Privacy Policy
Last updated October 27, 2026
In short: the public site doesn't collect anything about you. The invite-only app keeps what you log so it can work. Nothing is sold, there are no ads, and there are no third-party trackers. You can ask for a copy of your data, or for it to be deleted, at support@registry.coffee.
Who runs this
registry.coffee is run by an individual (the "operator", "we" or "us"), not a company. This policy covers registry.coffee (the launch page and the catalog), the shot-logging app at app.registry.coffee (the "app"), and the public dataset built from the catalog.
The public site and catalog
- The site doesn't set cookies, run analytics, or load scripts, fonts or images from other services.
- If you switch between light and dark, your choice is saved in your own browser's local storage. It never leaves your device.
- The site is hosted on GitHub Pages. Like any web host, GitHub receives your IP address and browser details when you load a page, and may log them for security. That's covered by GitHub's privacy statement; we don't receive those logs.
- Catalog links take you to roasters' own websites, whose privacy policies apply there.
- The catalog lists products and businesses, not people. It holds what roasters publish on their public storefronts: coffee names, prices, stock and the like.
What the app collects
The app is invite-only. When you use it, we keep:
- Your account: your username and a hash of your password. We never store the password itself.
- What you log: shots, bags, equipment and any notes you write.
- Bag photos you upload. Location and other EXIF metadata is removed before the photo is stored.
- Technical data:
- Your IP address, which the app holds in memory only, to apply rate limits.
- App logs of each request's route, status, timing and your user id. Request contents aren't logged.
- Request logs that Google Cloud records automatically for every request: IP address, browser details, the URL requested and the response status. They're kept in Google Cloud Logging for about 30 days by default.
- Cookies: one to keep you signed in, and two that remember your theme and handedness. None are used for tracking or advertising.
Why we use it
- To run the app: show your history, suggest your next shot, and match bags to the catalog.
- To keep it secure and prevent abuse, for example with rate limits.
- To find and fix problems.
We may also use aggregated or de-identified data, which can't reasonably identify you, to run and improve the service and to publish statistics about it. For example: "washed Ethiopians are most often brewed at 1:2.2".
Who processes it
We use these services to run registry.coffee. Each receives only what it needs for its part:
- Hugging Face: stores the app's data and the public dataset.
- Google Cloud: hosts the app (Cloud Run, in the United States) and keeps its logs.
- Anthropic: reads the label on a bag photo, and only when you upload one, to fill in the coffee's details.
- GitHub: hosts the public site and the code.
Your data is stored and processed in the United States.
What we don't do
- We don't sell or rent your personal data.
- We don't show ads.
- We don't use third-party tracking or analytics.
How long we keep it
We keep your data while your account exists. The data store is append-only, meaning records are added rather than overwritten. So when you ask for deletion, we remove your records within 30 days. Copies may remain in backups or in the data store's version history for a limited time afterwards, until they're overwritten or expire.
Your choices and rights
Email support@registry.coffee from the address on your account (or tell us your username) to:
- get a copy of your data
- correct it
- delete it, along with your account
We may need to confirm it's you before acting. Depending on where you live, you may have other rights under local law, and we'll honor them where they apply.
Security
We use reasonable measures to protect your data:
- HTTPS everywhere
- password hashing
- secrets kept out of the code
- access limited to what each part needs
No system is perfectly secure, and we can't guarantee that yours won't be accessed, disclosed or lost.
Children
registry.coffee isn't meant for children under 13, and we don't knowingly collect their personal information. If you believe a child has given us information, email us and we'll delete it.
Changes
We'll post any changes on this page and update the date at the top. If you keep using registry.coffee or the app after a change, you accept the updated policy.