Privacy

The short version

You can use almost all of Bean Clarity without telling us anything. There is no analytics, no advertising, and no tracking of any kind on this site. If you make an account we store your email address, because it is how you sign in. If you join a mailing list, your address is held by the company that sends the email and not by us.

What we do not do

No analytics package is installed. No Google Analytics, no Meta pixel, no Plausible, no PostHog, nothing. We do not profile you, we do not advertise, we do not sell or share your address, and we never pass it to a roaster. Our emails carry no tracking pixel, so we cannot tell whether you opened one.

Browsing the catalogue sets no cookie at all. The only things kept in your browser without an account are your colour theme and your saved coffees, and both stay on your device.

What we store, if you make an account

• Your email address. It is how you sign in and the only way to reach you.
• A handle. Generated for you, never built from your email address, and the only thing other readers can see. You can change it.
• When you signed up and when you last signed in.
• Your saved coffees, once signed in, so they follow you between devices.
• Anything you write about a coffee. Private by default: visible to you and to nobody else. Nothing you write is published unless that changes and you are told.

Signing in

We send a link rather than asking for a password. The link is single use and expires in fifteen minutes. We never store the link itself, only a one way hash of it, so a copy of our database would not let anyone sign in as you.

We store the IP address a sign-in link was requested from, for a short time and only to stop somebody using the form to send mail to strangers. It is never shown and never attached to your account.

If you sign in with Google or Facebook, we store the identifier that provider gives us for you, and the email address they share. We do not receive your password, and we ask for nothing beyond your name and email address.

Cookies

Two, both strictly necessary, neither used for tracking:

• bc_session, set when you sign in and lasting sixty days. It holds an opaque identifier, your handle and an expiry date. It deliberately does not contain your email address.
• bc_oauth, set only while you are signing in with Google or Facebook, lasting ten minutes. It exists to confirm the sign-in that comes back is the one you started.

Both are HttpOnly, so the page’s own JavaScript cannot read them.

The newsletter and alerts

These are run by utobo, the company that sends our email. If you sign up, your address is held by them and not by us: we deliberately keep no subscriber list, so there is no second copy to go out of date when you unsubscribe. Every email has an unsubscribe link, and leaving a list does not affect signing in.

We store one thing locally about sign-ups: a record that an address was submitted, used only to rate limit the form, and deleted automatically after an hour.

Who else sees your data

• Neon hosts the database, in London.
• Vercel hosts the site and serves the pages.
• utobo sends our email, using Amazon SES underneath.
• Google and Facebook, only if you choose to sign in with them, and only to the extent of confirming who you are.

That is the whole list. Nobody else, and no advertiser.

How long we keep it

Your account and anything you wrote are kept until you ask us to delete them. Sign-in links expire in fifteen minutes. Rate limiting records are deleted after an hour. Sessions expire after sixty days.

Deleting your data

Email hello@beanclarity.com from the address on the account and ask. We will delete your account, your saved coffees and anything you wrote, and confirm when it is done. You do not need to give a reason.

To leave a mailing list, use the unsubscribe link in any email, which is immediate. That is separate from deleting an account, and doing one does not do the other.

There is no self service delete button yet. Until there is, the address above is the way, and it is read by a person.

Your rights

Under UK data protection law you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@beanclarity.com. If you are not satisfied with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If what we store changes, this page changes with it and the date at the top moves. It is written from what the code actually does rather than from a template, so it should never describe a different site from the one you are using.

How we build the catalogue is a separate question, and that page answers it.