Privacy Policy
This Policy describes how shelf.coffee handles your personal data under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and the EU General Data Protection Regulation (GDPR), where applicable.
1. Controller
The controller of your data is shelf.coffee ("Controller"), a service operated from Brazil. Contact: privacy@shelf.coffee.
2. Data we collect
- Account: email and, when you sign in with Google or Microsoft, the name and profile picture they provide. Creating an account with an email code shares the email, a name, and the country.
- Usage: brew history, coffee catalog, equipment, and notes you register.
- Public content: the reviews you publish about recipes are visible to any visitor, without your name or any other account data, and you can edit or delete them at any time. Official and public recipes show their total of favorites and recorded brews, without identifying who favorited or brewed it. Your brew notes and ratings stay private.
- Payment: card and billing data are handled directly by Paddle; we never store card data. We receive only opaque identifiers (paddle_customer_id, paddle_subscription_id) and transaction metadata (date, amount, status). We do not collect or store physical shipping addresses, as the Service is strictly a digital software platform with no physical fulfillment.
- Telemetry: pages visited, usage events (brews started, methods chosen) via Google Analytics 4.
- Technical: IP address and User-Agent recorded in Cloudflare and Supabase logs for security and diagnostics.
3. Why we collect (legal basis)
- Contract performance: authentication, brew storage, subscription processing.
- Legitimate interest: security, fraud prevention, product improvement via aggregated telemetry, and occasional emails about what is new in the Service for account holders. Every such email includes a link to stop receiving them.
- Legal compliance: tax record retention via Paddle.
- Consent: non-essential cookies (analytics), where applicable.
4. Sharing
We share data only with processors essential to operating the Service:
- Supabase (processor) — database and authentication, with servers located in the United States.
- Cloudflare (processor) — hosting and CDN.
- Paddle (independent controller for payment) — processes payments as Merchant of Record and is responsible for the financial transaction of the digital subscription. Access to the SaaS features is granted immediately upon Paddle's confirmation. Policy: paddle.com/legal/privacy.
- Google — OAuth authentication and Google Analytics 4 (pseudonymized telemetry).
- Microsoft — OAuth authentication, for those who choose to sign in with a Microsoft account.
- Cloudflare Turnstile — bot check when requesting an email sign-in code.
- Resend (processor) — email delivery: the welcome email on account creation and, occasionally, news about the Service. Receives only your email address and name, and records whether the email was opened and whether a link was clicked. Policy: resend.com/legal/privacy-policy.
We do not sell your data nor share it for third-party marketing.
5. Cookies and similar technologies
- Session: Supabase cookies keep you logged in across visits.
- Preferences: theme, sound, music, timer, equipment, and units in
localStorage; for authenticated users, also in Supabase for cross-device sync. - Analytics: Google Analytics 4 with IP anonymization.
- Visit statistics: Cloudflare Web Analytics, without cookies and without identifying you, counts page views and load time.
6. Retention
- Software usage data (recipes, brews, and account preferences): while the account is active. Upon deletion we remove within 30 days (backup logs kept up to additional 30 days before final purge).
- Payment records: kept by Paddle per applicable tax requirements (5 years in Brazil).
- Technical logs: 90 days.
- Webhook events: 1 year (internal audit).
7. Your rights
Under LGPD Art. 18 (and GDPR equivalents), you may request:
- Confirmation of processing
- Access to your data (via
/me→ Export JSON) - Correction of incomplete or outdated data
- Anonymization, blocking, or deletion of unnecessary data
- Data portability (Export JSON covers this)
- Deletion of consent-based data
- Information about sharing
- Withdrawal of consent
To exercise any right: privacy@shelf.coffee. We respond within 15 business days.
8. Security
We adopt reasonable technical controls: enforced HTTPS, password hashing (delegated to OAuth), Row Level Security in the database, server-side secrets (API keys) isolated from the client, HMAC verification with replay protection on payment webhooks. No system is 100% secure — in case of an incident involving personal data, we will notify the relevant authority (ANPD in Brazil) and affected data subjects per LGPD requirements.
9. International transfer
Some processors (Supabase, Cloudflare, Paddle, Google, Microsoft, Resend) process data in servers outside Brazil. We ensure these processors offer adequate protection levels via standard contractual clauses and recognized certifications.
10. Children
The Service is not directed to children under 13. We do not knowingly collect data from children. Legal guardians who identify a child has provided data should contact us for removal.
11. Changes
This Policy may be updated. We will notify material changes via the Service interface. The date at the top indicates the current version.
12. Data Protection Officer (DPO)
The channel for data protection matters is privacy@shelf.coffee. Contact: privacy@shelf.coffee.
