Brewery Wars
Legal

Privacy

Short version: the app itself does not phone home. The optional War Passport is the one online feature this project operates, and this page says exactly what it stores and what happens when you delete it.

1. The app itself

The offline, single-player app collects nothing. There is no telemetry, no analytics, no crash reporting, and no ad-tech — not in the app, not on the project's websites. All brewery data — recipes, batches, readings, inventory, yeast lots, scores, settings — lives in your browser's local database (IndexedDB and localStorage) on your device.

This is a commitment, not just a current default: the app opens, brews, logs, and scores with no account, offline, forever. Every online feature on this page is strictly opt-in, and a war entry is always an explicit upload you choose to make — never a background sync.

Your local data leaves the device only when you move it:

  • Exports and backups contain your brewery data in plain form. Store and share them accordingly.
  • BYO-AI companion (optional): if you configure the AI companion with your own API key, the data relevant to your question is sent directly from your browser to the provider you chose (Anthropic, an OpenAI-compatible endpoint, or a local model server). That transfer is governed by your provider's terms, not by this project. Your key is stored in your browser's localStorage and is deliberately excluded from exports and backups. A local model server keeps AI traffic entirely off the internet.
  • Self-hosted sync (optional): if you stand up the sync daemon, your data goes to your own server. Nobody else is in that path.
  • Hosted copies: anyone hosting this app serves static files; like any web server they may see standard access logs (IP address, user agent).

2. The War Passport (optional)

If — and only if — you opt in to a War Passport, our server stores:

  • Your email address, as an irreversible keyed hash. The address is used to send you a sign-in code, and what the passport database keeps is an HMAC-SHA-256 of the address computed with a secret key ("pepper") held only on the server. That hash lets us recognize the same address when it returns; it cannot be turned back into your address without the separately held secret. The database does not store the address itself.
  • Your handle — the name your results appear under.
  • Your war record: the entries you explicitly upload for a war (the declared targets and measurements for that one brew), your placements and precision scores, and their timestamps. Once a war is finalized, your result is on the record under your handle and appears on that season's leaderboard. Tasting ballots are archived per war under an anonymous per-war voter number, not under your identity.
  • Social handles you choose to add — up to seven (Instagram, X, Reddit, YouTube, TikTok, Discord, and an optional contact email), each with its own publish toggle. Everything starts unpublished; only handles you publish are shown, and only to signed-in brewers who look up your handle.
  • Purchase records, if you buy anything: Stripe's transaction identifiers for your purchase. Payment happens on Stripe's checkout — your card details never touch our server.
  • Sign-in machinery: session tokens, recovery codes, one-time codes, and share-card tokens are stored only as SHA-256 hashes; a passkey is stored as its public key. The plaintext secrets exist only on your device.

3. How it's used

Passport data is used to sign you in, to display results and leaderboards under your handle, and to serve the share cards you mint. That's the list.

Nothing is sold. There is no advertising, no ad-tech, and no profiling. The only third parties in the path are infrastructure processors: Cloudflare (hosting and databases), an email delivery provider for sign-in codes (Resend, once live sending is switched on), and Stripe (payments).

A human operator can moderate the service — for example clearing an impersonating social handle or repairing a purchase. Operator actions on your account are logged with a written reason; those notes are deleted with your passport.

4. Sharing and share cards

  • Free share links are stateless: everything the card shows travels inside the link itself, and nothing about it is stored on our server. Anyone who has the link can render the card — treat the link as the content.
  • Posted images are copies. When you (or anyone) post a card to X, Discord, or anywhere else, that platform re-hosts its own copy of the image. Those copies are outside our control and are not affected by anything you later delete here.
  • Minted card links (a premium feature) work differently: the link carries only an opaque token, and every view is rendered fresh from live data. You can revoke any card you minted, at any time, even if your pass has lapsed. After a revocation — or an account erasure — the link stops resolving, with one honest caveat: an image already sitting in the edge cache can continue to be served for up to 5 minutes before it dies.

5. Deleting your data

DELETE /api/v1/passport erases the signed-in passport. In one pass:

  • every session is revoked — nothing can act as that passport again;
  • your display name on past war standings is scrubbed to "retired brewer" (the positions and scores themselves remain, because other brewers' results depend on the standings staying whole — only your name comes off);
  • your claims, leaderboard rows, social handles (published or not), share-card tokens, sign-in codes, credentials, entitlement rows, and operator-action notes are deleted;
  • your email hash is cleared, and your handle is retired permanently — no one can register it again.

What survives, on purpose:

  • A proof-of-purchase record engineered to contain no personal data. If you bought the Founding Edition, one row survives: the keyed email hash plus Stripe's two transaction identifiers — no handle, no address, no passport id. After erasure it points at a sale, not at a person. It exists so that if you come back and prove the same email address on a new passport, your purchase is restored automatically in most cases (a refunded or revoked purchase is not). Erasing your passport ends its access immediately either way. Stripe keeps its own records of any payment, as payment processors do.
  • Third-party copies of any card images you shared (see section 4), and up to the 5-minute cache tail on minted card images.

6. The waitlist (optional)

If you join the waitlist on brewerywars.beer, our server stores, in Cloudflare KV:

  • The email address you submit.
  • The time you first joined.
  • The 21-or-older box you checked.
  • The country Cloudflare reports for the request — a coarse signal Cloudflare attaches to the request itself, not something we look up. Nothing more precise is stored: no IP address, no name, no tracking, no analytics.

That's the whole list, and it exists for one reason: to email you when Brewery Wars opens. Nothing else — no other mailings, no analytics tied to your address, and it isn't shared with anyone.

Want off the list? Write to wars@brewerywars.beer, or just reply to any waitlist email. Removal is manual, and we do it promptly.

7. Age

This service is for people 21 and older.

8. Contact

Questions: wars@brewerywars.beer. This service is operated from California, USA.

Effective date: 2026-08-17. Any change to this document moves this date, in the same commit as the change.