Privacy Policy

Who is responsible

The controller of your personal data is [company name] OÜ, registry code [registry code], [registered address], Estonia. Contact: support@brewmeatoken.com.

Data we store

We store only what the service needs:

• Maintainers: your GitHub user id, login and avatar link.
• Maintainers: your GitHub access token, encrypted, until you sign out or the session expires.
• Supporters: the display name and message you choose to leave with a brew, if any.
• Stripe ids for accounts, customers, payments and subscriptions, so we can match a brew to a page.
• Reports: the reason, the optional details and, if you were signed in, your user id.
• An audit log of what our admins do to pages and brews, and who gets or loses beta access or admin rights, with their notes.

Beta waiting list

While the service is in beta, you can join the waiting list with GitHub. We store your GitHub account (user id, login and avatar link), the email address you give us, an optional note, and the dates you joined and were let in. We use them only to decide who gets in and to write to you about it. We keep the email address, note and the date you joined until you leave the list or the beta ends. If you leave, we delete them straight away; otherwise we delete them within 30 days after the beta ends. While you have access, we also keep the date you were let in and who let you in, and delete them within 30 days after the beta ends. Your GitHub account details stay, as for any sign-in. To leave, choose “Leave the waiting list” on the beta page, or write to support@brewmeatoken.com. This email address is the only one we store; supporters' email addresses are still never stored.

What we never store

We never store supporters' email addresses, card data or IP addresses. Stripe collects the details it needs to take payment and sends us only ids and amounts. Your IP address is used for a moment to limit abuse and is not saved.

Who processes data for us

Cloudflare hosts the site and API, runs the Turnstile bot check and keeps request logs. Neon hosts the database. Sentry receives error reports with personal data scrubbed. GitHub signs maintainers in. Stripe takes payments and acts as an independent controller for them, under its own privacy policy.

How long we keep it

How long each kind of data stays:

• Expired sign-in sessions are deleted every day.
• Processed Stripe events are deleted after 90 days.
• Pending refund records are deleted after 30 days.
• The details text of a report is cleared 365 days after the report is resolved. The report row stays.
• The admin audit log is kept.
• Brews, with their display names and messages, are kept as the record of a payment. A maintainer or an admin can hide them, and you can ask us to remove them.

Cookies

We set only the cookies the site needs, plus one optional cookie that you can accept or reject. None of them tracks you, and we use no analytics or advertising cookies.

• Always on: the session cookie keeps a maintainer signed in for up to 30 days, as the sign-in page says next to the GitHub button. Short-lived sign-in cookies protect the GitHub sign-in and expire after 10 minutes. The bmat_consent cookie stores your cookie choice, its version and when you made it, for six months. When you pick a language in the language menu (the globe in the header), the NEXT_LOCALE cookie keeps it until you close the browser.
• Only after you are let in: the bmat_beta cookie lets you through the beta gate for 1 day. It is strictly necessary for the gate and holds a signed code with your user id and nothing else.
• Only after you choose “Accept all”: the NEXT_LOCALE cookie remembers your language for one year, also when you open a page in a language your browser does not prefer. It stores only the language code. “Reject all” keeps it to the current visit.
• If you pick a light or dark theme, your browser keeps that choice in its session storage until you close the tab. Only after you choose “Accept all” does it keep the choice in its local storage, until you clear it or choose “Reject all”. It is never sent to us.
• Cloudflare Turnstile loads only when you start using the brew box, the report form or the beta waiting-list form, and then checks for bots. It may store data in its own frame. Stripe sets its own cookies on its own checkout pages, under its own privacy policy.
• You can change your choice at any time under “Cookie settings” at the bottom of every page.

Your rights

You can ask to see, correct, export or delete your data, to object to how we use it, or to restrict it. E-mail support@brewmeatoken.com and we will answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to your local data protection authority.