Last updated: 29 July 2026
CafeReview ("we", "us") helps people discover cafes, share reviews, and connect with other patrons. This policy explains what personal data we collect, how we use it, and the choices you have.
Account data: email, display name, profile photo, and how you sign in (Google, or email and password). User content: reviews, ratings, photos, comments, and chat messages you publish. Usage data: pages visited, searches, interactions — used in aggregate to improve the product. Device data: the browser and operating system your browser reports, stored alongside each sign-in session so you can see and end your own sessions.
To operate the service (show cafes, store your reviews), personalize content (nearby places, language), secure the account, respond to support requests, and comply with legal obligations.
We do not sell your personal data. Where your data is kept: on a single server we operate ourselves, rented from Hetzner Online GmbH and located in Helsinki, Finland. Your account, your reviews, your comments, your chat messages and every photo you upload are stored on that machine and served from it. They are not copied to any other provider. We share data with two others, and only these: Google LLC, when you choose “Continue with Google” — that sign-in is exchanged with Google, and nothing else on this site is; and the mail provider that delivers our account emails (verification and password-reset links), which receives the address the message is sent to. Public reviews and your display name are visible to anyone who visits the site.
You can access, correct, export, or delete your account data at any time from your profile settings, or by emailing privacy@cafereview.dev. We respond within 30 days.
We do not use cookies and we do not use analytics cookies. Staying signed in is done with a session token your browser keeps in local storage, which is not sent to any other site. Clearing your browser's site data signs you out.
Account data is kept as long as the account is active. Deleted accounts are fully removed within 60 days, except where law requires longer retention.
Questions? privacy@cafereview.dev