Privacy Policy

Effective date: August 29, 2026

This Privacy Policy explains what information CoffeeDrop collects, how it is used, and the choices available to you when you use the service.

Information you provide

When you create an account, CoffeeDrop uses your email address for authentication and account-related messages. You may also provide a username, display name, profile photo, and bio. Your email address is not displayed publicly.

When you create a coffee post, you may provide a drink photo, drink name, store, size, base drink, ingredients, ordering instructions, and optional notes. Published coffee posts are public.

If you contact CoffeeDrop at support@coffeedrop.site, we receive the information contained in your message and the email address you use to contact us.

Account and authentication information

CoffeeDrop uses Supabase Auth to operate account creation, login, session management, and email verification. Authentication data is used to identify your account securely and is not exposed as part of your public profile.

Payment information

Creator Membership payments are processed by Stripe. CoffeeDrop does not directly store your full payment card number. CoffeeDrop stores the Stripe customer and subscription identifiers and subscription status needed to provide paid membership features and manage billing access.

Anonymous visitors

Anonymous visitors receive a secure random browser identifier stored in an HTTP-only cookie. CoffeeDrop stores the associated server-side identifier so that one anonymous visitor can create one free coffee post and, from the original browser, manage that post when ownership can be verified.

For abuse prevention and rate limiting, CoffeeDrop may create salted cryptographic hashes derived from request IP addresses. These controls are designed to limit abusive activity without permanently storing raw IP addresses for that purpose.

Likes, reports, and usage data

When you like a coffee, CoffeeDrop stores enough information to prevent the same account or anonymous visitor from repeatedly liking the same post. If you report content, CoffeeDrop stores the report reason, optional notes, the coffee being reported, and account information when you are signed in.

CoffeeDrop may use privacy-conscious analytics to understand general site usage, such as page visits and product interactions. Sensitive account, authentication, or payment information is not intentionally included in analytics events.

How information is used

We use information to operate CoffeeDrop, authenticate users, publish and manage coffee creations, maintain creator profiles, process membership status, prevent fraud and abuse, respond to support requests, moderate content, improve the service, and protect CoffeeDrop and its users.

Public information

Public coffee posts may include your coffee photo, recipe, notes, and other submitted drink information. For paid creators, your username, display name, avatar, bio, and published creations are also public. Anonymous coffee posts display the creator as Anonymous and do not publicly expose the anonymous visitor identifier.

Service providers

CoffeeDrop relies on service providers to operate the website. These include Supabase for database, authentication, and file storage; Stripe for subscription billing; Vercel for website hosting and infrastructure; and an email delivery provider for account emails. These providers process information as needed to perform their services.

Data retention

Information is retained for as long as reasonably necessary to operate CoffeeDrop, maintain your account, comply with legal obligations, resolve disputes, prevent abuse, and enforce agreements. Some records may remain for a limited period in backups, logs, payment records, or security systems after account or content deletion.

Deleting your account and content

Members can delete their account from Settings. CoffeeDrop deletes the member's public CoffeeDrop posts and uploaded images as part of the account-deletion process, subject to limited technical, security, legal, or payment-record retention where necessary. Anonymous creators can edit or delete their anonymous coffee post from the original browser while ownership can still be verified.

Security

CoffeeDrop uses technical and organizational safeguards including authentication controls, server-side authorization, secure cookies, validation, rate limiting, restricted database access, and trusted payment processing. No internet service can guarantee absolute security.

Children's privacy

CoffeeDrop is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to CoffeeDrop, contact us so we can review and remove it where appropriate.

Changes to this policy

We may update this Privacy Policy as CoffeeDrop changes. The effective date at the top of the page will reflect the latest version.

Contact

Privacy questions or requests can be sent to support@coffeedrop.site.