1. Operator and service
Coffee Ledger is a free shared ledger for team coffee funds. The service operator does not receive, hold, transfer or refund members’ money. A administrator designated by the team manages the bank account and funds. Privacy contact: dww7541@gmail.com Privacy officer: Seunghyeon Dong (dww7541@gmail.com)
2. Information and purposes
Account: email, password, display name and account ID for registration and authentication. Supabase hashes passwords. Ledger: team and role, member name and optional email, deposits, orders, balances, settlement records, notes and the team bank account, provided by you or your team administrator. The account holder must authorize registration of their bank details. Notifications: email, preferences, device push tokens, message content and delivery results. Team games: in Together mode, participant names, identifiers and inputs are stored in the room while it is in progress. Game results and winner statistics are not stored separately. No payment or prize features are provided. Technical data: access/error logs, IP, device/browser information, authentication storage and language for operation and security. Processing necessary for the account and ledger relies on contract performance where applicable; consent-based collection is explained separately. Administrators must establish a lawful basis for information entered about others.
3. Sharing within a team
Team members can view shared member names, orders, deposits and balances. The current member list also contains any registered email. Administrators can manage account emails and roles, edit records and export data to Excel according to their permissions. Members can view the team bank account. Administrators must explain collection and visibility to affected people and have appropriate authority and a lawful basis before entering information. Do not put sensitive information, identity numbers or passwords in notes or game names. External disclosure requires an appropriate legal basis and any necessary separate consent.
4. Retention and withdrawal
Withdrawal deletes the account, memberships, consent records, push tokens, preferences and delivery logs linked to the account email. Shared ledger entries are separate from login accounts. On withdrawal, member names are replaced with a withdrawn label and emails removed where a verified account email identifies the member within that team. Shared dates and amounts remain. This is not a claim of complete anonymization. Name-only entries, old email addresses, free-text notes, game records and administrator bank details may not be automatically linked. Contact the operator with the team and relevant records for verified access or deletion requests. Administrators must request deletion when the settlement purpose ends. Personal information is not retained indefinitely merely because it is part of a shared ledger. Statutory retention is applied only where actually required, with its basis and duration explained. Retention and purge (as of 2026-09): server runtime/error logs (Vercel) are kept up to 1 day and deleted automatically. Automatic database backups (Supabase) are kept up to 7 days and then deleted, so withdrawn data disappears when backups expire. Email and push delivery records follow the default retention of Resend and Firebase; the service’s own delivery log is deleted on withdrawal. Account data is deleted immediately on withdrawal; other deletion requests are handled within 10 days of receipt.
5. Providers and optional features
Supabase provides storage, authentication and realtime features. Vercel hosts the application and server requests. Resend sends email addresses and message content. Google Firebase sends push tokens and notification content, controlled through device permission and notification settings. Menu recognition sends menu images to configured Google Gemini or OpenRouter/model providers after an upload notice. Do not upload faces, contact details or other personal information. Original images are not saved to the ledger database by the extraction endpoint. Provider retention and training settings must be verified separately. Nearby cafes uses browser location permission and coordinates in Kakao map searches; the ledger database does not store your current coordinates. You can enter a cafe manually instead. Active providers (as of 2026-09): Supabase, Inc. (database, authentication, realtime; servers in Sydney, Australia) / Vercel Inc. (hosting and server functions in Sydney, static files on a global CDN) / Resend, Inc. (email delivery) / Google LLC (Firebase push, Google Analytics, AdSense) / Contentsquare SAS (usage analytics) / OpenRouter, Inc. (AI menu extraction, including connected model providers) / Kakao Corp. (nearby cafe search, Korea). Google Gemini is not currently used. This list is updated when providers change.
6. International processing
Authentication, storage, hosting, notifications and selected optional features may involve overseas processing. The relevant basis must distinguish necessary contractual processing/storage from transfers requiring separate consent. International transfers (as of 2026-09; all transfers occur over the network while you use the service): · Supabase, Inc. — data: all stored information (account, ledger, consent, notification settings) / country: Australia (Sydney) / purpose: storage, authentication, realtime / retention: until withdrawal or deletion request / basis: processing necessary for the service contract / refusal: withdrawal ends the service · Vercel Inc. — data: connection data (IP, device, request) / country: Australia (functions), worldwide (CDN) / purpose: hosting and server processing / retention: logs up to 1 day / basis: contract / refusal: service unavailable · Resend, Inc. — data: recipient email and notification content / country: United States / purpose: email delivery / retention: provider default / basis: contract / refusal: turn off email in notification settings · Google LLC — data: push tokens and notification content (Firebase); visit and device data (Analytics, AdSense) / country: United States and other Google data centers / purpose: push delivery, analytics, advertising / retention: push until delivered, analytics up to 14 months / basis: contract for push; legitimate interest for analytics and ads (can be refused) / refusal: device notification permission, opt-out links in Article 7 · Contentsquare SAS — data: on-screen behavior (clicks, scrolling), device data; input fields are masked / country: France, United States / purpose: usage analytics / retention: up to 13 months / basis: legitimate interest (can be refused) / refusal: opt-out link in Article 7 · OpenRouter, Inc. — data: menu images you upload / country: United States and the connected model provider’s country / purpose: menu extraction / retention: provider policy (originals are not stored in the ledger database) / basis: your choice when using the feature / refusal: enter menus manually Refusing essential account/storage processing may prevent account services; refusing optional features does not prevent using the basic ledger. Contact dww7541@gmail.com.
7. Storage, analytics and advertising
Browser storage maintains login sessions, selected teams, language and remembered email. Clearing it may sign you out. Google Analytics, Contentsquare, Vercel Analytics and Google AdSense currently load with the page. A transition to separate analytics/advertising choices is outside this change. · Google Analytics (Google LLC): pages visited, usage flow, device, browser, approximate region. Purpose: usage statistics. Retention: up to 14 months. Opt out: https://tools.google.com/dlpage/gaoptout · Contentsquare (Contentsquare SAS): on-screen behavior (clicks, scrolling), device data; input fields are masked by default. Purpose: screen improvement. Retention: up to 13 months. Opt out: https://optout.contentsquare.net · Vercel Analytics (Vercel Inc.): cookie-free aggregate page views, device type and country; no individual identification. Retention: aggregate statistics only. · Google AdSense (Google LLC): advertising identifiers, cookies, device and usage data. Purpose: ad delivery and measurement. Retention: per Google advertising policy. Opt out: https://adssettings.google.com or block cookies in your browser
8. Your rights and deletion
Request access, correction, deletion, restriction or withdrawal at dww7541@gmail.com. Provide the account email, team and records so identity can be checked using minimum necessary information. Account withdrawal and notification settings are available in Settings. We explain lawful limits on requests. Unneeded data is deleted using appropriate procedures. Provider and backup copies follow verified retention/deletion procedures. Ask your administrator separately to delete exported Excel files.
9. Security and age
We use authenticated access, team scoping, role checks, encrypted transport and password hashing by the authentication provider. We do not claim unverified security equipment or audits. The service is for people aged 14 or older. If information about a child under 14 was entered, we take appropriate steps to stop processing and delete it. Administrators must also check the age of members they register.
10. Changes and contact
Changes, effective dates and prior versions are available at /legal/updates. Material changes are announced in advance. Processing requiring separate consent starts only after that consent; acknowledging a notice is not consent. Contact: dww7541@gmail.com. Korean privacy assistance: privacy.kisa.or.kr (118), kopico.go.kr.