered and you can change it by clearing site data.
Location persistence: when you grant location permission, recent coordinates may be stored locally on your device for up to 30 days to improve near-me UX.
Your control: you can remove stored location data by clearing site data in your browser/app settings, and you can revoke location permission at any time in device/browser settings.

5. Retention and Deletion

Account and profile data are retained while your account is active.
User-generated content is retained until removed by you, moderation, or account deletion.
Café visits stay part of your stamp passport until you delete your account. Stamps that are never saved to an account stay on record without a name so cafés' visit totals stay accurate.
Security and operational logs are retained for up to 90 days for abuse prevention and reliability, then deleted or aggregated.
Inactive waitlist entries are deleted on a rolling schedule after 365 days unless a longer period is legally required.
Locally cached location data is kept on your device for up to 30 days unless you clear site data sooner.
You can preview deletion impact in Settings before confirming permanent account deletion.
Account deletion removes account-linked records, invalidates active sessions, and attempts cleanup of known user-owned media keys.

6. Your Rights

Depending on your location, you may have rights to know/access, correct, delete, and request portability of your personal data.

If the GDPR applies to you, you can also object to processing based on legitimate interests, ask us to restrict processing, and withdraw consent at any time. You can also complain to a data protection authority, in particular where you live or work.

For California residents (CCPA/CPRA baseline), you may also request details about categories of personal information collected and disclosed, and request deletion/correction where applicable.

For Canada (PIPEDA baseline), you may request access/correction and withdraw consent for location processing where applicable, subject to legal or service limitations.

Authenticated users can self-serve privacy operations in Settings: Export My Data and Preview Account Deletion.

To make a privacy request, contact us at support@brewroutescoffee.com.

7. Policy Updates

We may update this policy to reflect product, legal, or security changes. Material updates will be reflected by the Last Updated date on this page.