BeBartenderAbout the app
Privacy Policy
Effective date: 7 October 2026.
1. Controller and contact
The controller of personal data is Marek Przybolewski, an individual operating BeBartender. For app and personal data enquiries, email contact@bebartender.com.
Address: Jasna 7/63, 82-200 Malbork, Poland.
This policy covers the BeBartender app, the bebartender.com website and contact with the controller. The current app is free, without advertising or purchases. I do not sell users' data or use it for advertising tracking.
2. Data processed
Browsing the catalogue and complete recipes does not require sign-in or create an account. My Bar, favourites and personal ratings require an account. Guest access still involves the device storage, resource requests and infrastructure processing described below.
The app also stores whether you have already entered as a Guest or signed in. This on-device flag skips Welcome on later launches and remains after sign-out or account deletion. It does not identify an account or synchronise to the server.
- Account and sign-in. When you sign in with Google or Apple, the app receives an identity token and passes it to Supabase, which manages the account and session. Data includes account and provider identifiers, the email supplied, any available name, profile image URL and technical authentication information, such as address verification, sign-in time, organisation domain or use of a relay address. The scope depends on the provider and account. Apple may supply a relay address and your full name on first authorisation; the app does not separately save that name in Supabase. BeBartender does not receive your Google or Apple account password.
- Bar, favourites and ratings. I store selected ingredients, saved cocktails and ratings from 1 to 5 stars, linked to an account and timestamps. Your bar helps match recipes and identify missing ingredients; matching happens on your device. It does not record remaining bottle quantities or consumption history. Ratings contribute to aggregate scores, counts and rankings, including activity during the past seven days. Other users see aggregate results, rather than a list of people and their ratings.
- Feedback. A problem report or suggestion contains its message, kind and server date. You can send it as a Guest without signing in, creating an account or providing contact details. Signed-in submissions retain their verified account link; authorised people handling them see the available email or account identifier. Guest submissions have no account link and appear as Guest. A bug report includes the available app version, platform, operating system version and language; an Idea includes none of this context. Account deletion removes account-linked feedback. Historical feedback retained under earlier account-deletion rules and Guest messages may still contain personal data in their text. A separate account identifier record serializes signed-in submissions. For Guest abuse prevention, the server processes the network IP address and derives a secret-keyed technical digest. Separate limiter events store that digest and acceptance time; neither the IP nor digest is added to Feedback. People sharing a network address share ten accepted Guest submissions per rolling 24 hours. This processing does not make the message or digest anonymous.
- Session diagnostics. A report contains the outcome of a session recovery attempt, the event time and the time the server received it. It does not contain a user identifier, although sending it requires an authenticated session. Unsent reports wait on the device. A separate abuse-prevention counter stores the account identifier, UTC day and number of reports. Report dates and account links are also used to limit the number of feedback submissions.
- Logs and technical data. Supabase records authentication events, such as sign-in, session refresh and sign-out. Logs may include the account identifier, time, event type, IP address, client information and sign-in provider. Additional audit storage in the BeBartender database is disabled. Infrastructure providers also handle request data, such as IP address, time, resource address, method, response result and browser or app information, to deliver resources, investigate faults and protect services. Infrastructure logs also include approximate location (city and country) derived from the IP address, used for technical diagnostics and security. The app does not request access to the device's GPS location.
- Website visits. Reading the website does not require an account. The site has no advertising, form or additional visitor analytics; fonts and images are served from its own domain. Its code does not set cookies or store data in the browser. Hosting and traffic protection process the technical data described above. Clicking an email address opens your email app; I receive the message only after you send it.
- Correspondence. I receive the sender's address, message, attachments and other information you choose to send. Since 14 September 2026, the contact mailbox uses OVHcloud Zimbra. Earlier messages were forwarded through Cloudflare to consumer Gmail; changing providers did not delete earlier correspondence.
- On-device data. The app stores language, units and the names of up to six cocktails opened from search results. The initial language comes from system settings. Queries and filters work locally against the downloaded catalogue. You can clear recent result names. These preferences and history are not synchronised as separate account records; language may be included in a bug report. The session, with user data and account metadata, uses the operating system's secure storage. A random installation marker supports its operation. Images are cached.
- Sharing a recipe. The app creates a local image with the photo, ingredients, instructions and any available aggregate rating, in your chosen language and units. It is sent to the app or recipient you select in the system sharing menu. It does not include your account identifier, email, bar, favourites or individual rating.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account, sign-in, bar, favourites and ratings | Performance of the agreement to use the app — GDPR Article 6(1)(b), for data necessary for these features. |
| Handling voluntary feedback and correspondence, diagnosing faults, planning new features using users' suggestions and preventing abuse | Legitimate interests in maintaining and improving a functional, secure app and handling users' enquiries — GDPR Article 6(1)(f). This includes reviewing feedback retained without an account link under the earlier rules, subject to the retention limits and rights below. |
| Fulfilling and necessarily documenting data protection requests | Obligations under the GDPR — Article 6(1)(c). |
| Establishing, exercising or defending specific claims, if needed | The legitimate interest in protecting the controller's rights — GDPR Article 6(1)(f), limited to necessary data. |
| Delivering and protecting the public website | Legitimate interests in providing BeBartender information and maintaining availability and security — GDPR Article 6(1)(f), without advertising tracking. |
Authentication data is necessary for features requiring an account. You decide whether to populate your bar, save favourites, rate a cocktail, submit feedback or send an email. Do not include other people's data or sensitive data in a report unless necessary for the matter.
The app matches and orders recipes using your bar, filters and aggregate ratings. I do not use this to make decisions producing legal or similarly significant effects on you.
4. Recipients and service providers
People authorised to operate the app have access within their responsibilities. I use these services:
| Provider | Scope |
|---|---|
| Supabase Pte. Ltd., Singapore | Accounts, sessions, the database and app files: account data, bar, favourites, ratings, feedback, diagnostics and technical data. It processes entrusted data on my behalf. Supabase policy. |
| Netlify, Inc., USA | Hosting the admin panel. The panel retrieves from Supabase data including feedback content, kind and date, context, and the sender's identifier and available email. It processes entrusted data on my behalf. Netlify policy. |
| OVH Sp. z o.o., Poland (OVHcloud) | Zimbra contact mailbox: addresses, content, attachments and technical delivery and security data, including spam and virus filtering. It processes entrusted data on my behalf. OVH DPA, Zimbra terms. |
| Cloudflare, Inc., USA | Domain DNS and public website hosting on Cloudflare Pages, with technical visit data. It does not receive your bar, favourites, ratings or feedback content for this purpose. Historical email-routing events have separate retention; new email to contact@bebartender.com is not forwarded by Cloudflare. Cloudflare policy. |
| Google Ireland Limited, Ireland, for consumer services in the EEA | Optional Google sign-in, historical email in consumer Gmail and messages sent to separate domain addresses still forwarded to Gmail. OVH handles new email to contact@bebartender.com. Google applies its own policy; consumer Gmail is not a processor service with a data processing agreement. Google policy, Gmail information. |
| Apple Distribution International Limited, Ireland, for Apple accounts in the EEA | Optional Apple sign-in and a relay address. The relevant entity depends on the account's region. Apple operates its service under its own policies. Apple policy, Apple entities. |
Supabase, Netlify and Cloudflare standard terms include agreements for processing on the customer's behalf, including free plans; OVH's agreement forms part of the purchased service terms. Providers separately determine their own purposes for customer accounts, billing and security. Supabase, Netlify, Cloudflare.
App connections to Supabase use HTTPS. The native session uses operating-system secure storage. Access rules link private bar, favourites and individual ratings to the account, and the feedback panel is available to authorised people.
5. Processing locations and transfers
The Supabase project database is in West EU (Paris), France, EU. Netlify admin functions run in Ohio, USA. Content delivery networks, email, support and providers' infrastructure may operate in other countries; the database region does not mean all processing is European.
Transfers outside the EEA may include the USA. Supabase terms provide European Commission Standard Contractual Clauses (SCCs). Netlify and Cloudflare provide the EU–US Data Privacy Framework (DPF) for covered transfers and SCCs in other applicable circumstances. OVH specifies location and subprocessor rules and SCCs for covered transfers to countries without a relevant adequacy decision. Supabase DPA, Netlify DPA, Cloudflare DPA, OVH DPA.
Google and Apple describe international processing and safeguards in their own documents. These transfer descriptions do not establish a processor agreement for consumer Gmail. Google, Apple. You can request information about safeguards for BeBartender data and a copy through the contact address.
6. Retention
| Data | Retention period or criterion |
|---|---|
| Account, bar and favourites | Until account deletion. You can delete an individual bar entry or favourite earlier. Inactivity alone does not delete an account. |
| Ratings | While the account exists, you can change or delete a rating. Account deletion deletes your ratings; each cocktail's aggregate score, count and ranking are recalculated without them. Ratings from accounts deleted under the earlier rules, before this version of the policy, were retained without an account link: they carry only the stars, timestamps and cocktail identifier, still contribute to aggregate results, have no set expiry and remain until the cocktail is deleted. No rating is linked to a new account. |
| Feedback | No longer than 12 calendar months from the server originally receiving the report. Account deletion deletes your account-linked feedback earlier, including the message, kind, date and context. Feedback from accounts deleted under the earlier rules, before this version of the policy, was retained without an account link and remains until its original deadline; its text may still contain personal data — removing the account link did not make it anonymous. You can request its earlier erasure under section 7. |
| Session diagnostics on the server | No longer than 30 days from the server receiving the report. |
| Diagnostic counters | The current and previous UTC day; daily cleanup removes older counters. They are also deleted with the account. |
| Feedback limit record | Only the account identifier, from the first accepted feedback until account deletion. |
| Guest Feedback limiter events | Each separate event is removed within 48 hours of acceptance by scheduled hourly cleanup, including for continually active addresses. An outage that misses this deadline is a retention incident requiring cleanup. This deadline applies to the operational limiter, not message retention or separate infrastructure logs/backups. |
| Ordinary support correspondence | No longer than 12 months after the matter is resolved, including historical Gmail correspondence. Changing providers does not restart this period. |
| Data-rights request records | Only the minimum needed to fulfil and document obligations for the particular request. The need to retain records is assessed after the matter is resolved; they are erased when no longer needed for that purpose. A specific legal duty or dispute may justify retaining necessary data for the duration of that duty or for establishing, exercising or defending claims. This does not automatically cover all email. |
| Additional Auth audit in the BeBartender database | Storage is disabled and the table contains no historical entries. Supabase's separate authentication service logs remain. |
| On-device recent searches | Up to six names, until cleared, replaced by newer ones or successful in-app account deletion on that device. |
| On-device unsent diagnostics | Until sent, replaced by newer entries or successful in-app account deletion on that device; up to 100 reports, without a separate time-based expiry. Signing out does not clear the queue. |
| Language and units | Until changed or app data is removed. Signing out or deleting the account does not remove them. |
| On-device session | While sign-in is maintained. Successful sign-out or account deletion ends the local session. Technical markers and encrypted remnants that the app does not use to restore sign-in may remain in system storage. |
| Photos and sharing images | Cache or temporary files managed by libraries and the device system, without a separate app-set expiry. Signing out or deleting the account does not clear them. The recipient manages a copy passed to another app. |
Daily cleanup of diagnostics and feedback may remove a record up to one day before the maximum deadline. The device clock does not extend retention; account deletion ends the retention of your ratings and feedback earlier.
Provider logs and backups are separate categories. Plan documentation specifies a 1-day window for available Supabase Free API and database logs and 24 hours for Netlify Free function logs. Cloudflare's earlier email-routing events, including sender, recipient, subject and routing decision data, have a 31-day period; routing was disabled on 14 September 2026. These windows do not mean all internal provider data is deleted. Supabase, Netlify, Cloudflare.
I do not currently make my own database backups. The project uses the Supabase Free plan, which does not provide a customer-accessible automatic backup feature; the provider describes its own technical backups. If the plan changes, I will update this section with the backup retention period of the new plan before relying on it. Database backups contain Storage metadata, not the image files themselves. Internal provider logs and backups follow criteria relating to service purposes, security and legal duties and deletion terms after services end. I do not assign them a single deadline or equate deleting a record with immediate deletion of every copy. Supabase backups and the provider policies in section 4 describe their scope.
OVH Zimbra describes recovery of messages for 30 days after deletion from Trash; other security data and backups have separate rules. Gmail keeps a message in Trash for up to 30 days unless permanently deleted earlier. Google describes a deletion process usually lasting around two months and encrypted backups for up to six months, with legal and security exceptions. These provider cycles do not extend BeBartender's ordinary use of correspondence. OVH Zimbra, Zimbra terms, Gmail, Google retention.
Guest Feedback is not linked to an account created later, so deleting that account does not locate or erase earlier Guest messages. You can request erasure with an approximate date and brief description. Network processing also occurs in the separate provider infrastructure described above; the limiter deadline is not a promise that providers never process or log IP addresses.
7. Your rights and account deletion
Subject to the GDPR's conditions, you can request access, rectification, erasure, restriction and data portability. You can object to legitimate-interest processing on grounds relating to your particular situation. If processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
In the app, open Profile → Delete account and confirm your decision. An internet connection is required. The server verifies the current session and deletes the account, bar, favourites, ratings, feedback and limit records. Once the server confirms, the app ends the local session and clears recent searches and unsent diagnostics on that device. There is no waiting period; deletion cannot be undone. If an error occurs, the app lets you retry. Language, units and cached public images remain. Signing out or uninstalling the app alone does not delete the server account. Signing in again after deletion creates a new, empty account.
Your ratings and account-linked feedback are deleted with the account, under section 6. Feedback from an account deleted under the earlier rules was retained without an account link, and its text may still contain your personal data; you can request its erasure. Provide only what is needed to locate the report, such as an approximate date and brief description. The missing account link may make searching harder but does not remove rights concerning data that still identifies you. After verifying an applicable request, I erase that data or report unless a legal exception applies and explain the outcome.
Without installing the app, use the Account deletion page or email contact@bebartender.com. You do not need to give a reason. Where reasonably necessary, I will verify control of the account, including for an Apple relay address; do not send a password, token or identity-document scan.
Deleting your BeBartender account does not delete your Google or Apple account. On an iPhone or iPad, an account with an Apple identity requires confirmation again in Apple's system sheet so the server can revoke sign-in access. On Android and for email requests, the Apple connection may remain. For Google, the app attempts to disconnect access after deleting the BeBartender account. You can also check connections in your Apple settings and Google settings; this is not a condition for accepting a BeBartender account deletion request.
I provide information about action taken without undue delay and within one month of receiving a request. If its complexity or the number of requests justifies an extension by up to two further months, I will explain the reasons within the first month. If I refuse, I will explain the basis and available remedies. Straightforward erasure requests are handled without undue delay. You can complain to the competent supervisory authority, including the President of the Personal Data Protection Office in Poland.
8. Updates
When processing practices change, I update this policy and its date. The current version is available on the Privacy Policy page.