Privacy Policy

Last updated: August 26, 2026

Data controller

Brewr is provided by Hugo Miguel Sá Figueiredo, an individual, Portuguese tax number 226391124, with an establishment at Rua do Reservatório 265, 4510-413 São Pedro da Cova, Portugal. Privacy and support contact: [email protected]. Telephone: +351 963 514 604.

Data we process

We process the account identifier, email address and authentication data received from Google; username, avatar, profile, location and optional social links; recipes, equipment, inventory, fermentations, reminders, sensory evaluations, lists and other data entered by the user; published recipes, comments, reviews, likes, favourites, followers, blocks and reports; purchase and subscription identifiers and status; support requests, device information, IP address, security logs and technical diagnostics. We do not receive complete payment card details.

Purposes and legal bases

We process the data needed to create and manage the account, synchronise data, provide requested features and administer the subscription on the basis of performing the contract. We process information for invoicing and compliance with legal obligations where applicable. Security, fraud and abuse prevention, moderation, support and stability improvements rely on our legitimate interests, balanced against users' rights. Where required by law, we request consent for optional features, which may be withdrawn at any time.

Notifications and diagnostics

Brewing and fermentation reminders are local notifications scheduled on the device after permission is granted; Brewr does not collect or transmit push tokens to Expo. Reminder notes and dates associated with fermentations may be synchronised with the account. GlitchTip, installed and managed by the controller on the same infrastructure as the application, receives technical diagnostics with the sending of personal data disabled by default. We do not use advertising, advertising tracking or solely automated decisions producing legal effects.

Local storage

The application stores the authentication session, preferences, temporary data and a per-user cache on the device to enable offline operation and improve performance. In the web version, Appwrite may use session cookies or local storage that are strictly necessary for authentication. These mechanisms are not used for advertising.

Service providers and recipients

Authentication, databases, functions, storage and GlitchTip use software managed by the controller on a VPS located in Nuremberg, Germany (Hetzner eu-central region, nbg1 location), provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, acting as a hosting processor. RevenueCat, Apple App Store and Google Play process subscription and purchase identifiers. Google processes the data required for Google sign-in. Expo/EAS may process technical data required to build, distribute and update the application. Authorities or courts may receive data where there is a valid legal obligation.

International transfers

Data stored on Brewr's main infrastructure remains within the European Economic Area, on a Hetzner VPS in Nuremberg, Germany. RevenueCat, Google, Apple and Expo may process data outside the European Economic Area depending on the location and terms of their respective services. Where necessary, such transfers rely on adequacy decisions, standard contractual clauses or another applicable legal mechanism. Hetzner's and RevenueCat's data processing agreements govern processing on Brewr's behalf and, where applicable, transfer mechanisms.

Retention

Account data is retained while the account is active. After deletion, active data covered by the process is erased immediately; public recipes with interactions may remain in anonymised form. Backups, where present, have a maximum rotation period of 30 days. Technical logs and diagnostics are retained for up to 90 days; support requests for up to 12 months after closure; reports and moderation decisions for up to 24 months. Transaction records may be retained for the period required by law, and stores and RevenueCat also apply their own retention policies.

Public sharing

Non-private profiles, published recipes, comments and reviews are visible to authenticated members of the community. Users can make their profile and recipes private in the relevant settings. Do not sell or disclose third parties' personal data in published content.

Deletion and rights

The account can be deleted in Settings. You may also contact [email protected] to exercise rights of access, rectification, erasure, restriction, objection and portability, or to withdraw consent. We respond without undue delay and generally within one month, and may request only the information needed to confirm identity.

Complaints

You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados), Avenida D. Carlos I, 134, 1.º, 1200-651 Lisbon, at www.cnpd.pt, without prejudice to any other administrative or judicial remedy.

Security

We apply access controls, per-user permissions, HTTPS communications, environment segregation and infrastructure protection measures. No system is entirely risk-free; incidents will be assessed and notified to data subjects and authorities where required by law.

Minors

Brewr is intended exclusively for people aged at least 18. We do not knowingly collect data from minors. If we detect a minor's account, we may suspend it and delete the associated data.

Changes

The current version will be available at https://brewr.app/privacy. Material changes will be communicated in the application and, where necessary, renewed acceptance will be requested. The date shown at the beginning identifies the version in force.