Privacy Policy

1. Information We Collect

When you sign up for First Crack, we collect the following information from your Google account or registration form:

• Email address — used as your account identifier and for service-related communications.
• Name — used to personalize your account and profile.
• Profile picture (if provided) — used for account display.
• Roast session data — temperature curves, batch notes, and profile metadata that you voluntarily upload through the First Crack application.

2. How We Use Your Information

We use the collected information solely for:

• Providing, maintaining, and improving the First Crack roasting platform.
• Authenticating your identity and securing your account.
• Communicating service updates, billing information, and support responses.
• Aggregating anonymized roast data for platform improvements.

We do not sell your personal information to third parties. We do not use your roast data for advertising.

3. Data Storage & Protection

Your data is stored securely using industry-standard encryption:

• Data in transit is encrypted via TLS 1.3.
• Data at rest is encrypted using AES-256.
• Authentication is handled through Supabase Auth, which follows SOC 2 compliance standards.
• We enforce least-privilege access controls — only essential infrastructure can read user data.

4. Data Retention & Deletion

We retain your personal information for as long as your account is active. If you delete your account:

• Your profile information (name, email, avatar) is permanently deleted within 30 days.
• Your roast session data is permanently deleted within 90 days.
• Anonymized aggregates (statistics that cannot identify you) may be retained for platform analytics.

To request account deletion, contact support@firstcrackiscoming.com or use the account settings page.

5. Third-Party Services

First Crack uses the following third-party services:

• Supabase — authentication and database (PostgreSQL).
• Polar — payment processing. We do not store credit card information; payments are handled entirely by Polar.
• Cloudflare — CDN and edge hosting.
• LogSnag (or similar product analytics) — operational events such as sign-ups and billing milestones. We do not use roast profiles for advertising.

Each service provider has its own privacy policy governing data handling. We select providers that offer adequate data protection guarantees.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention obligations).
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact support@firstcrackiscoming.com.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the application. Continued use of First Crack after changes constitutes acceptance of the updated policy.

8. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at support@firstcrackiscoming.com.