Privacy policy

This explains what Rate My Spritz collects, why, who else handles it, how long it's kept and what you can do about it. Rate My Spritz ("we") is responsible for your data (the "controller"). Questions or requests: help@ratemyspritz.com.

What we collect

• Account: your email address, username, optional display name, and when you joined and last signed in.
• What you post: spritz photos, the bar, drink type, price level, caption and your own rating. Photos are resized on your device before upload, which removes hidden location (GPS) data. If you type in a bar that isn't in the search, we record that you added it.
• Ratings, reactions and reports you give other spritzes, who you follow, and who you block. We also note the newest post you've seen in your Following feed, to show where you got up to, and the bars you save to your “Want to try” list (only you can see it).
• Days you use the site: the date (not the time or page) of each day you open the site while signed in, so we can count how many people use it each week. Only totals are shown, to our admins.
• Invites and feedback: if you join through a member's invite link we record whose link you used. Feedback you send us is stored with your username.
• Technical data: your IP address and browser details are processed when you use the site. We use your IP address to stop abuse (for example, limiting invite-code guesses and posting). Our providers also keep short-lived server and sign-in logs (see "How long we keep it").

Cookies and storage on your device

We only use what's needed for the site to work: cookies that keep you signed in and remember that you entered an invite code, and one setting in your browser's storage that remembers if you dismissed the "add to home screen" tip. No advertising or analytics cookies, so there's no cookie banner.

Why we use it (and our legal basis)

• To run the site for you: accounts, posts, ratings, rankings and sign-in emails (performing our agreement with you under the terms).
• To keep the site safe: moderation, rate limits, blocking abuse and handling reports (our legitimate interests).
• To see how the site is doing: counting how many people use it each week and in which cities, as totals (our legitimate interests).
• To email you about moderation, for example if we remove one of your posts, and to alert our moderators to reports (which include the reporter's and reported person's usernames).
• We don't send marketing emails, sell your data or use it for advertising.

Who can see what

• Members (during the private beta, only invited people) can see your username, display name, posts, photos, the ratings and reactions you give, and how many followers you have. Who you follow is visible only to you and the person you follow. Who you block is visible only to you; blocked people aren't told. Notifications (someone rated or reacted to your spritz, or followed you) are shown to you inside the site only.
• Followers-only posts are shown only to followers you've approved (and to our moderators). They aren't included in rankings.
• Posts aren't shared outside the site: only signed-in members can open a post, and there are no public previews.
• Photos (including those on followers-only posts) are stored at hard-to-guess public web addresses: anyone who is given a photo's exact address can view it. We ask search engines not to index posts during the beta.
• Your email address is never shown to other users.

Who else handles your data

• Supabase: database, sign-in and photo storage (servers in Frankfurt, Germany).
• Vercel: website hosting (processing in Frankfurt, delivered through a global network).
• Resend: sends sign-in emails (servers in Ireland).
• OpenStreetMap services: what you type into the bar search goes to Photon (run by komoot in Germany); we look up the bars you pick with Nominatim; and map pictures load from OpenStreetMap's tile servers. These services see your IP address, and the map pictures can show roughly which area you're looking at, including around you if you use "Near me". We never receive or store your location.

Supabase, Vercel and Resend are US-headquartered, so data may be accessed from outside the UK and EU. Where that happens it's protected by approved safeguards: for UK users the UK International Data Transfer Addendum or the UK–US data bridge, and for EU users the EU standard contractual clauses or EU–US Data Privacy Framework.

How long we keep it

• Your account, posts, photos, ratings and reports: until you delete them or your account.
• IP-based abuse records: deleted automatically after 1 day.
• Sign-in sessions (which include your IP address and browser): until you sign out or the session expires.
• Provider logs (hosting, sign-in and email delivery logs): kept by those providers, usually for days to a few weeks.
• Invites (emails added with an invite code or link) that never become an account: deleted after 30 days.
• Notifications and feedback: deleted after 90 days.
• Backups of the database and photos, so the site can be recovered after a mistake or outage: we keep the four most recent copies (made about weekly), stored encrypted, so anything deleted is gone from backups within about a month.
• Blocked emails: kept for as long as the block lasts.
• Admin moderation records (which can include an email or account ID): kept for 12 months.
• Days you used the site: deleted after 12 months.
• Removed photos are deleted from storage. Cached copies can take up to a day to disappear, and our providers' backups roll over on their own schedules.

Your rights

You can ask to access, correct, download, restrict, object to or delete your data. On your profile page you can edit your details, download a copy of your data, and delete your account (which removes your profile, posts, photos, ratings and reports). For anything else, email help@ratemyspritz.com. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Age

Rate My Spritz is about alcoholic drinks and is only for people aged 21 or over.

Changes

If we change this policy, we'll update the date at the top and, for significant changes, tell members.