Legal

Privacy policy

Effective 20 August 2026 · Last updated 21 August 2026

Beerwright is a recipe studio for homebrewers. It is run by one person, and this page is the plain description of what it stores about you, who else touches that data, and how you get it back or get rid of it.

Short version: there is no advertising here, and no third party that gets your recipes to do its own thing with. What is collected is what an account and a sync engine need in order to work, plus usage measurements of the studio itself (which pages get opened, which buttons get pressed, and what broke) with your recipes and everything else you have typed masked out of them. You can export everything and delete everything yourself, from Settings, without asking.

“We” below means Beerwright and its operator. Questions, requests or complaints: hello@beerwright.com.

Operator: Christopher Main, 36 Troy St, Pittsburgh, PA 15209, United States, the data controller for the purposes of UK/EU data protection law.

1. What is collected, and why

Account details

When you create an account we store your email address, a display name, an optional profile image URL if your sign-in provider supplied one, and the dates the account was created and last changed. This is what identifies your workspace and lets us email you about it. There is no password field: sign-in is a Google account or an emailed magic link, so we never hold a password of yours to lose.

Sessions

Signing in creates a session record: a random token, its expiry, and the IP address and browser user-agent the session was created from. The token is carried in an HttpOnly cookie, so page scripts cannot read it. The IP address and user-agent are kept so that you (and we) can tell a session apart from an impostor's; they are deleted with the session.

Sign-in provider links

If you sign in with Google, we store the identifier Google gives us for your account and the tokens that sign-in issued, so that returning to the site recognizes you. A magic-link sign-in stores a short-lived, single-use token against your email address until it is used or expires.

Your brewing data

Recipes, batches, inventory, water profiles, equipment, settings and your assistant conversations live in a Durable Object, a small database on Cloudflare's network that belongs to your account alone, not a shared table with other people's rows in it. We store it in order to sync it between your devices and hand it back to you on request. We do not read it to build a profile of you, and we do not sell it or share it with anyone for advertising.

Billing details

Checkout is handled by Paddle as merchant of record: Paddle collects and holds the card or wallet details and the billing address needed for tax, and we receive only what tells us what you are entitled to: a subscription identifier, the plan, its status and its renewal date, plus the receipts Paddle issues. Full card numbers never reach our systems.

Request logs

Like any site, Beerwright is reached over the network, and Cloudflare processes the technical details of each request (IP address, user-agent, URL, timestamps) to route traffic and to defend against attacks. We do not build visitor profiles for anybody else, we do not sell anything about you, and no advertising or tracking network is embedded in these pages.

How the studio itself is used

The studio (the app at https://app.beerwright.com, not these marketing pages) measures its own use through PostHog, so that a feature nobody can find gets fixed rather than guessed at. Three things go there, and nothing else:

• Usage events. Which screens are opened and which elements are clicked, with the visible text of what you clicked stripped out before the event is sent. Addresses are recorded without their query strings.
• Session replays. A reconstruction of the page as you used it, with every input masked and everything that came from you masked with it: recipe and batch names, the ingredients and amounts in your recipes, the notes and tags you wrote, your support messages and assistant conversations, your name and email in the account menu, and your profile picture. What is left is the studio's own furniture (its menus, buttons and headings, our ingredient catalog as you browse it, and calculated readouts such as gravity and bitterness) plus the layout and where you clicked. Our own words are not masked: they are identical in everybody's session and printed on this website anyway, and a replay in which every button is a row of asterisks cannot show which button somebody failed to find, which is the only reason to keep replays at all. A replay shows that somebody hunted around the fermentation panel for thirty seconds; it cannot show the recipe they were hunting through.
• Errors. When the studio breaks, the error and its stack trace, so that the crash can be found and fixed, and linked to the (masked) replay of what led to it.

If you are signed in, these are labeled with your account identifier (an opaque string that means nothing outside our database) and nothing else. Your email address and your name are not sent to PostHog. PostHog processes this in the United States.

If your browser sends a Do Not Track header, none of it happens: no events, no replay, no error reports. Nothing else about the studio changes when you set it.

2. The AI assistant

The assistant is optional; if you never open it, nothing here applies to you.

When you send it a message, the relevant context is processed by an open-weight AI model running on Cloudflare Workers AI, the same infrastructure that hosts the rest of Beerwright, so assistant messages never leave the processor that already stores your workspace. That context is your message, the recent conversation, and the recipe or workspace details needed to make the answer about your beer rather than a generic one: ingredients, amounts, targets, water, calculated vitals. It is not sent with your name or email attached, and use is capped per month by plan tier.

Cloudflare does not use inference inputs or outputs to train models, and because the model is open-weight and runs on Cloudflare's infrastructure, its original developer never receives your prompts or responses. We do not use your recipes to train any model either. The conversation itself is stored in your own workspace, and deleting the conversation, or your account, removes our copy.

3. Who else processes your data

These are every third party involved in running the service. Each is a processor acting on our instructions under its own data processing terms; none of them is an advertising network.

If we add or change a subprocessor, this table changes with it and the effective date at the top moves.

What Google receives, specifically

Signing in with Google tells Google that you signed in to Beerwright. In return we receive your email address, your basic profile information (name, and a profile picture URL if you have one) and a Google account identifier. We use them for one thing: creating and authenticating your account. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service, and we do not sell or transfer that data to anyone else except as described on this page.

4. Cookies and local storage

Beerwright sets no advertising cookies and belongs to no ad network. These marketing pages set nothing at all. The studio sets the following, and nothing else:

• Session cookie (app only, strictly necessary): carries your session token. HttpOnly and SameSite=Lax, and Secure on every real deployment. Without it you cannot stay signed in.
• Theme preference: light or dark, kept in your browser's local storage on this device. It is never sent to a server.
• Your offline copy: the app keeps your workspace in the browser so it keeps working on brew day with no signal. Signing out or deleting your account clears it on that device.
• A usage identifier: PostHog keeps a random id in local storage and a cookie so that two visits from this browser count as one person rather than two. It is not linked to you until you sign in, when it is labeled with your account identifier; signing out unlinks it again. Turn it off with Do Not Track in your browser, or by blocking the analytics domain. The studio works exactly the same either way.

5. Why we are allowed to hold it

If UK or EU data protection law applies to you, our lawful bases are: contract (account, sync, assistant and billing data are what the service you asked for is made of); legitimate interests (keeping accounts secure, preventing abuse, diagnosing faults, and understanding which parts of the studio are actually used, in the masked form described in section 1); and legal obligation (tax and accounting records for purchases, which Paddle keeps as merchant of record).

6. How long it is kept

• Account and workspace data: for as long as the account exists. Delete the account and it goes.
• Sessions: until they expire or you sign out.
• Magic-link tokens: minutes. They are single-use and expire quickly.
• Billing records: kept by Paddle for as long as tax law requires it, independently of your account here.
• Session replays: 30 days, PostHog's shortest retention setting, after which they are deleted there. Usage events and error reports are kept longer, because a comparison with last season is the point of having them.

One caveat worth stating plainly: Cloudflare's databases keep a rolling point-in-time recovery window at the platform level, so a deleted record can linger in that recovery window for a short period before it ages out. Nothing in Beerwright reads from it in normal operation; it exists so that a mistake on our side is recoverable.

7. Your rights, and the buttons that already do them

Two of these are self-serve today, and we would rather you did not have to email anybody:

• Export everything. Settings has a one-click export of your whole workspace, produced in your browser. Any single recipe also exports as BeerJSON from its own menu.
• Delete everything. Settings has a type-to-confirm account deletion. It erases your workspace, your sessions, your sign-in provider links, any pending magic-link token, your plan record and your account row, and clears the local copy on that device. It cannot be undone, so export first. The one thing that button does not reach is the usage data held by PostHog, which is labeled with your account identifier rather than stored here: ask us and it is deleted there too.

Depending on where you live you also have the right to ask for access to your data, to correct it, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where we relied on it. Email hello@beerwright.com and we will answer within 30 days. If you think we have got it wrong, you can complain to your local data protection authority. In the UK, that is the Information Commissioner's Office.

8. Where your data is

Beerwright runs on Cloudflare's global network, and the providers listed above operate internationally, so your data may be processed outside the country you live in. Where transfers out of the UK or EEA need a safeguard, we rely on the standard contractual clauses and equivalent terms in those providers' own data processing agreements.

9. Security

Traffic is encrypted in transit. Session tokens sit in HttpOnly cookies rather than in page-readable storage. No passwords exist to be stolen. Each account's brewing data is held in its own Durable Object, so one account's data is not one query away from another's, and no API route accepts a user id from the client. The session decides whose data a request touches.

No system is perfect. If you find something that looks like a security problem, please email hello@beerwright.com before making it public, and we will get to it quickly.

10. Children

Beerwright is about brewing beer. It is not intended for children, and accounts are for people who are 18 or older (or the legal drinking age where you live, if that is higher). We do not knowingly collect data from children; if you believe a child has an account, tell us and we will delete it.

11. Changes to this policy

When this policy changes, the effective date at the top changes with it and the current version is always here. For a change that materially affects your data (a new subprocessor, a new category of data, a new purpose), we will email account holders before it takes effect, and note it in the app.

12. Contact

hello@beerwright.com. One person reads that address, and a privacy request is not a support ticket to be closed. Say what you want and it gets done.