1. Information We Collect

1.1 Account & Authentication Data

When you sign in using Google Sign-In or Apple Sign-In, we collect your display name, email address, and profile photo URL via Firebase Authentication. This information is used exclusively to create, authenticate, and secure your Brew account.

1.2 Profile & Customization Data (3-Stage Progressive Disclosure)

To facilitate meaningful coffee chat matching, you provide the following profile information during onboarding:

• Display Name (your real or preferred name) and Anonymous Alias
• Birth Month & Year (used strictly to compute age; exact birth day is never requested or stored)
• Gender & Ethnicity (optional preferences for matchmaking filters)
• Bio & Interests (coffee topics, discussion areas, and hobbies)
• Icebreaker Cards (custom conversation prompts)
• Profile Pictures (uploaded voluntarily and hosted securely in Firebase Storage)

3-Stage Progressive Trust Model: Profile data is partitioned and protected under a strict 3-stage progressive disclosure architecture:

• Stage 1 (Espresso Chat): Only your anonymous alias and icebreakers are visible to your match. Photos, real names, bios, age, gender, and ethnicity remain strictly hidden.
• Stage 2 (Permanent Connection): If both users mutually agree to keep chatting after 15 minutes, real names are shared. Photos, bios, demographics, and detailed profile information remain locked.
• Stage 3 (Mutual Full Reveal): Only after 3 days (72 hours) of conversation and mutual dual-consent are full profiles, photos, and bios revealed to your match.

1.3 Location Data (Precise & Approximate Geolocation)

With your explicit runtime permission, Brew accesses your device's geolocation to discover nearby activities, calculate transit directions, and facilitate local coffee meetups. We implement a strict 3-tier dual-precision location architecture:

• Precise Location (High Accuracy): Acquired on-demand in the foreground while viewing the interactive Activities Map, exploring nearby venues and live events, dropping meetup pins, or calculating road-network transit durations. Precise coordinates are stored exclusively in your private Firestore subcollection (users/{uid}/private/profile).
• Public Geohash Prefix (~39km): A coarsened 4-character geohash prefix cell (~39km × 39km) is written to your public user profile (users/{uid}.geohashPrefix) strictly to enable push notification fanout for newly created nearby activities without exposing your location.
• Approximate Location for Discovery Radar (~110m): For 1-on-1 Discovery Radar matchmaking, coordinates are obfuscated on the client to 3 decimal places (~110m resolution) and indexed in Realtime Database under a 3-character prefix cell (~156km × 156km) with an automated 70-second expiration TTL.

We never track background location, sell geolocation data to advertisers, or monitor continuous movements. Location access is foreground-only and requested on-demand.

1.4 Ephemeral Face Verification (Identity Badge)

Brew offers an optional Identity Verification badge. To verify your profile, you take a real-time verification selfie. This image is securely transmitted to our serverless backend where Google Cloud Vision API analyzes face placement, lighting, and pose angle. Verification selfies are processed ephemerally in memory and permanently deleted immediately in a finally execution block (0-second retention). Brew never builds or retains biometric facial recognition templates.

1.5 Voluntary Developer Tipping & In-App Purchases

If you choose to send an optional developer tip or donation (e.g., Espresso, Coffee & Croissant, Roaster Supporter), all payment processing is handled directly and securely by the Google Play Store Billing System or Apple App Store (StoreKit). Tipping is a voluntary donation to support independent app development; it conveys no supporter badges, entitlements, or profile modifications. We never collect, process, or store credit card, banking, or billing details.

1.6 Messages & E2EE Key Vault

One-to-one direct messages are protected by client-side End-to-End Encryption (E2EE) using X25519 ECDH (Elliptic Curve Diffie-Hellman) key exchange and AES-256-GCM authenticated encryption. Only encrypted ciphertext is stored in Firebase Firestore; plaintext messages are never transmitted to or readable by Brew servers. Users can optionally create an encrypted cloud recovery vault at users/{uid}/private/vault protected by PBKDF2 (100,000 iterations, SHA-256) and AES-256-GCM using a personal password.

1.7 Push Notifications & Device Tokens

We collect your Firebase Cloud Messaging (FCM) token (stored privately in users/{uid}/private/profile.fcmToken) to deliver push notifications for incoming chat requests, matches, and meetup updates. We do not harvest device IMEI, advertising IDs (GAID/IDFA), or hardware serial numbers.

1.8 Voice Dictation & Speech Recognition (Microphone Access)

When you use Voice Dictation in the Scout AI Concierge or Standalone Translator screen, Brew requests optional runtime Microphone permission (android.permission.RECORD_AUDIO / NSMicrophoneUsageDescription). Spoken audio is captured only while actively dictating and is processed ephemerally on-device by native platform speech recognition engines (expo-speech-recognition). Spoken audio recordings are never recorded in the background, saved to local disk, transmitted to cloud servers, or analyzed for voice biometrics.

1.9 AI Activity Concierge & Generative Processing (Scout)

When interacting with Scout (Brew's AI Activity Concierge), conversational prompts and meetup parameters (such as activity title, category, coarse coordinates, and transit estimates) are securely transmitted via server-side Firebase Cloud Functions (geminiGenerateContent) to the Google Gemini API to generate venue suggestions and itineraries. Prompts are processed ephemerally in real time and are not used by Google to train foundation models. If you flag an AI response using the in-app report button, the message is logged to our secure moderation collection (/reports with source: "ai_concierge") for safety review.

2. How We Use Your Information

• Matchmaking & Discovery: Profile details and coarsened geohash cells connect you with nearby users who share coffee and conversation interests.
• AI Activity Coordination: Scout processes activity parameters to provide venue suggestions, route estimates, weather forecasts, and booking deep-links.
• Encrypted Communication: Private key infrastructure and FCM tokens deliver secure, encrypted direct chats and real-time alerts.
• On-Device Translation: Neural language models run 100% locally on your smartphone. Message content is translated on-device without cloud API calls.
• Safety & Community Moderation: Moderation reports in /reports are reviewed to enforce guidelines against harassment or bad actors. Automated Cloud Vision SafeSearch filters explicit images.
• Financial Recordkeeping: Digital purchase transaction tokens are acknowledged in accordance with app store accounting and tax requirements.

3. Third-Party Service Providers

We partner with trusted service providers to deliver backend infrastructure, urban intelligence, and map rendering under strict data protection terms:

4. Data Retention & Cleanup Schedule

Brew enforces strict automated retention schedules executed via scheduled serverless Cloud Functions:

• User Profiles & Accounts: Retained while your account remains active. Permanently deleted upon account deletion.
• Temporary Matchmaking Queue: Automatically expires and purges from RTDB after 70 seconds (cleanupExpiredMatchmakingQueue).
• Temporary 1-on-1 Chats (Espresso): Active duration is 15 minutes. Ended temporary chats and their message subcollections are permanently purged after 1 hour (cleanupEndedChats).
• Expired Activities & Group Chats: Swept and purged every 15 minutes (cleanupExpiredActivities), recursively deleting associated group chat messages.
• Verification Selfies: 0 seconds (ephemeral). Immediately and permanently deleted from Cloud Storage in all execution paths via a finally block.
• Permanent 1-on-1 Chats: Retained until either participant deletes the conversation or deletes their account.
• Safety & Moderation Reports: Anonymized abuse reports in /reports are retained for up to 90 days for safety investigations before permanent deletion.

5. Your Rights & Account Deletion

You maintain full control over your personal data:

• Profile Editing: Update your bio, photos, alias, and preferences anytime in Account Settings → Edit Profile.
• Revoke Permissions: Disable location, microphone, camera, or notification permissions in your device's OS Settings at any time.
• In-App Account Deletion: Instantly delete your account and all associated data inside the app via Settings → Account Settings → Delete Account. This triggers the trusted server-side deleteMyAccount Cloud Function.
• Web Deletion Portal: If you no longer have the app installed, submit a deletion request via our public Account Deletion Page (processed within 48–72 hours).

6. International Privacy Frameworks & Statutory Disclosures

6.1 General Data Protection Regulation (GDPR — EU & UK)

For individuals residing in the European Economic Area (EEA) and the United Kingdom, Brew acts as the Data Controller of your personal data.

A. Lawful Bases for Processing (Article 6)

B. Special Category Data & Biometrics (Article 9)

Providing your ethnicity is completely optional during onboarding. Processing occurs strictly based on your explicit consent under Art. 9(2)(a), and you may delete this preference at any time. Face verification analyzes 2D landmark positioning solely to confirm a live human presence; Brew does not extract, store, or process unique biometric templates or facial recognition vectors.

C. Data Subject Rights (Articles 15–22)

Under GDPR, you have the right to:

• Access (Art. 15): Request a copy of your personal data processed by Brew.
• Rectification (Art. 16): Correct inaccurate or incomplete profile data in the app.
• Erasure (Art. 17): Permanently delete your account and all associated data.
• Restriction (Art. 18): Restrict processing under contested circumstances.
• Data Portability (Art. 20): Receive your personal data in a structured, machine-readable JSON format.
• Object (Art. 21): Object to processing based on legitimate interests.
• Lodge a Complaint: You have the right to lodge a complaint with your local EU/EEA Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).

D. International Data Transfers (Articles 44–49)

Personal data is hosted on Google Cloud Platform / Firebase servers located primarily in the United States. International data transfers from the EEA, Switzerland, and the UK rely on the European Commission's Standard Contractual Clauses (SCCs) incorporated into our cloud infrastructure agreements.

6.2 California Consumer Privacy Act & CPRA (Cal. Civ. Code § 1798.100 et seq.)

A. Notice at Collection — Categories of Personal Information

B. "Do Not Sell or Share My Personal Information" Affirmation

Brew does NOT sell personal information of any consumer (including minors under 16) for monetary or other valuable consideration. Brew does NOT share personal information with third parties for cross-context behavioral advertising. We do not incorporate third-party advertising SDKs or tracking pixels.

C. California Consumer Rights & Exercise

• Right to Know / Access: Request details regarding categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: Request permanent deletion of personal information collected.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of SPI: Brew uses Sensitive Personal Information strictly for operational service delivery requested by the user.
• Right to Non-Discrimination: Brew will never discriminate against you for exercising your privacy rights.
• Authorized Agents: Authorized agents registered with the California Secretary of State may submit requests on your behalf with written authorization and identity verification.

6.3 Australian Privacy Principles (APPs — Privacy Act 1988 (Cth))

Brew complies with the 13 Australian Privacy Principles (APPs) governing personal information handling:

• APPs 1, 3 & 5 (Openness, Collection & Notification): We collect personal and sensitive information strictly with your knowledge and consent for legitimate application purposes.
• APP 6 (Use and Disclosure): Personal data is used exclusively for the primary purpose of coffee chat matching, activity coordination, and encrypted communication. Data is never disclosed for secondary marketing.
• APP 8 (Cross-Border Disclosure): Personal information collected in Australia is hosted and processed on Google Cloud / Firebase servers located overseas in the United States. We take reasonable steps to ensure overseas recipients adhere to standards substantially similar to the APPs.
• APP 11 (Security): We enforce robust physical, technical, and cryptographic safeguards including client-side E2EE (AES-256-GCM / X25519), TLS 1.3 encryption in transit, Firebase App Check, and automated data purging.
• APPs 12 & 13 (Access and Correction): You may access and update your personal data in the app or contact support.
• Complaints & OAIC Escalation: If you believe Brew has breached the APPs, please contact brewapp.support@gmail.com. If unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

7. Children's Privacy

Brew is strictly intended for individuals aged 18 and older. We enforce an age gate during onboarding and do not knowingly collect personal data from minors. Accounts identified as belonging to individuals under 18 are terminated and purged immediately.

8. Contact & Developer Information

For any questions, concerns, or data requests regarding this Privacy Policy, please contact the developer: