Privacy Policy
Effective date: 2026-10-31 · Last updated: 2026-10-31
Extraction Notes (“Extraction Notes,” “we,” “us,” or “our”) is operated by Andrew Leary. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. It applies to extractionnotes.com, the Extraction Notes Journal, and the Extraction Notes Logbook app (together, the “Service”).
Extraction Notes is a personal, non-commercial project run by one person, and access to the app is by invitation. This policy applies in full all the same.
Information we collect
Account information. When you sign up, we collect your email address and, if you use email/password sign-in, a securely hashed password. If you sign in with Google, we receive your email address, name, and profile picture from Google, which our authentication provider stores with your sign-in record; we do not receive your Google password. When you accept our Terms of Service and this policy, we record which version you accepted, when, and the minimum age you confirmed.
Coffee and brew data. The core of the Service is a personal coffee log. Information you enter including coffees, roasters, brew recipes, tasting notes, ratings, equipment, and similar records is stored so the Service can work. This data is private to your account. The Service never publishes a record or makes it viewable by anyone else. The only way a record leaves your account is as a share-card image you choose to create, described under “Share cards” below.
Demo access requests. If you ask for access, we collect your name, email address, and what you want access for. If you are evaluating the project, you can also give your role, your organization, and a profile or company link. Any note you add is included too. We use these details only to decide on your request and to reply to you, and we email you a receipt when you submit. A request does not sign you up for any mailing list. If we grant access, we add your email address to the list of addresses allowed to create an account and email you instructions.
Feedback you send us. If you use an in-app feedback or contact form, we receive whatever you write, plus your account email if you’re signed in.
Technical information. Our hosting and infrastructure providers automatically log standard technical data (IP address, browser type, timestamps) for security and reliability purposes, in the ordinary course of operating a web service. Our authentication provider also records the IP address and browser type of each sign-in session. We also keep your IP address, email address, or account ID for up to two days to rate-limit sign-in and sign-up attempts, demo access requests, and feedback against abuse. We do not use this data for advertising or behavioral tracking, and we do not run any analytics or advertising tracking scripts on the Service today. If that changes, we will update this policy first.
What we store on your device
Extraction Notes is offline-first, so your device holds more than a typical web app would. We store a full local copy of your coffees, brews, tasting notes, and pending changes in your browser’s IndexedDB database, so you can log a brew with no connection and sync it later. The app also caches pages you have already visited so they open offline, and those cached pages can include your own records.
We use one strictly necessary cookie, set by our own site, that holds your sign-in session (issued by our authentication provider, Supabase) and lasts until you sign out or the session expires. Your browser’s local storage holds lightweight preferences such as your theme, your unit system, how you like your lists sorted, and which introductions you have already seen, along with a marker saying which account the cached pages belong to, so one account’s pages are never shown to another. None of this is used for advertising or cross-site tracking, and none of it is sold or shared with any advertiser. Because we don’t use non-essential cookies, we don’t show a cookie-consent banner.
When you sign out, we erase the local copy of your logbook from that device, along with the cached pages that were built from it. The same cleanup runs whenever the sign-in screen appears and nobody is signed in, which covers a session that expired or one you ended on another device. When a different account signs in on the same device, it erases the previous account’s copy too. Signing out needs a connection: if you are offline the sign-out does not complete, and nothing is erased.
The one exception is changes made on that device that haven’t synced yet. We keep those records, and only those, rather than destroy the only copy of work you haven’t backed up. They stay until they have synced and the cleanup next runs. You can remove everything at any time by clearing site data in your browser.
Do Not Track and similar signals
Some browsers send a “Do Not Track” or “Global Privacy Control” signal. Our Service does not track you across other websites, and no third party collects information about your online activity over time and across sites through it. It uses no third-party advertising or analytics trackers, so there is nothing for such a signal to change, and we do not respond to these signals for that reason.
How we use your information
We use your information to:
- Provide, maintain, and secure the Service, including syncing your data across your devices
- Respond to support requests and feedback
- Send you service-related email, such as a receipt for an access request or confirmation of an action you took. We don’t send a newsletter or marketing email
- Decide on access requests, and set up your account when we grant one
- Understand, in aggregate and from our own database and server logs, how the product is used, so we can improve it
- Enforce our Terms of Service and protect against fraud or abuse
We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.
Share cards
Every coffee and brew record is private to your account, and no setting makes a record public. To share one, you can create a share card: an image of that record, generated in your browser on your own device. A share card shows details from the record, such as the coffee and roaster, brew specifications, tasting notes, ratings, the notes you wrote, and the names of the equipment you used. It does not show your email address or your display name.
We don’t upload, store, or host share-card images. When you save, copy, or share one, it goes only where you send it. If you share through your device’s share sheet, the accompanying text names the coffee and includes our homepage address. Once you post or send an image, whoever receives it handles it under their own terms, and copies they keep are outside our control.
If we ever add a way to publish a record, that is a material change and we will notify you before it takes effect, as described under “Changes to this policy.”
AI features
We do not currently use artificial intelligence or machine learning to process the content of your coffee or brew records, and we do not use your content to train AI models. If we introduce AI features in the future (for example, scanning a coffee bag label or suggesting recipes based on your history), we will update this policy to describe what data is used, which provider processes it, and where the feature involves analyzing content you upload, we will ask for your affirmative consent before turning it on for your account.
Who we share information with
We use a small number of service providers (“subprocessors”) to operate the Service. Each only receives the information it needs to do its job, and none may use your information for their own purposes:
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase | Database and authentication | Account and app data, plus the IP address and browser type of each sign-in |
| Vercel | Application hosting | Technical request data |
| Resend | Sending transactional email, such as access-request receipts, invitations, and account messages | Email address, message content |
| Upstash | Rate-limiting (abuse prevention) on sign-in, sign-up, confirming an emailed link, demo access requests, and feedback | IP address, email address, and account ID, for up to two days |
| Google (Sign in with Google) | Optional sign-in | Your email, name, and profile picture, only if you choose this sign-in method |
| Google (Workspace) | Our support inbox | Messages you send us, including feedback and requests, and our replies, with your email address |
Account and app data with Supabase is hosted in the United States.
We may also disclose information if required by law, to protect the rights and safety of our users or the public, or to a successor operator of the Service, such as a company formed to run it. In that case we will notify you before your information becomes subject to a different privacy policy.
International data transfers
Our service providers may process data in the United States. If you are located in the European Economic Area, the United Kingdom, or elsewhere outside the United States, your information will be transferred to and processed in the United States. We rely on our providers’ standard contractual safeguards for these transfers (each of the providers listed above publishes its own data-processing and transfer commitments).
Data retention
We keep information only as long as it’s useful for the purpose it was collected for, or as long as we’re required to keep it for legal, security, or fraud-prevention reasons.
| What | How long we keep it |
|---|---|
| Account, coffee, and brew data | While your account is active, then deleted within 30 days of a deletion request |
| The local copy on your device | Erased when you sign out of that device, or when the sign-in screen next appears with nobody signed in, except for the records of changes that have not synced yet |
| Demo access requests | Until you ask us to remove yours. If you have an account, it is deleted along with your account |
| Your agreement to our Terms and this policy | A record of which version you accepted, when, and the minimum age you confirmed, kept while your account is active and deleted with it |
| Support and feedback | Up to 24 months in our support inbox, so we can follow up and keep a record of what was asked |
| Account deletion requests | A record of each request (a reference, its dates, and its status) is kept as proof it was handled, with your email address removed from it when the request is completed. Messages about the request are deleted from our support inbox at the same time |
| Infrastructure and sign-in logs | Kept by our hosting and authentication providers on their own schedules. Supabase keeps the IP address and browser type of a sign-in for as long as that session exists, and in its authentication logs |
Your rights
Regardless of where you live, you can always:
- Access and export your data. The Service includes a built-in data export feature (Settings → Export). The export covers your profile, coffees, brews, equipment, water profiles, recipe templates, tasting tags, and want-to-try list, as they are synced to your account; records still saved only on one device are included once they sync. For anything else we hold about you, such as an access request or feedback, email us and we will send it within 30 days
- Correct inaccurate data by editing your records directly in the app
- Delete your account and associated data by requesting it at support@extractionnotes.com or via Settings. We complete deletion requests by hand within 30 days. Settings records your request, shows you a reference and its status, and we email you when it is done. Deleting your account also removes any access request under your email address.
These rights don’t depend on having an account. If you requested access and never signed up, you can still ask what we hold about you, ask us to correct it, or ask us to delete it. Email support@extractionnotes.com and we’ll respond within 30 days. We may need to confirm your identity before acting on a request, and we’ll never charge you for making one.
If you are in the European Economic Area or United Kingdom (GDPR): our legal basis depends on what we’re doing. For your account and log data, it’s that the processing is necessary to provide the Service you signed up for (contract). For an access request, it’s taking steps at your request before you have an account: deciding whether to grant access, and setting up your account if we do. For answering support requests and feedback, keeping the Service secure and available, and rate-limiting signups against abuse, it’s our legitimate interests in supporting our users and preventing misuse of the Service. You additionally have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with your local data protection authority.
If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined by California law, so there is nothing to opt out of today. We will not discriminate against you for exercising any of these rights.
Children’s privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Security
We use industry-standard safeguards (encryption in transit, access controls, row-level security on our database) to protect your information. Because the app works offline, a copy of your logbook also sits on every device you sign in on. Securing that device, and signing out on shared ones, is the part of this only you can do. No system is perfectly secure; if we experience a data breach affecting your personal information, we will notify affected users without unreasonable delay, consistent with applicable law.
Changes to this policy
We may update this policy as the Service evolves. If we make a material change, we will change the effective date above and ask you to review and accept the updated documents in the app before you continue to use the Service. We may also email you. The “Effective date” above always reflects the current version.
Contact us
Questions about this policy or your data: support@extractionnotes.com
Extraction Notes is operated by Andrew Leary, who is the data controller for the purposes of this policy. Our postal address is available on request by email.