Privacy Policy

1. Information We Collect

Information you provide directly:

• Account information — your email address and username when you create an account
• Profile information — display name, city, school (optional), favorite matcha order (optional), and avatar customization
• Reviews and ratings — the reviews, quality scores, and tags you submit for cafes
• Saved cafes and lists — cafes you save and any custom lists you create

Information collected automatically:

• Location data (GPS) — we collect your device location while using the app to show matcha cafes near you. We do not collect your location in the background when the app is closed.
• Usage data — how you interact with the app, including which cafes you view, features you use, and how often you open the app. This is collected through PostHog analytics.
• Device information — device type, operating system version, and app version for diagnostic purposes

2. How We Use Your Information

• To show you matcha cafes near your current location
• To display community quality scores and reviews for cafes
• To save your bookmarked cafes and custom lists across devices
• To maintain your account and profile
• To understand how people use Ocha so we can improve it
• To send you email updates about the app when you opt in (via Beehiiv)
• To respond to your support requests

3. Information We Share

We do not sell your personal information. We do not share your data with advertisers. We share data only in these limited circumstances:

• Google Places API — we send your location to Google to retrieve nearby cafe results. Google's privacy policy applies to this data: policies.google.com/privacy
• Supabase — we use Supabase to store your account, reviews, and saved cafes securely. Supabase privacy policy: supabase.com/privacy
• PostHog — we use PostHog to analyze app usage. Data is anonymized and used only to improve Ocha. PostHog privacy policy: posthog.com/privacy
• Beehiiv — if you join our waitlist or opt into email updates, your email is stored with Beehiiv. Beehiiv privacy policy: beehiiv.com/privacy
• Legal requirements — we may disclose information if required by law or to protect the rights and safety of our users

4. Data Storage and Security

Your data is stored securely using Supabase, which is hosted on AWS infrastructure with encryption at rest and in transit. We take reasonable technical measures to protect your information. However no system is 100% secure and we cannot guarantee absolute security.

Your saved cafes and profile data are also stored locally on your device using AsyncStorage so the app works even when offline.

5. Location Data

Ocha requests access to your device location solely to show you matcha cafes near you. Location access is requested only when you open the app and is never collected in the background. You can revoke location permission at any time in your device Settings — the app will still work but will not be able to show nearby cafes.

6. Your Rights and Choices

• Access your data — you can view your profile, reviews, and saved cafes directly in the app
• Delete your account — email us at jvochoa88@gmail.com and we will delete your account and associated data within 30 days
• Opt out of emails — every email we send includes an unsubscribe link
• Revoke location access — go to your device Settings → Ocha → Location and set to Never
• Opt out of analytics — email us and we will disable analytics tracking for your account

7. Children's Privacy

Ocha is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information please contact us and we will delete it promptly.

8. Third-Party Links

Ocha may display links to TikTok and Google Maps for cafe discovery. These are external services with their own privacy policies. We are not responsible for the privacy practices of these third parties.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of Ocha after changes are posted means you accept the updated policy.

10. California Residents

If you are a California resident you have additional rights under California law including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights contact us at jvochoa88@gmail.com.