Privacy Policy

In short

We collect what you give us when you make an account or post a review, standard web server logs, and — once advertising is switched on — some data for ad delivery through our ad partner(s). We don't sell your personal information. We don't run session-recording or behavioural analytics ourselves. Accounts are for people 13 and over.

1. Who this policy covers

This policy applies to thecoffeereview ("The Coffee Review", "we", "us"), an independently run café review website based in Perth, Western Australia, and to everyone who visits or creates an account on it ("you").

2. What we collect

• Account details — if you sign up, your email address and password are handled by Firebase Authentication (Google Cloud). We never see or store your raw password ourselves — Firebase stores it in hashed form, and we only check a prospective password against a public breach database at signup (see §6).
• Reviews and ratings you post — your star rating, written comment, and a display name derived from your email are stored and shown publicly on the relevant café's page.
• Reported corrections — if you flag inaccurate café information, we store what you submit and your email if you chose to give one, so we can follow up.
• Standard server logs — like effectively every website, our hosting provider (Firebase Hosting / Google Cloud) automatically logs visitor IP addresses and basic request data (page requested, browser type, timestamp) for security, abuse prevention and performance. We don't run our own analytics or tracking scripts on top of this.
• Advertising data (once advertising is enabled) — we intend to show third-party display advertising, currently expected to be served through Adsterra, and may use other ad networks in future. When active, these networks may set cookies or use similar technologies, and may collect your IP address, device/browser information, and approximate location to select and measure ads, and in some cases to personalise which ads you see. This data is collected and processed by the ad network under its own privacy policy, not stored by us. Until advertising is actually live on the site, none of this collection happens.

3. Cookies & similar technologies

Right now, the only thing resembling a cookie on this site is the session token Firebase Authentication uses to keep you logged in — that's strictly necessary for the site to work and isn't used to track you elsewhere. We don't currently use analytics or advertising cookies. When advertising goes live, the ad network(s) we use (e.g. Adsterra) may set their own cookies or device identifiers for ad serving and measurement, and — where legally required, such as for visitors in the UK/EU — we'll show a cookie notice letting you accept or decline non-essential cookies before they're set. You can also control cookies through your browser settings at any time, and opt out of personalised advertising generally via resources like youronlinechoices.com or your device's ad-tracking settings.

4. How we use your data

To run your account and let you post reviews; to show café information, prices and ratings to other visitors; to respond to correction reports and support requests; to keep the site secure (fraud/abuse prevention, rate-limiting); and, once live, to serve and measure advertising that helps fund running the site. We don't use your data for anything beyond operating and improving The Coffee Review.

5. Who we share it with

• Firebase / Google Cloud — hosting, authentication and database infrastructure. Data may be processed on Google Cloud servers outside Australia.
• HaveIBeenPwned — at signup, the first 5 characters of a hash of your chosen password are sent to check it against known data breaches. Your actual password, or a hash that could be reversed to it, is never transmitted (this is a "k-anonymity" check — see their explanation).
• Advertising partners (once live) — e.g. Adsterra, under their own privacy policy, for the purposes described in §2 and §3.
• We don't sell personal information, and we don't share it with anyone else for their own marketing purposes.

6. Password security

New passwords must be at least 8 characters with a letter and a number, and are checked against a public breach database before an account is created (see §5). This is a security measure for your benefit, not a data collection exercise — we don't log or store the result anywhere beyond the signup form itself.

7. Your rights

Wherever you're located, you can ask us to access, correct, or delete the personal information we hold about you (see §10). If you're in the EU or UK, you have rights under the GDPR including access, correction, erasure, restriction and data portability. If you're a California resident, you have rights under the CCPA/CPRA, including the right to know what we collect and to request deletion — and to be clear, we don't sell your personal information. We'll honour reasonable requests regardless of where you live.

8. Children

The Coffee Review isn't directed at children, and accounts are only for people aged 13 and over — this is confirmed at signup. We don't knowingly collect personal information from anyone under 13, and any advertising shown on the site isn't intentionally targeted at children. If you believe a child has created an account, contact us (§10) and we'll remove it.

9. Data retention & security

We keep account and review data for as long as your account exists, and correction reports until they're resolved. Access to café/menu management and to correction reports is restricted to approved admin accounts, enforced by database security rules rather than just by the app's interface. No method of storing or transmitting data is 100% secure, but we take reasonable, standard precautions appropriate to a small independent site.

10. Questions, deletion requests & changes to this policy

Want your account or a review removed, or have a question about this policy? Email thecoffeereview.au@gmail.com, or use the "Is this information inaccurate?" link on any café page for factual corrections. We may update this policy as the site grows (for example, when advertising actually goes live); the "last updated" date at the top will always reflect the current version.