← Home

Privacy Policy

DRAFT — this page has not been reviewed by a solicitor and is not yet in effect. It exists to establish the real structure and content this app needs before wider launch. Sections marked PLACEHOLDER below are business/legal decisions (exact retention periods, governing law, formal contact details) that need confirming; everything else describes what the app actually, concretely does today, verified against its real code.

Manchester Drink Finder (“we”, “the app”) is a site for finding which Manchester cafes sell a specific drink, built from menus photographed and submitted by users. This policy explains what personal data we collect, why, how long we keep it, who else it's shared with, and how to have it deleted.

What we collect

Account information

When you sign up: your email address, a display name you choose, and your password — never stored in plain text, only a one-way bcrypt hash of it, which cannot be reversed back into your actual password even by us.

Content you submit

Menu photos you upload (stored in Vercel Blob storage), the drink names/prices/categories automatically extracted from them, star ratings (1–10) you give a drink, whether you mark a rating “public” or keep it private to your own diary, “still available at this price” confirmations, your “tried it” history, and any cafe you suggest (name and address).

Location

If you use “Near me” sorting, your device's location is read once, in your browser, using the standard browser Geolocation API — after you're shown an explanation and asked to confirm. That location is used entirely on your own device to calculate distance to each cafe and is never sent to, or stored on, our servers.

Technical/usage data

Standard request metadata (IP address, timestamps) is processed transiently to enforce rate limits against abuse (e.g. repeated failed logins, scripted submissions) and is not retained as a separate log of your activity beyond what's needed for that.

Why we collect it

Who we share data with

We don't sell personal data. The following third-party services process data as part of running the app:

Cookies

We use one essential session cookie to keep you logged in — the app can't function without it, and it isn't a tracking cookie. If you accept tracking in the cookie banner, Sentry's browser SDK also becomes active for crash reporting; declining keeps it off entirely. You can change this choice at any time — see the banner shown on your first visit, or clear your browser's local storage to see it again.

How long we keep it

Account and content data is kept for as long as your account exists, or until you request its deletion (see below).

PLACEHOLDER — confirm with a solicitor before launch: exact retention periods for specific data types (e.g. should rejected/deleted menu submissions, or inactive accounts after N years of no login, be purged automatically on a schedule, rather than only on explicit request?).

Your rights, and deleting your data

You can delete your account and its personal data at any time from your profile page, with immediate effect — no need to email anyone. This permanently removes your account, display name, email, password, tried-drinks diary, and availability confirmations. Your star ratings are kept but anonymized (disconnected from your account entirely) rather than deleted outright, so that the average rating shown to other users for a drink doesn't change just because you closed your account — once anonymized, a rating can no longer be traced back to you by us or anyone else.

If you can't access your account, contact us using the details below and we'll verify your identity and action the request manually.

PLACEHOLDER — confirm with a solicitor before launch: formal data-subject-rights language (access, rectification, portability, objection) and which specific data protection law(s) govern this (e.g. UK GDPR) — depends on where users are based and needs a solicitor's framing, not a developer's guess.

Changes to this policy

If this policy changes materially, we'll update this page and, where practical, notify account holders.

Contact

PLACEHOLDER — confirm with a solicitor before launch: a real, monitored contact email/address for privacy requests goes here.

We use one essential cookie to keep you logged in — it can't be turned off. If you say yes, we also use Sentry to report errors when something breaks, so we can fix it. Privacy Policy