Privacy Policy

havebean · Effective 31 October 2026

This policy explains what personal data the havebean iPhone app and its backend process, why, and what rights you have. havebean is a free, non-commercial app for finding and recommending specialty coffee cafés. It shows no ads, contains no analytics or advertising SDKs, does not track you across apps or websites, and does not sell your data.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

I am not required to appoint a data protection officer. Write to the address above for any privacy question or request.

2. What data is processed and why

2.1 Your account

To create and run your account I process your email address, a password (stored only as a salted hash by our hosting provider), a user ID, and the time you signed up and last signed in. If you use Sign in with Apple or Sign in with Google, I receive an identifier for your Apple or Google account and the email address the provider shares (for Apple this can be a private relay address). I never receive your Apple or Google password.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

2.2 Your profile and activity

When you use the app, I store what you choose to add:

• Profile: username, short description, coffee preferences (for example brew style or favourite drink), profile picture and privacy settings.
• Café log: which cafés you checked in at and on which day.
• Reviews: whether you recommend a café, your review text and photos.
• Lists: the cafés you save, list names and styles, and lists of others you copy or follow.
• Social: who you follow, follow requests, and who follows you.
• Contributions: café suggestions, suggested edits and café photos you submit, and the beans, levels and leaderboard positions you earn for them.

Photos are re-encoded on your device before upload, which removes embedded metadata such as GPS location.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). This is the service you signed up for.

2.3 What other people can see

havebean is a social app. Other signed-in members can see your username, profile picture, description and coffee preferences. Unless you change it under Profile → Privacy, they can also see your reviews, café log and public lists. Your reviews also appear on the café's page. You can make your account private (only approved followers then see your activity), hide individual sections or lists, and choose whether you appear on leaderboards. People you block cannot see your profile.

2.4 Safety and moderation

If you report or block someone, I store the report (reason, optional details, the reported content) or the block. If someone reports you, I store that report. I use this to review reports, remove content that breaks the Terms of Use, and suspend accounts where necessary. Moderation is done by people, not by automated decisions.

Usernames are checked against a list of offensive words when you choose one.

Legal basis: our legitimate interest in keeping the community safe and enforcing the Terms (Art. 6(1)(f) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).

2.5 Your location

If you allow it, the app uses your device's location while you use it to centre the map and show cafés near you. The distance calculation happens on your device. Your location is not sent to or stored by havebean. You can withdraw permission at any time in iOS Settings. The map itself is provided by Apple Maps (see section 3).

Legal basis: your consent through the iOS permission prompt (Art. 6(1)(a) GDPR).

2.6 Crash and performance reports

The app uses Apple's MetricKit to collect crash reports and performance measurements (for example launch time, hangs and memory use) together with the app version, build and iOS version. These reports are uploaded without your user ID or any other account link, and are deleted after 90 days. Only I can read them.

Legal basis: our legitimate interest in finding and fixing bugs (Art. 6(1)(f) GDPR).

2.7 Server logs

When the app talks to the backend, our hosting provider automatically records technical data such as IP address, time, the request made and error information. This is needed to run the service securely and to investigate abuse. These logs are kept for a short period set by the provider and then deleted.

Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

2.8 Data stored on your device

The app keeps your sign-in session in the iOS Keychain and stores a copy of your own profile, lists and café log, plus some settings, on your device so it works offline. This data is removed when you sign out. Storing it is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG).

3. Who receives data

• Supabase Inc. (USA) hosts our database, sign-in, file storage and server functions as a processor under a data processing agreement. Data is stored in London, United Kingdom.
• Apple provides Sign in with Apple, Apple Maps, MetricKit and the App Store. Apple processes data under its own privacy policy.
• Google provides Sign in with Google, only if you choose it. Google processes data under its own privacy policy.
• Other members see the parts of your profile and activity described in section 2.3.

Links to café websites or Instagram open outside the app. Those sites have their own privacy policies.

I do not share your data with anyone else unless the law requires it.

4. Transfers outside the EU

Our database is hosted in the United Kingdom, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). Supabase, Apple and Google are based in the USA and may access data from there. These transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5. How long data is kept

• Account, profile and activity: until you delete them or your account. You can delete your account at any time under Profile → Delete Account. This immediately deletes your profile, reviews, photos, lists, café log, follows, blocks, reports and contributions. Cafés that were accepted into the catalogue from your suggestions stay, but are no longer linked to you.
• Backups: none are kept, so deleted data cannot be restored.
• Crash and performance reports: 90 days.
• Server logs: the provider's short retention period, then deleted.

6. Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time, with effect for the future (Art. 7(3)), for example by turning off location access.

Email me to use any of these rights. You also have the right to complain to a data protection supervisory authority, for example the one where you live or the one responsible for me: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

7. Age

havebean is for people aged 16 and over. I do not knowingly process data of anyone younger. If you believe a child has created an account, please contact me and I will delete it.

8. Security

Data is encrypted in transit (TLS). Access to the database is restricted per account, so members can only read what the privacy settings above allow. No system is perfectly secure, but I take reasonable measures to protect your data.

9. Changes

I will update this policy when the app or the law changes. The effective date at the top shows the current version. If a change significantly affects you, I will tell you in the app.