Privacy notice

The short version

• You can browse without an account. If you do, we don't set cookies or store anything in your browser, and nothing is loaded from Google.
• If you create an account, we store your email address, the coffees you rate, any tasting notes and brew notes you write and your flavour preferences. We use them only to show them back to you and recommend coffees.
• We don't sell your data, show adverts, or share your ratings with roasters or anyone else.
• You can download or delete everything from your account page at any time.

Who we are

Bean Counter is a non-commercial hobby site, run by an individual in the UK, that compares speciality coffee from UK roasters. For data protection law, the person who runs it is the "controller" of your personal data.

If you just browse

• The site is a set of ready-made pages served by Cloudflare. Like any web host, Cloudflare handles your IP address and basic browser details to deliver the pages and protect the site from attacks. We don't use this to identify you.
• We don't use any analytics at the moment. If we switch on Cloudflare Web Analytics, which doesn't use cookies or store anything on your device, we'll say so here.
• Coffee photos are shown straight from each roaster's own website, so your browser fetches them from there. As with any image on the web, the roaster's site can see your IP address and that the request came from our site.
• When you follow a link to a roaster, you're on their site and their privacy policy applies. Our buy links addutm_source=coffeebeansprofiler so they can see the visit came from us; they don't identify you.

If you create an account

We store:

• Your sign-in details, held by Firebase Authentication: your email address, when you joined and last signed in, and whether you've confirmed your email address. If you sign in with Google, Google also passes us your name and profile picture link. If you use a password, Firebase stores it securely hashed; we never see it.
• Your ratings: which coffee, your score from 1 to 5, any tasting notes you write, and when you last changed it. With each rating we also keep the coffee's name, roaster, flavour profile, origin, process, roast style and whether it's decaf, so your ratings still make sense if the coffee is no longer listed.
• Your brew notes: for each coffee you save them for, whichever of these you fill in: brew method, grinder, grind setting, dose, yield, water temperature, brew time and notes, plus the coffee's name and roaster and when you last changed them.
• Your "not coffee" reports: which item you reported, its name, roaster and shop link, anything you wrote about it, and when. These are linked to your account so you can withdraw them and so one person can't report the same item twice.
• Your roaster suggestions: the website you suggested, plus any name, town and note you added, and when. Linked to your account so one person can't suggest the same roaster twice.
• Your flick game score, if you save one: your best score and the name you choose for the leaderboard. Unlike everything else here, this is public: anyone can see the leaderboard's names and scores.
• Your flavour preferences (the 0 to 9 sliders) and whether you want decaf coffees recommended.

We use this only to provide the features you signed up for: showing your ratings and brew notes and working out recommendations. In data protection terms, the lawful basis is that it's necessary to provide the service you asked for. Recommendations are worked out in your own browser, not on a server.

The only emails we send are the ones needed to run your account (confirming your email address and resetting your password). They come from Firebase's address on our behalf. No newsletters, no marketing.

Your tasting notes and brew notes are private: only you can see them. Your "not coffee" reports and roaster suggestions are seen by you and by us (the site owner), and are used only to fix how the site reads roasters' shops and to add roasters. We delete each one once we've dealt with it.

Who else handles your data

• Google (Firebase) stores and processes account data for us, under Google's data processing terms. Ratings and preferences are stored in Google's europe-west2 (London) data centre, as configured for this site. Firebase Authentication is a global service, so your sign-in details may also be processed outside the UK, including in the United States, under Google's standard data protection safeguards. Google also handles your IP address when you sign in, to protect accounts from abuse.
• Cloudflare hosts the site.

Nobody else gets your data, unless the law requires us to share it.

Cookies and storage in your browser

Anonymous visitors: none. We don't set cookies, and nothing is saved in your browser's storage.

Once you sign in (or start signing in), the following are used. They're needed for the sign-in you asked for, so we don't ask for separate consent:

• Firebase keeps you signed in by storing your session in your browser's IndexedDB (or local storage if that isn't available), plus a little technical housekeeping of its own (such as which version of its software last ran). If you choose Google, Google's sign-in window sets its own cookies, as it does on any site that offers Google sign-in.
• We store a small flag, cbp:signedIn, in local storage, so pages know to load the sign-in features for you and nobody else.
• We keep a temporary copy of your ratings, brew notes and preferences in session storage, so we don't have to fetch them on every page. It's cleared when you close the tab.

Signing out removes your session, the flag and the temporary copy.

How long we keep it

• Your ratings, notes, brew notes and preferences stay until you delete them or your account.
• Deleting your account removes your sign-in, ratings, notes, brew notes, reports, suggestions, game score and preferences from the live service straight away. We keep an encrypted backup, taken every few months and deleted after 90 days, so deleted data is gone from our backups within 90 days too.
• If we ever close the site, we'll delete everything.

Your rights

Under UK data protection law you can:

• Get a copy of your data: use “Download my data” on your account page (a JSON file).
• Correct it: edit any rating, brew note or preference on your account page.
• Delete it: delete single ratings or brew notes, or use “Delete my account” to remove everything.
• Object to how we use it, or ask us to restrict it. Deleting your account stops all use straight away.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Children

The site is meant for adults. Please don't create an account if you're under 13.

Changes to this notice

If we change what we collect or how we use it, we'll update this page and the date at the top.