Privacy Policy

Coffier (formerly Merlin) updated this Privacy Policy on 2026-05-11 to reflect the rebrand from merlin.coffee to coffier.co. No substantive privacy practices have changed in this update; the rewrite swaps the product name, domain, and contact addresses only.

This Privacy Policy describes how Coffier collects, uses, holds, and protects your personal information when you use the Coffier web application at coffier.co. It is written to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and to inform users in the European Economic Area, the United Kingdom, and other jurisdictions of the additional rights they may have under their local data protection laws.

Who we are

Coffier ("we", "us", "our") is operated by [Legal entity to be confirmed — e.g. "Alvin Yip, sole trader, ABN XXXXX" or "Coffier Coffee Pty Ltd, ACN XXXXX"]. Our registered postal address is [Postal address to be confirmed]. We are an APP entity for the purposes of the Privacy Act 1988 (Cth) and accountable for handling your personal information in line with the Australian Privacy Principles.

If you have any questions about this policy or how we handle your personal information, please contact us at privacy@coffier.co.

What personal information we collect

When you create and use a Coffier account, we collect:

• Account identity — your email address (required), name (optional), and either a hashed password (for email/password accounts) or your Google account identifier (for accounts created via Sign in with Google). We also store account metadata such as your selected timezone, account creation date, and account status.
• Brew log data — every brew you log, including the coffee, recipe, grind setting, water details, brewing parameters, taste scores, notes, environmental conditions, and any flavour notes you tag.
• Cupping data — cupping sessions you create or participate in, including the samples, scorecards, scores, tasting notes, and the participants involved.
• Catalog contributions — roasters, coffees, recipes, grinders, filter papers, and flavour notes you create or save as part of the shared product catalog.
• Product analytics — anonymised usage data via PostHog (page views, button clicks, viewport size, referrer). No raw IP addresses are stored. The PostHog client respects Do Not Track and standard ad/tracker blockers.
• Server logs — operational logs that may contain a one-way hash of your email address (not the raw address) plus correlation identifiers for failed transactional email attempts. Used for operational triage only.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Why we collect it and how we use it (APP 6)

We use the personal information we collect for the primary purposes of:

• Providing and maintaining the Coffier service to you, including features such as analytics, search, and history that operate on your data on your behalf.
• Authenticating you and protecting your account from unauthorised access.
• Sending transactional email related to your account (for example, password reset emails).
• Operational diagnostics and troubleshooting.
• Improving the product through anonymised analytics.

Sharing anonymised insights with roasters. When you log a brew of a coffee published by a roaster on Coffier, anonymised and aggregated insights from those brews — such as the equipment used, the overall ratings given, and how often QR scans lead to a logged brew — are shared with the roaster of that coffee to help them understand and improve it. These insights are aggregated across many people and only become visible to the roaster once at least five different people have logged a brew, so they do not identify you individually. You can turn this sharing off at any time from the Data sharing section of your account settings.

We will only use your personal information for a secondary purpose if that purpose is related to the primary purpose and you would reasonably expect it, or if you have consented.

Cross-border disclosure (APP 8)

Coffier operates as a thin layer over a small number of trusted infrastructure providers. To deliver the service, we disclose personal information to overseas recipients:

| Recipient | Country | What is processed | |-----------|---------|-------------------| | Vercel Inc. | United States (with EU data residency available) | Hosting and primary database (Vercel Postgres): account, brew logs, catalog contributions | | Resend Inc. | United States | Transactional email delivery | | PostHog Inc. | United States or EU (depending on instance) | Anonymised product analytics events | | Google LLC | United States | Identity authentication when you sign in with Google (your email, name, avatar image) |

We take reasonable steps to ensure each overseas recipient handles your personal information consistently with the Australian Privacy Principles, including via the data processing terms each provider publishes.

By creating a Coffier account and using the service, you consent to the disclosure of your personal information to these overseas recipients for the purposes described above. If you would prefer your information not to be disclosed overseas, the service cannot be provided to you.

Storage and security (APP 11)

Personal information is stored in the Vercel Postgres instance described above. We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, including:

• TLS encryption in transit for all client-server traffic.
• Bcrypt password hashing for email/password accounts (we never store your password in clear text).
• Authentication state managed via signed session tokens.
• Operational access to production infrastructure restricted to authorised personnel.
• Regular review of dependencies and processors for known vulnerabilities.

No system is perfectly secure. If we become aware of an eligible data breach as defined under Part IIIC of the Privacy Act 1988 (Cth) (the Notifiable Data Breaches scheme), we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.

Accessing and correcting your information (APP 12 and APP 13)

You can access most of your personal information directly within the Coffier app and edit it at any time (for example, your profile and your brew logs). For information that is not directly editable, you can request a copy or a correction by emailing privacy@coffier.co. We will respond to your request within a reasonable period (typically within 30 days) and at no charge for routine requests.

If we refuse a request to access or correct your information, we will tell you why in writing and explain how you can complain (see "Complaints" below).

Data retention

• Account data and brew/cupping records are retained for the lifetime of your account. You can delete your account at any time from your account settings.
• On account deletion, your account, brew logs, cupping records, scorecards, saved coffees, and personal audit metadata are removed from the live database immediately. Database backups may retain copies for up to 30 days, after which they are overwritten in the regular backup rotation.
• Catalog contributions (roasters, coffees, recipes, grinders, flavour notes you submitted to the shared catalog) are retained as part of the shared product catalog after your account is deleted, with the original creator attribution removed. This is so other users' brew logs that reference your catalog contributions are not orphaned.
• Server logs are retained for up to 90 days for operational triage and then deleted.
• Anonymised analytics events in PostHog are retained per PostHog's data retention policy, which we configure to the shortest reasonable interval for our needs.

Cookies and similar technologies

Coffier uses a small number of strictly necessary cookies to keep you signed in (session cookies set by the authentication system) and to support secure transactional flows (a short-lived signed cookie used during account registration via Google). We do not use third-party advertising cookies or tracking pixels. PostHog analytics are loaded only after the page has rendered and respect Do Not Track.

Information for users in the European Economic Area, United Kingdom, and other jurisdictions

If you are located in the EEA, the UK, or another jurisdiction with comparable data protection law, the General Data Protection Regulation (GDPR) and equivalent local laws may also apply to our handling of your personal information. In addition to the rights described above under the Australian Privacy Principles, you may have the following rights:

• Right of erasure ("right to be forgotten") — you can delete your account at any time, which removes your personal data as described under "Data retention" above.
• Right to data portability — you can request an export of your brew log and cupping data in a machine-readable format. The self-serve export feature is on our roadmap; until it ships, please email us.
• Right to object — you can opt out of product analytics processing by enabling Do Not Track, using an ad/tracker blocker, or emailing us.
• Right to withdraw consent — for any processing based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

The lawful basis for our processing under GDPR is:

• Contract performance for account, brew log, cupping, catalog, and transactional email data.
• Legitimate interest for product analytics (operating and improving the service), with the right to object as described above.

If you are in the EEA or UK and we cannot resolve a complaint to your satisfaction, you can lodge a complaint with your local supervisory authority.

Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first at privacy@coffier.co. We will acknowledge your complaint within 7 days and respond substantively within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

Changes to this policy

We will update this policy as the service evolves. Each version of this policy carries a date-stamped version identifier (visible at the top of the page). When you registered, we recorded which version you accepted. Material changes will be communicated via email to your account address, and you will be asked to re-accept the new version on next sign-in.

Contact

For privacy questions, requests under your data protection rights, or to report a concern, contact us at privacy@coffier.co. Our postal address is [Postal address to be confirmed].