Privacy Policy

This Privacy Policy explains how Roastly (“we”, “us”, “our”) collects, uses, and protects your personal data when you use the Roastly mobile app, website (getroastly.com), and related services (collectively, “the Service”). Roastly is operated by a sole proprietor based in the Netherlands.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

Roastly
The Netherlands
Email: info@getroastly.com

3.1 Account data. When you create an account, we collect your email address, username, and password. If you sign in with Apple, we receive the information you authorize Apple to share (typically your name and email address).

3.2 Profile data. You may optionally provide a profile avatar and bio.

3.3 User content. Coffee reviews, ratings, and other content you create within the Service.

3.4 Social data. Information about which users you follow and who follows you.

3.5 On-device image analysis. Before uploading photos, the app may use Apple's on-device content analysis to check for sensitive material. This analysis runs entirely on your device — no image data is sent to our servers or any third party for this purpose. Photos flagged as sensitive are blocked from upload.

3.6 Device and analytics data. We may collect technical information such as device type, operating system, app version, and usage patterns to improve the Service.

3.7 Place data. When you attach a café or restaurant to a brew, we store that place's name, address, and coordinates, and the name as it appeared when you logged it is kept on your entry. If you allow location access, a coarse coordinate from your device is sent with your search so that nearby results rank first. We do not store your location: it is used only to answer that search and then discarded. A place attached to a public entry is visible to everyone who can see that entry.

We use your data to:

• Provide, maintain, and improve the Service.
• Authenticate your account and keep it secure.
• Send transactional emails (account confirmation, password resets).
• Analyze usage to improve performance and features.
• Comply with legal obligations.

We process your personal data on the following legal bases:

• Contract. Processing necessary to provide the Service you signed up for (account data, user content, social data).
• Legitimate interest. Analytics and Service improvement, provided these interests are not overridden by your rights.
• Consent. Any optional communications, and device location for place search. You may withdraw consent at any time, and location access can be refused or revoked in your device settings.
• Legal obligation. Where required by applicable law.

We use the following categories of third-party services:

• Apple. App distribution (App Store) and authentication (Sign in with Apple). See Apple's privacy policy.
• Analytics. We use Umami, a privacy-focused, open-source analytics tool that we self-host on our own servers in Germany. Umami does not use cookies, does not collect personal data, and does not track users across websites. All analytics data stays on our infrastructure.
• Resend. We use Resend to deliver transactional emails such as account confirmations and password resets.
• Google. Place search is powered by the Google Places API. Your search text, and a coarse coordinate if you have allowed location access, are sent to Google to return results. These requests are made by our servers rather than your device, so Google does not receive your device identifiers or your Roastly account. Google's use of this data is governed by Google's privacy policy.

We do not sell or share your personal data with third parties for their marketing purposes.

Your data is stored on self-hosted servers located in Germany. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. However, no system is completely secure, and we cannot guarantee absolute security.

We retain your personal data for as long as your account is active. If you request account deletion, we will delete your data within a reasonable timeframe, unless we are required by law to retain it longer.

Two exceptions are kept deliberately short. Records of place searches, which we keep only to apply rate limits, are deleted after 30 days. Place details we cache from Google are refreshed or removed on a 30-day cycle; the name of a place you attached to a brew stays on that entry as part of your own record, for as long as the entry exists.

If you are in the European Economic Area, you have the following rights:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request correction of inaccurate or incomplete data.
• Erasure. Request deletion of your personal data.
• Data portability. Request your data in a structured, machine-readable format.
• Restriction. Request that we restrict processing of your data under certain circumstances.
• Objection. Object to processing based on legitimate interest.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@getroastly.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

You can delete your account and all associated data from within the app, under Profile. Deletion is immediate and cannot be undone: your entries, ratings, photos, follows, and profile are removed. You may also request deletion by emailing info@getroastly.com.

One thing does not disappear with your account: if you were the first person to add a café or restaurant to Roastly, that place stays, because other people's entries refer to it. It is no longer connected to you in any way once your account is gone.

The Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. For users under 16 in the European Union, parental or guardian consent may be required in accordance with GDPR. If we learn that we have collected data from a child without appropriate consent, we will delete it promptly.

The getroastly.com website does not use cookies. Our analytics tool (Umami) is cookieless and does not track users across websites. The mobile app does not use cookies either.

The Service does not currently display advertisements. If we introduce advertising in the future, we will update this Privacy Policy to reflect any associated data practices before doing so.

Your data is stored on servers in Germany within the European Economic Area. If any third-party service processes data outside the EEA, we ensure appropriate safeguards are in place as required by GDPR.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email. The “Effective” date at the top indicates when the policy was last revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

This Privacy Policy is governed by the laws of the Netherlands.

For questions or concerns about this Privacy Policy or your personal data, contact us at info@getroastly.com.