Privacy Policy

1. Who we are

beerXP is an app for logging and discovering beers. The app, the website and app.beerxp.com are developed and maintained by Gustavo Baptista, as the Data Controller. For any question, data deletion request or clarification about your privacy, contact us at suporte@beerxp.com.

2. Data we collect

• Sign-up: name, email and profile photo, if you upload one. If you sign in with Google, Facebook or Apple, we receive the data you authorize from the chosen service (such as name, email and photo).
• Age verification: we ask for your date of birth only to confirm that you are 18 or older. We keep the result of the check (of legal age, and when it was verified), not the date of birth.
• App usage: drink-ins, ratings, comments, photos, saved beers, people you follow or block, reports you make, XP, levels and achievements.
• Location: only when you use place features, such as tagging a pub or searching nearby places, and with your permission on the device. Never in the background.
• Camera and photos: only when you choose to take or upload a photo.
• Website visits: on beerxp.com we measure visits in aggregate and without cookies: the page visited, where you came from (including campaign parameters such as utm_source), language, screen size, approximate country (derived from the IP address) and clicks on the sign-in and language buttons. Links from the website to the app carry campaign parameters (that you came from the website, which button, the page language and the campaign you arrived with, if any), with no identifier of yours. We do not store cookies or other identifiers in your browser, we do not build an individual visitor profile, and we do not measure visitors who have turned on “Do Not Track” or Global Privacy Control in their browser.
• Technical and usage data: device model, system version, identifiers used to send notifications, error and performance logs and app usage events (screens and actions). They keep the service stable and help us improve the product.
• Identifier, errors and IP address: we link usage events and error reports to an internal identifier of your account, not to your name or e-mail, to understand and fix problems that affect you. The providers that receive this data (Google/Firebase and PostHog) also receive your device’s IP address, which we use for security, to prevent abuse and to estimate your country. We also use remote settings (feature flags) to turn features on or off, and they may differ from one person to another.
• Session recording (app): in the mobile apps (Android and iOS) and in the web version of the app (app.beerxp.com) we record usage sessions (taps, scrolling and navigation between screens) to find bugs and confusing parts of the product and to understand problems you run into. In the recording, the text and images shown are masked: we do not see what you type, nor names, photos or other content that appears on screen. The recording is made by PostHog and we can turn it off at any time. We do not record sessions on the beerxp.com website.

3. What we use it for

• Create and maintain your account and passport (performance of a contract).
• Calculate XP, levels and emblems and show your history.
• Show the feed, recommendations and trending beers.
• Send access emails and notifications you turned on.
• Measure app quality, fix errors (including through session recording), and understand how people reach the website and the app (legitimate interest).
• Ensure security, prevent abuse and moderate content (legitimate interest).
• Comply with legal obligations.

4. Artificial intelligence

We use Google artificial intelligence models (Gemini, through Google Cloud) to read beer labels you photograph, fill in beer information, support content moderation and suggest beers. Suggestions take into account your drink-in history, your ratings and the preferred styles in your profile. Photos sent for label reading and reported content may be analyzed by these models. In moderation, the AI measures the severity of reported content and may hide it automatically until the team reviews it; suspending or deleting accounts is always decided by people on our team. You can ask for a review of decisions made solely by automated processing (see “Your rights”).

5. What other people can see

Name, photo, bio, level and drink-ins are visible to other users when your profile is public. With a private profile, only people you approve can see your activity. Your email and date of birth are never shown.

6. Sharing

We do not sell your data. We only share it with providers that operate the service on our behalf, under contract and with the same protection obligations:

• Google (Firebase and Google Cloud): hosting, database, authentication, notifications, usage analytics, error reports, maps and artificial intelligence.
• PostHog: product usage analytics, website visit analytics and recording of app usage sessions.
• Resend: sending access emails.
• Google, Facebook and Apple: social sign-in, when you choose to use it.

We may also share data when required by law or a court order.

7. Transfers to other countries

Some of these providers store or process data outside Brazil, such as in the United States. We do this with the safeguards provided for in Article 33 of the LGPD.

8. How long we keep it

As long as your account exists. When you delete your account in the app, we remove your personal data and associated content (profile, drink-ins, photos, comments, likes, progress and follow relationships), except what the law requires us to keep for a set period. Deletion starts right away and usually finishes within a few hours; accounts with a lot of content can take longer, and the system retries if anything fails. Database backups keep versions for up to 7 days, so data that has already been deleted may remain in them until then and is discarded afterwards. Usage and error data linked to the account’s internal identifier (which does not contain your name or e-mail) may remain with our analytics providers (PostHog and Firebase) for their retention period. Session recordings are kept for 30 days. See the step-by-step in Delete my account.

9. Your rights

At any time you can: confirm whether we process your data, access it, correct it, request portability, anonymization or deletion, withdraw consent, find out who we share data with and request a review of decisions made solely by automated processing. Much of this is available directly in the app settings; for the rest, get in touch.

10. Minors

beerXP is intended exclusively for people over 18. If we identify an account belonging to a minor, it will be closed and the data deleted.

11. Security

We adopt technical and administrative measures to protect your data against unauthorized access, loss and misuse. No system is 100% secure; if an incident that may cause you significant risk occurs, we will notify you and Brazil's National Data Protection Authority, as the law requires.

12. Contact

Questions, data deletion requests or clarifications about your privacy: suporte@beerxp.com. This is our channel for you to reach the controller about how your data is processed. We may update this Policy; relevant changes will be announced in the app.