BrewTrails Privacy Policy

Last updated: [DATE] [LEGAL ENTITY NAME] ("BrewTrails", "we", "us") Contact: [SUPPORT EMAIL]

1. Scope

This policy explains what we collect through the BrewTrails app, why, who we share it with, and the choices you have. It applies to the app and related services. It does not apply to third-party services you reach from the app, such as Uber — their own policies govern once you leave.

You must be 21 or older to use BrewTrails. We do not knowingly collect information from anyone under 21.

2. What we collect

2.1 You give us

Data	Where it comes from
Email address and password	Sign-up. Passwords are hashed by our authentication provider; we never see them.
Date of birth	Sign-up — used to enforce the 21+ requirement.
Display name, username, bio, avatar	Profile setup.
Favourite beer styles, home brewery, travel mode, designated-driver flag	Profile, optional.
Home address	Optional. Stored as the text you typed and as coordinates, and used to set a ride's destination.
Check-in comments, beer ratings, photos	When you record a visit.
Trail names, stops, and collaborators	When you plan a trip.
Follows, comments, kudos	Social features.
Brewery claim documents	If you claim a listing: your legal name and a document such as a TTB brewer's notice, licence, permit, or utility bill. See §4 — this is the most sensitive data we handle.
Brewery content	If you are a verified owner: photos, hours, specials, tap list, about text.

2.2 Collected automatically

Location. With your permission, including in the background if you grant "Always" — used to detect arrival at a stop on an active trail and to show nearby breweries. You can revoke this at any time in iOS Settings.
Privacy zone. If you set one, we store its centre and radius so we can suppress precise location near it.
Device token for push notifications, if you enable them.
Visit timestamps and coordinates when you check in.
Basic technical and diagnostic data (app version, OS version, error logs).

2.3 We do not collect

Blood alcohol content, impairment, or any health measurement. The app makes no assessment of whether you can drive.
Payment card details. We do not process payments in the app today.
Your contacts, calendar, microphone, or messages.

3. Why we use it

To provide the app: accounts, trails, check-ins, ratings, social features.
To show nearby breweries and detect arrival at stops.
To pass a destination to a ride provider when you ask for a ride.
To verify brewery ownership claims (§4).
To send notifications you have enabled.
To keep the service secure, prevent abuse, and debug failures.
To comply with law.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. Brewery claim documents — read this

To verify that you own a brewery, we ask for a document proving it. Because that document usually identifies you personally, here is exactly what happens to it:

Upload. It is stored in a private storage bucket. Access is restricted so that only you and our service systems can read it.
Automated review. The document is transmitted to Anthropic (api.anthropic.com), an AI provider, which reads it and returns a structured summary comparing it to your claim. The document image or PDF itself is sent, not merely a description of it.
Human review. The summary, your legal name, the brewery, and a signed link to the document valid for 72 hours are posted to a private Slack channel used by our review team. A person — never the automated system — approves or denies the claim.
Retention. The document remains in private storage attached to the claim record. It is deleted when you delete your account (§8).

The automated system never decides. It reads and summarises; a human approves or denies.

If you are not comfortable with this, do not submit a claim. Contact [SUPPORT EMAIL] to discuss alternatives.

5. Who we share with

We share personal information only as described here.

Recipient	What	Why
Supabase	All account and app data; uploaded files	Our database, authentication, storage, and serverless functions provider (processor).
Anthropic	Brewery claim documents; brewery details for badge suggestions	Automated reading of claim documents (§4).
Slack	Claim summaries, legal name, brewery details, and a 72-hour signed document link; badge requests	Our internal review workflow (§4).
Uber	The destination coordinates and label you choose, when you tap to request a ride	To pre-fill your drop-off. Uber's own privacy policy governs from that point.
Apple	Device token	Push notification delivery.
Map and geocoding services	Addresses you enter; coordinates	To convert addresses to coordinates and draw routes.

We may also disclose information if required by law, to enforce our terms, or to protect the rights or safety of anyone — and in connection with a merger or sale of assets, in which case we will notify you.

6. What other users can see

Your display name, username, avatar, and bio are visible to other users.
Check-ins, comments, ratings, and photos are visible according to your privacy settings and the visibility you choose for a trail.
If you set your profile to private, your activity is limited to people you approve.
Your home address is never shown to other users. It is used only to set a ride destination.
Brewery owners see check-in comments at their brewery without any identifying information — no name, username, or avatar — unless you and the owner follow each other.
If you enable live location sharing on a trail, people you share the trail with can see your position while it is active. A privacy zone, if set, suppresses precise location near that place.

7. Security

We use access controls enforced at the database level, encryption in transit, private storage for sensitive files, and scoped credentials. Claim documents sit in a private bucket readable only by their owner and our service systems.

No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and any regulator as required by law.

8. Retention and deletion

We keep your information while your account exists.

You can delete your account at any time from Settings. Deletion removes your profile, check-ins, ratings, photos, trails you created, follows, comments, and your claim documents, and releases any brewery you own so another owner can claim it. Some content that is not personal to you — such as photos published for a brewery you managed — may remain associated with that business.

Backups may retain copies for a limited period before being overwritten. We may retain records where required by law.

9. Your rights and choices

Everyone:

Access and correct most of your information in the app.
Delete your account and data from Settings.
Turn off location, background location, and notifications in iOS Settings at any time.
Set your profile private, choose default trail visibility, disable live location sharing, and set a privacy zone.
Remove your home address from Settings → Rides.

US state privacy rights (including California). Depending on where you live, you may have the right to know what we collect, to obtain a copy, to correct or delete it, and not to be discriminated against for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising. To exercise a right, contact [SUPPORT EMAIL]. We may need to verify your identity.

EU/UK, if applicable. You may have rights of access, rectification, erasure, restriction, portability, and objection, and a right to complain to your supervisory authority. Our bases for processing are performance of our contract with you (providing the app), your consent (location, notifications, claim document review), and our legitimate interests (security and abuse prevention).

10. International transfers

We are based in the United States and our providers may process data there and elsewhere. If you use the app from outside the US, you understand your information will be transferred to and processed in the US, where privacy laws may differ from your own.

11. Children

BrewTrails is for people 21 and over. We do not knowingly collect information from anyone under 21. If you believe a minor has given us information, contact [SUPPORT EMAIL] and we will delete it.

12. Changes

We may update this policy. If a change is material we will give notice in the app or by email before it takes effect, and update the date above. Continued use after the effective date means you accept the updated policy.

13. Contact

[LEGAL ENTITY NAME] [ADDRESS] [SUPPORT EMAIL]