Privacy Policy

Last Updated: July 13, 2026

1. Who We Are

Meticulous Community ("we," "us," "our") is operated by Meticulous Home, registered at 2093 Philadelphia Pike #7717, Claymont, DE 19703.

We are the data controller for the personal data processed through the Meticulous Community platform (accessible at https://meticulous-community.vercel.app).

Contact for data protection inquiries:

• Email: privacy@meticuloushome.com

We have not appointed a Data Protection Officer; we are not required to under Article 37 GDPR given the scale and nature of our processing. All data protection inquiries are handled via the contact above.

2. What This Policy Covers

This policy explains how we collect, use, store, and protect your personal data when you use Meticulous Community — a platform for backing up espresso shot data from Meticulous espresso machines and sharing it with the community.

This policy applies to:

• Our website and web application
• Our mobile application (if applicable)
• All features including shot backup, social sharing, community profiles, and machine sync

3. What Data We Collect and Why

3.1 Account Data (Collected at Registration)

Lawful basis: Performance of our contract with you (Article 6(1)(b) GDPR) — this data is necessary to create and maintain your account.

3.2 Profile Data (You Provide Voluntarily)

Lawful basis for bio: Performance of our contract with you (Article 6(1)(b) GDPR) — part of your community profile.

Lawful basis for Instagram/Discord usernames: Your consent (Article 6(1)(a) GDPR) — these are optional and not required for the service. You can add or remove these at any time in your Settings.

3.3 Espresso Shot Data (Core Service)

Lawful basis: Performance of our contract with you (Article 6(1)(b) GDPR) — backing up and storing your espresso shot data is the primary purpose of this service. Full-fidelity storage of all machine data (including raw JSON and debug data) is necessary because you are using us as a backup service.

3.4 Equipment Data

Lawful basis: Performance of our contract with you (Article 6(1)(b) GDPR) — tracking your equipment, coffees, and preferences is how we provide shot tracking, dial-in guidance, and coffee and roaster discovery.

AI-assisted extraction: When you upload a photo of a coffee bag, we send that photo to an AI service provider (currently xAI — see Section 5.2) to read the label and extract the coffee's details. Only the photo and our extraction instructions are sent — never your name, account details, or shot data.

3.5 Social and Community Data

Lawful basis: Performance of our contract with you (Article 6(1)(b) GDPR) — social sharing is an explicitly offered feature of this service. You signed up for a platform described as "Like Strava, but for specialty espresso," which includes these community features.

3.6 Machine Connection Data

Lawful basis: Performance of our contract with you (Article 6(1)(b) GDPR) — machine connection is the mechanism that enables automatic backup, which is the core service.

3.7 Technical and Security Data

Lawful basis for session cookies and push tokens: Performance of our contract with you (Article 6(1)(b) GDPR) — strictly necessary for authentication and for delivering notifications you enabled.

Lawful basis for audit logging and product analytics: Our legitimate interest in maintaining platform security and improving the Service (Article 6(1)(f) GDPR). See Section 7 for more on legitimate interests.

Note on IP addresses: We do not build profiles from or analyze the IP addresses of regular users. Our infrastructure providers (Section 5.2) process IP addresses transiently to serve requests, and we keep short-lived rate-limiting counters — keyed by IP address for requests made without a login — to protect the Service against abuse and denial-of-service attacks. These counters are used only for abuse protection and expire with the rate-limit window. Audit logs are kept only for actions performed by our own administrators, and those logs include the administrator's IP address and browser information for security purposes, retained for up to 12 months.

3.8 Coffee Purchase Email Import (Optional)

If you choose to use the email import feature, you can forward coffee order confirmation emails to a personal forwarding address we generate for you. From those emails we extract only the coffee purchase details (roaster, coffee name, product link). We do not store the raw email in our database — your forwarding address token is stored encrypted, and message identifiers are stored as hashes.

Lawful basis: Your consent (Article 6(1)(a) GDPR) — this feature only processes emails you actively choose to forward. You can stop using it at any time.

4. How We Use Your Data

We use your personal data for the following purposes:

1. Providing the backup service — Storing your espresso shot data securely so you have a remote copy
2. Displaying your data — Showing your shots, charts, analytics, and brewing history to you
3. Social sharing — Displaying your public content to other users per your privacy settings
4. Community features — Powering the feed, follows, likes, comments, and community profiles
5. Machine sync — Connecting to your machine to automatically import shots
6. Account management — Managing your account, preferences, and settings
7. Platform security — Detecting and preventing unauthorized access, fraud, and abuse
8. Content moderation — Reviewing content for compliance with our Terms of Service
9. Recommendations and discovery — Using your brewing history, equipment, coffees, and preferences to recommend coffees, roasters, brewing profiles, and starting parameters that fit your setup and taste
10. Service improvement and analytics — Understanding how the platform is used to improve features and performance (see Sections 4.1 and 4.3)
11. Product improvement and machine health — Analyzing shot and machine data to improve the Meticulous machine and this platform, help you brew better, and proactively identify machine issues (see Section 4.2)

4.1 Anonymized and Aggregated Data

We also create anonymized and aggregated datasets from the data on the platform to improve the Service for all users. For example:

• Equipment insights — Understanding how different grinder, burr, and basket combinations perform with various coffees (e.g., "users with Grinder X and Burr Y typically achieve a 1:2.5 ratio with light roasts")
• Coffee trends — Which coffees and roasters are popular in the community
• Brewing patterns — Aggregate statistics on shot parameters (dose, yield, pressure profiles) that help users dial in their equipment
• Profile recommendations — Understanding which community brewing profiles work well with which equipment

This anonymized data:

• Cannot be linked back to you or any individual user — all identifying information (user ID, username, free-text notes, photos, machine serial numbers, IP addresses) is permanently stripped, and timestamps are coarsened, before aggregation
• Is only ever aggregated across groups of users — we do not publish or share any statistic computed from fewer than 10 users
• Is built from both public and private shots — your shot privacy setting controls who can see a shot, not whether its anonymous measurements strengthen community statistics. A private shot is never shown to anyone; only its numeric brew measurements contribute to aggregates, and no aggregate ever reveals an individual shot or who pulled it
• Is not personal data under GDPR — once truly anonymized, data falls outside the scope of GDPR (Recital 26)
• Survives account deletion — because it is no longer personal data, anonymized and aggregated data is retained even after you delete your account (see Section 8)
• Is never sold — we use it to improve the Service and share it with coffee roasters as described in Section 5.4

4.2 Product Improvement and Machine Health

Our goal is to help you brew great coffee and to make the Meticulous machine and this platform better. To do that, authorized Meticulous personnel may access and analyze your shot data and machine data (including shot telemetry, raw shot files, debug data, machine firmware and software versions, and sync diagnostics) in identified form, in order to:

• Improve the product — identify firmware bugs, software issues, and opportunities to improve the machine and the platform
• Help you brew better — understand where brewing guidance, dial-in recommendations, or new features would help
• Proactive machine maintenance — detect patterns that suggest a machine issue (e.g., degrading hardware, abnormal telemetry) so we can address problems, in some cases before you notice them
• Support you — investigate issues when you ask for help

This access is limited to authorized personnel, is used only for the purposes above, and is never used for advertising or sold to anyone.

Lawful basis: Our legitimate interest in improving our products and supporting our users (Article 6(1)(f) GDPR). You have the right to object to this identified analysis (see Section 9.6); if you object, we will exclude your data from identified analysis, though anonymized aggregate data (Section 4.1) is unaffected.

4.3 Product Analytics

We collect usage analytics inside the product — such as pages viewed, features used, performance timings, and errors — to understand how the Service is used and to improve its features, reliability, and performance.

Our analytics:

• Are collected first-party or through our hosting provider, without advertising cookies or cross-site tracking
• Are never shared with advertisers or data brokers
• Are used only to improve the Service

If we engage an analytics processor, it will be listed in Section 5.2. If we ever introduce analytics that require consent under ePrivacy rules (e.g., analytics cookies), we will ask for your consent first.

Lawful basis: Our legitimate interest in understanding and improving the Service (Article 6(1)(f) GDPR). You may object (see Section 9.6).

We do NOT use your data for:

• Advertising or ad targeting
• Selling your personal data to third parties
• Automated decision-making or profiling with legal effects
• Email marketing (we do not currently send marketing emails)
• Cross-site tracking or advertising analytics

5. Who We Share Your Data With

5.1 Other Users (Based on Your Privacy Settings)

Each shot has a privacy setting that you control. You can change the privacy of any shot, and your default for new shots, at any time in Settings.

• Public shots: Visible to all members of the platform. Public shots may appear in the community feed, search results, other users' dial-in guidance, and the aggregate statistics that power recommendations.
• Private shots: Visible only to you. No other user can ever view a private shot. Its numeric brew measurements contribute only to the anonymized, aggregated statistics described in Section 4.1, which cannot be traced back to you or your shot.

(An earlier "followers only" setting was retired in June 2026; shots that used it were converted to Private.)

Your username, display name, avatar, and bio are visible on your public profile page.

5.2 Service Providers (Data Processors)

We use the following third-party service providers who process data on our behalf under Data Processing Agreements:

5.3 Authentication Providers

When you log in, your authentication is handled by the provider you chose:

• Discord — Provides your email, username, and avatar to us
• Google — Provides your email, name, and avatar to us
• Microsoft (Azure) — Provides your email, name, and avatar to us

These providers act as independent data controllers for data they hold about you. Please refer to their privacy policies for information about their own data practices.

5.4 Coffee Roasters (Aggregated, Anonymized Data Only)

Part of our mission is to support great coffee roasters by helping them understand how their coffees are actually brewed and enjoyed. To that end, we may share aggregated, anonymized insights with roasters — for example:

• How many community members brew a roaster's coffees, and which ones
• Typical brewing parameters for their coffees (dose, ratio, grind ranges, extraction metrics)
• Which equipment is commonly used with their coffees
• Aggregate ratings and enjoyment trends

This shared data is always aggregate-only:

• It never includes your identity, username, contact information, individual shots, notes, or photos
• Every statistic is computed across a minimum group of users (at least 10) so no individual can be singled out
• It follows the anonymization standards described in Section 4.1

Separately, you can choose to interact with roasters directly on the platform (for example, by following a roaster). Those interactions are visible to that roaster as part of the feature, just as they are described in the product.

5.5 We Do NOT Share Your Data With

• Advertisers
• Data brokers
• Marketing platforms
• Advertising or cross-site analytics companies
• Any other third parties not listed above

5.6 Legal Requirements

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect our rights, property, or safety, or that of our users or the public.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place:

• Supabase: Standard Contractual Clauses (SCCs) approved by the European Commission, as part of Supabase's Data Processing Agreement.
• Vercel: Standard Contractual Clauses as part of Vercel's Data Processing Agreement.
• Cloudflare: Standard Contractual Clauses as part of Cloudflare's Data Processing Addendum.
• xAI, Apple, Google (FCM), Resend: Data is processed in the United States under each provider's data processing terms, including Standard Contractual Clauses where applicable.
• OAuth Providers: Authentication data is processed by Discord (US), Google (US), and Microsoft (US) under their respective data processing terms and Standard Contractual Clauses.

You can request a copy of the relevant safeguards by contacting us at privacy@meticuloushome.com.

7. Our Legitimate Interests

Where we rely on legitimate interest as the lawful basis (Article 6(1)(f) GDPR), we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.

You have the right to object to processing based on legitimate interest. See Section 9.

8. How Long We Keep Your Data

8.1 What Happens When You Delete Your Account

When you delete your account, within 30 days we delete:

• Your profile and identity data (username, display name, email link, avatar, bio, social handles)
• Your photos (shot photos and profile images)
• Your comments, likes, follows, blocks, and notifications
• Your free-text tasting notes and descriptions
• Your raw machine shot files and debug data
• Your machine connection data (machine IP address, serial number, API keys) and push notification tokens
• Your shared brewing profiles and equipment selections

We retain brewing measurements only in irreversibly de-identified form: numeric brew records (dose, yield, ratio, grind setting, extraction metrics, rating, and the coffee/equipment/profile they reference) that have been permanently unlinked from you — your user ID and username are removed, all free text, photos, raw files, and machine identifiers are deleted, and timestamps are coarsened. This applies to all your shots — Public and Private alike: nobody ever sees a Private shot, and on deletion only its de-identified numeric measurements are retained, exactly as for Public shots. These records cannot be traced back to you and are no longer personal data (GDPR Recital 26). We retain them because they power the community's dial-in guidance and recommendations.

Other exceptions:

• Where we are required by law to retain certain records
• Coffee bag photos uploaded to the shared catalog — these become community catalog content (e.g., the photo shown for a coffee that other users also log) and are not linked to your identity after deletion
• Anonymized and aggregated data — retained as described in Section 4.1

9. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@meticuloushome.com.

9.1 Right of Access (Article 15)

You can request a copy of all personal data we hold about you. We will respond within one month of your request. You can also export your data at any time using the data export feature in your Settings.

9.2 Right to Rectification (Article 16)

You can correct your personal data at any time through your Settings page (display name, bio, social handles). For data managed by your OAuth provider (email, name), please update it with your provider directly.

9.3 Right to Erasure / Right to Be Forgotten (Article 17)

You can delete your account at any time through your Settings page. This will permanently delete:

• Your profile and account data (including your name, avatar, and photos)
• All your comments, likes, and social connections
• All your free-text notes, raw machine files, and debug data
• All your equipment selections
• All your community profiles
• Your machine connection data (machine IP, serial number, API keys) and push tokens

Audit log entries are detached from your identity.

What is NOT deleted:

• De-identified brewing measurements — numeric brew records that have been irreversibly unlinked from you, as described in Section 8.1. They cannot be traced back to you and are not personal data under GDPR.
• Anonymized and aggregated data derived from your data before deletion (see Section 4.1). For example, if your shot data contributed to an aggregate statistic like "average extraction yield for Coffee X with Grinder Y," that aggregate number remains even after your account is deleted, but there is no way to trace it back to you.

9.4 Right to Data Portability (Article 20)

You can export all your data in a structured, machine-readable format (JSON) at any time using the data export feature in your Settings. This includes your profile, all shots, equipment, social data, and community profiles.

9.5 Right to Restrict Processing (Article 18)

You can request that we restrict the processing of your data in certain circumstances (e.g., while we verify a correction you've requested). Contact us at privacy@meticuloushome.com.

9.6 Right to Object (Article 21)

You can object to processing based on our legitimate interests — including audit logging, admin data access, identified product improvement and machine health analysis (Section 4.2), and product analytics (Section 4.3). We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests. Contact us at privacy@meticuloushome.com.

9.7 Right to Withdraw Consent (Article 7(3))

Where we process data based on your consent (Instagram/Discord usernames), you can withdraw consent at any time by removing that data from your Settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you can contact the Data Protection Authority of your country of residence, place of work, or where the alleged infringement occurred.

Response Times

We will respond to all data subject requests within one month of receipt. If a request is complex or we receive a high volume of requests, we may extend this by up to two additional months, and we will inform you of any extension within the first month.

10. Your US State Privacy Rights

If you are a resident of California or another US state with a comprehensive privacy law (including Colorado, Connecticut, Texas, and Virginia), the following applies to you:

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because of this, there is no "Do Not Sell or Share" option to exercise, and browser Global Privacy Control signals do not change our processing.
• Categories of personal information we collect: identifiers (email, username, display name), user-generated content (shots, notes, comments, photos), device and machine information, and usage data — as described in Section 3. We do not collect sensitive personal information as defined by these laws.
• Your rights: to know/access, correct, delete, and port your personal information. You can exercise access, portability, and deletion directly through the export and delete tools in your Settings, or by emailing privacy@meticuloushome.com. We will verify requests using your authenticated account. Authorized agents may submit requests on your behalf where the law provides.
• No discrimination: we will never treat you differently for exercising your privacy rights.
• Appeals: if we decline a request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state Attorney General.

11. Cookies

We use a small number of cookies that are necessary for the platform to function. We do not use advertising or analytics cookies.

For full details, see our Cookie Policy.

Summary:

12. Children's Data

Meticulous Community is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at privacy@meticuloushome.com and we will take steps to delete that data.

13. Security

We take the security of your data seriously. Our technical measures include:

• Row-Level Security on all database tables — your data is isolated from other users at the database level
• OAuth-only authentication — we never store your password
• Encrypted sessions using HTTPOnly, SameSite cookies
• API key hashing — machine API keys are stored as hashes, not plaintext
• Input sanitization — protection against SQL injection and cross-site scripting
• Sensitive data redaction — tokens, passwords, and keys are never logged
• Encrypted connections — all data transmitted over HTTPS/TLS

No system is 100% secure. If you discover a security vulnerability, please report it to privacy@meticuloushome.com.

14. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you (Article 22 GDPR). Our recommendations (e.g., suggested coffees, roasters, or brewing parameters) personalize your experience but have no legal or similarly significant effect.

15. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via the platform (e.g., a notification or banner)
• Where required, seek your consent for material changes

We encourage you to review this policy periodically.

16. Contact Us

If you have questions about this privacy policy or your personal data, contact us at:

• Email: privacy@meticuloushome.com
• Postal: 2093 Philadelphia Pike #7717, Claymont, DE 19703

This privacy policy was last reviewed on July 13, 2026.