Privacy Policy — Specialty Atlas (app, website and B2B)

Last updated: 4 November 2026

1. Controller

The controller of personal data is Marcin Dziubak (Poland), who operates Specialty Atlas. Privacy contact: contact@specialtyatlas.com or Help in the app.

2. Scope of this document

We describe processing when you use:

the mobile app (consumer features),
the website (marketing, blog, public café/event/user profiles, city pages, authentication helper pages),
the B2B portal for cafés and roasteries (account, listings, subscriptions, statistics).

Individual processes (for example payment) may have short supplementary notices.

3. What data we process

Account and sign‑in. Email, password hash, display name, username and its previous aliases, profile bio, avatar choice, account identifiers for Google/Apple sign‑in, session tokens on the device or in the browser, optional date of birth.

Consumer profile and activity. Language, theme, time format, favourites, hidden places, blocked users, profile and section visibility settings, notification and sound preferences.

Passport and gamification. Check‑ins (QR scan at a venue: café, time, source), city and venue stamps, Coffee Miles — the ledger of awards with their reason, levels, badges and their progress.

Coffee activity. Visit ratings (score, text, highlight chips), bean ratings, recipes and brew sessions (parameters, gear, grinder, method), the Coffee DNA taste profile and preference quiz answers, favourite and excluded tasting notes, private notes about places, the “Want to visit” list.

Community content. Buzz posts and comments with photos and @ mentions, friend relations (requests, acceptances, blocks), public profile, activity feed, Wrapped (a recap built from your own history) and shareable cards.

Content translation. When a Buzz comment or a café or roastery description is saved, its text is sent to Google Cloud Translation, which detects its language. When someone chooses “See translation”, the same service translates the text into the app language. We keep the translation together with the original and delete it when the text is edited or removed. Google receives only the text, without your account data.

Reports and suggestions. Reports of content, places and events, change suggestions for café data, new venue submissions, messages from Help forms, moderation decisions and their statements of reasons.

B2B partner data. Company name, billing details, venue addresses, contact phone numbers and emails, photos and offer descriptions, opening hours, “on bar” beans, events, subscription status, portal events, and notes and contact history in our internal CRM.

Venue data from other sources. We also build the café and roastery catalogue from publicly available information and user submissions. This concerns primarily business data (name, address, hours, public contact); where it includes data of a natural person running the venue, that person has the rights described in section 10.

Location. Approximate or precise coordinates after a system permission — map, nearby search, walking navigation, recommendation context, and notifications when a place from your “Want to visit” list is nearby. Proximity checks run only while the app is in use, throttled by time and minimum movement; we do not track in the background and do not build a persistent route history.

Technical data. IP address, device model, OS and app version, diagnostic logs, push notification tokens (Expo, using FCM/APNs).

Mobile app analytics. The app uses Google Analytics for Firebase — we log product events (screen views, café, roastery and bean profile views and similar) with an app instance identifier and, once you are signed in, with your account identifier. This is used to measure product usage and stability. Legal basis: legitimate interest (Art. 6(1)(f)) — you may object through Help. We do not use this data for behavioural advertising and do not sell it.

Statistics for partners. We count profile views for cafés, roasteries and beans, shop link clicks, check‑ins and additions to the “Want to visit” list. B2B partners see aggregated data only — a partner cannot see who specifically viewed their profile or who added their venue to a list. Where a small number of observations could point to individuals, we apply a minimum user threshold and show a “collecting data” state instead of the figure. The exception is inherently public content (a signed visit rating or a Buzz post).

Payments. Limited billing metadata at Stripe or mobile store operators; we do not store full card numbers on our own infrastructure.

Media. Uploaded photos (profile, recipes, Buzz posts, partner galleries). The QR scan in the passport feature runs on the device — the camera image is not sent to the server; only the decoded identifier is transmitted.

Calendar. If you add an event to your calendar, it is written on your device; we do not read the rest of your calendar.

Website analytics and ad measurement. After you consent, we collect pseudonymous visit data via Google Analytics 4 and Google Tag Manager, and Meta Pixel (the _fbp cookie) measures conversions from our ads on Meta’s services, such as a click through to an app store after arriving from a campaign.

Providing the service and account, passport, recipes, community content, B2B billing — Art. 6(1)(b). Optional location, calendar, camera and photo access and some notifications — (b) and/or (a) (system consent). Website analytics and ad measurement (Meta Pixel) — (a) (consent). Mobile app analytics, partner statistics, IT security, abuse prevention (including fake check‑ins and reviews), content moderation, translating content into the reader’s language, building the venue catalogue and the internal sales CRM — (f) (legitimate interest). Legal obligations (accounting, tax, obligations under the Digital Services Act) — (c). Promotional use of public user content in social media — (f), with the right to object. Pursuing claims — (f).

Promotional use is based on a non‑exclusive licence (see the Terms); it does not transfer ownership of copyright or other economic rights to Specialty Atlas — you remain the author, within the rights vested in you, subject to the licences you grant.

Content you share with other users or the world as public (visit ratings, public recipes, Buzz posts) may be used in Specialty Atlas promotional material, including social media and advertising campaigns. We do not use private content, friends‑only content or private notes about places in this way. You may object to further use of specific material — we will honour the request where technically possible and lawful.

6. Advertising and sponsored content

The app displays partner banners and material labelled as advertising. Selection is based on the context of the placement in the app and campaign settings on our side (country, screen, section) — for these ads we do not build advertising profiles, do not use behavioural advertising based on your history, and do not share your personal data with advertisers. Advertisers receive aggregated delivery statistics only.

Google ads (AdMob). In selected places in the app (including the Hub and the lists of cafés, roasteries, beans and recipes) you may see ads served by Google AdMob (Google Ireland Limited), labelled as advertising — only where no partner banner is running at that moment. For this, Google may use your device's advertising identifier (Advertising ID on Android; IDFA on iOS only after you allow it in the system “Allow tracking” prompt), your IP address, device information and your interactions with the ad. In the European Economic Area, the UK and Switzerland we ask for consent through Google's form (a certified consent management platform, IAB TCF). We show personalised ads only with your consent (Art. 6(1)(a) GDPR); without it Google may show non‑personalised or limited ads. You can change or withdraw consent at any time in Settings → Privacy → Google ad consent (without an account: Settings → Google ad consent), and when signed in you can turn personalisation off with the Ads personalization switch. How Google uses data: policies.google.com/technologies/partner-sites.

A separate form of promotion is Lab Boost — a temporary increase to the match score of one selected roastery bean in the Lab, started by the roastery from its plan allowance. It operates on the ranking itself; the roastery does not receive your data or information about who the bean was shown to, and your taste profile is not modified because of it. Ranking rules are described in the Mobile App Terms of Service.

7. Recipients and processors

Among others: Supabase (database, authentication, storage, edge functions), Stripe (B2B payments), Expo/EAS (builds and push notifications), the map stack (MapLibre and tile providers), Google (OAuth, Firebase Cloud Messaging, Google Analytics for Firebase, and after consent GA4 and GTM, AdMob — in-app ads, Cloud Translation — language detection and content translation), Apple (sign‑in, APNs, distribution), Meta Platforms Ireland Limited (Meta Pixel on the website, after consent: measuring conversions from ads), hosting/CDN providers and a transactional email provider. We conclude data processing agreements where required. Data may be disclosed to competent authorities on a legal basis.

8. Transfers outside the EEA

Data may be processed outside the EEA — we use GDPR‑compliant mechanisms (standard contractual clauses, adequacy decisions).

9. Retention

Account data is kept for as long as the account exists. After account deletion we delete or anonymise data within a reasonable technical period, except: data required by law (billing — until tax periods lapse), evidence needed to defend against claims, records of abuse and moderation decisions, and factual data permanently built into the shared venue catalogue (with no link to you). Backups may retain data for a limited technical period. Diagnostic logs and view counters are kept short‑term or in aggregated form.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability (where applicable), objection to processing based on legitimate interest, withdrawal of consent, and to lodge a complaint with the Polish DPA (PUODO) or another supervisory authority.

How to exercise them: Settings → Your data in the app (data export, clearing local data, account deletion), profile visibility settings, the B2B portal, website forms and Help.

11. Automated decisions and profiling

We use profiling to select recommendations: bean and recipe matching in the Lab is based on your taste profile, ratings, location and impression history; similar mechanisms order content on the Hub and in discovery lists. The main parameters are described in the app Terms.

We do not take decisions based solely on automated processing that produce legal effects within the meaning of Art. 22 GDPR. Automated signals (for example check‑in abuse detection) may trigger a review, but decisions to restrict an account or remove content are taken by a human, and you may appeal them (Terms, section 12).

12. Children

The service is not directed at people under 16 without a guardian’s consent. Providing a date of birth is optional and is used among others for content fit and aggregated statistics. If we learn that an account is run by someone below the required age without the required consent, we will delete the account.

13. Security

We use transport encryption, row level security in the database, environment separation, least‑privilege staff access and monitoring, among other measures. Take care with your password and device.

14. Changes and contact

We may update this policy; material changes will be highlighted (date, in‑app message or email). Questions: contact@specialtyatlas.com, Help in the app or the contact channels on the website.

Search Specialty Atlas