Privacy Policy

1. Who we are

CoffeeStops is operated by Almås Labs, based in Norway (“we”, “us”). If you have questions about this policy or how we handle your data, contact us at coffeestops@almaslabs.no.

2. What we collect

• Account information — your email address and password when you create an account, or your name, email address, and profile picture if you sign in with Google. Your password is handled by our authentication provider, Supabase, and is never stored in plain text by us.
• Profile information — the username, display name, and avatar you choose to set.
• Content you submit — the name, description, and location of coffee stops you add, and any photos you upload. Photos are compressed in your browser before upload, which strips EXIF metadata (including any embedded GPS location) from the image file.
• Ratings — the scores you give a stop for things like beverages, food, service, restrooms, and atmosphere.
• Reports — if you flag a stop or a piece of content, we store the reason you give and the outcome of our review.
• Admin activity— if you're an administrator, actions you take (e.g. hiding content, banning a user) are logged against your account for accountability. We do not log IP addresses.

3. Why we process your data

We use this data to run your account, publish the coffee stops and photos you choose to share, show ratings to other cyclists, and moderate content on the platform. This is necessary to provide the service you've signed up for, or is in our legitimate interest in keeping the platform trustworthy and abuse-free.

4. Who we share it with

We use the following processors to run CoffeeStops:

• Supabase— authentication, database, and file storage. Supabase may process data outside the EU/EEA; where it does, this is covered by Supabase's own data processing agreement and standard contractual clauses.
• Google Maps Platform— to display the map and let you search for places. Loading the map sends your IP address and search queries to Google. If you choose “Continue with Google” to sign in, Google also shares your name, email, and profile picture with us.

We do not sell your data, and we do not use any analytics or advertising trackers.

5. Cookies

We only use one cookie: a session cookie set by Supabase to keep you signed in. We don't use analytics or marketing cookies, so there's no cookie banner.

6. How long we keep it

We keep your account and content for as long as your account exists. Deleting a stop you submitted removes it from public view; deleting your account (see below) removes your personal data, except where we're required to keep records, such as moderation logs kept for abuse prevention.

7. Your rights

Under GDPR, you have the right to access, correct, delete, or export your data, and to object to or restrict how we use it. To exercise any of these, email coffeestops@almaslabs.no. You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you think we've mishandled your data.

8. Deleting your account

CoffeeStops doesn't yet have a self-service “delete account” button. To delete your account and personal data, email coffeestops@almaslabs.no from the address on your account and we'll process the request manually, normally within 30 days.

9. Location data

If you allow it, your browser's location is used to center the map on your position. We don't store or transmit this location — it stays in your browser.

10. Children

CoffeeStops isn't directed at children, and we don't knowingly collect data from anyone under 16.

11. Changes to this policy

We'll update this page if how we handle your data changes, and update the date at the top.