Privacy Policy

CafeNode is a platform for discovering independent cafes for coffee, atmosphere, reading, meetings, travel, relaxing, and work-friendly visits when appropriate. We process only data needed to provide authentication, discovery, reviews, favorites, and owner listing features.

CafeNode does not sell personal information in the ordinary meaning of selling user data.

Account information

• Name and email
• Profile photo when provided
• Authentication details managed by Supabase Auth (email/password metadata)

Location information

• Approximate or precise location, only with permission
• City or search location entered by users
• Browse and map context such as nearby cafe search area

User-generated data

• Reviews, ratings, and comments
• Suggested edits and correction requests
• Uploaded photos and reports
• Private review-author block preferences and moderation case records
• Favorites and saved cafes

Cafe owner information

• Business name and business address
• Owner/manager contact details
• Website, social links, and claim verification details
• Cafe amenities and policy fields (Wi-Fi, outlets, noise, etc.)

Technical and device data

• Device and browser metadata
• IP address and request metadata
• Pages viewed, app interactions, and feature usage
• Crash and error events for reliability
• Analytics events if an analytics provider is enabled

• Authenticate and protect user and owner accounts.
• Power café discovery, search, filtering, and map/list experiences.
• Display and rank listing and review signals for discovery quality.
• Enable owner claim workflows and moderation review.
• Operate abuse prevention, fraud prevention, and safety workflows.
• Improve product quality and support analytics and monitoring.

Optional AI assistance

When you ask for AI assistance, CafeNode sends the text and relevant cafe context needed for that request to OpenAI through our server. Owner AI tools ask for your explicit permission before this transfer. Depending on the tool, the request includes the cafe name and city, your submitted notes, the public review being answered, or a bounded sample of published reviews and rating aggregates. Reviewer profile and contact fields are not attached, but free-text reviews or notes may themselves contain personal information. Do not assume that this text is anonymous. Do not include passwords, payment details, confidential information, or someone else's private information in a prompt. AI output can be inaccurate; review drafts before applying or publishing them.

Owner AI permission belongs to your signed-in account and the disclosed data categories; it does not transfer to another account. You can decline AI and keep editing manually, or withdraw Owner AI permission from its controls. Withdrawal stops future approved requests; it cannot recall information already sent to OpenAI. A draft is not published automatically.

CafeNode keeps usage records needed to enforce request limits and protect the service. Provider processing and retention are also subject to the provider's applicable terms and privacy practices.

Phone notifications

Where phone notifications are enabled, OneSignal processes device/subscription identifiers, notification permission and delivery information to register the device and send notifications through Apple APNs or Android FCM. Our notification integration disables OneSignal location sharing. Location used by cafe maps is a separate feature with its own device permission.

You can pause phone notifications in the app or manage permission in device settings. Message previews can reveal information on a lock screen; keep previews private when using a shared device. Enabling permission does not guarantee that every notification will be delivered.

Data is stored using Supabase and related infrastructure providers. We use role-based controls, transport security, and least-privilege access patterns.

Retention is based on feature use and operational needs. Logs or backups may be retained for limited periods under security, legal, and compliance requirements.

Review-author blocks are account-specific preferences, not public accusations or changes to cafe ratings. Reports and moderation notes are restricted to the reporter where applicable and authorized staff; cafe ownership or a paid plan does not grant access to private reports. Moderation records support safety decisions and appeals. Do not include passwords, financial information, or unnecessary personal details in a report or moderation note. Account deletion removes associated block preferences. The deletion workflow minimizes linked moderation records; necessary safety decision metadata may remain as described in the account and data deletion policy.

We use trusted providers to operate the service and only share what is required:

• Supabase (Auth, database, storage, and operational APIs)
• Vercel (hosting and deployment delivery)
• Google Maps / Places / Geocoding APIs if map features are enabled
• OpenAI, when you request AI assistance
• OneSignal and platform push services, where phone notifications are enabled
• Stripe for website checkout and subscription processing, when used
• Apple or Google for purchases made through their stores, where offered
• Analytics providers if an analytics integration is enabled

Payment providers process payment credentials and transaction information under their own privacy practices. CafeNode uses subscription, customer and transaction references to reconcile paid access; payment card details are entered into the payment provider's checkout, not cafe review or AI forms.

We do not share personal information with marketing or data brokers for resale.

• Request access, correction, or deletion where available in product features.
• Manage location permission in device/browser settings.
• Withdraw consent for optional processing where applicable.
• Use Account and Data Deletion to request removal.
• Contact us directly for additional privacy requests.

For account deletion workflow details, see /delete-account. We retain only data required for security, legal, fraud prevention, disputes, or regulated obligations.

We implement safeguards appropriate to a startup product, including secure access controls and review processes. No system is completely risk free.

CafeNode is not knowingly directed to children under 13. We do not intentionally collect personal data from children.

Data may be transferred across regions to operate the service infrastructure. Where required, we rely on provider safeguards and legal transfer mechanisms.

We may update this policy as features evolve. Material changes will be reflected by updating the date and, where needed, notifying users through product channels.

Legal entity: Decodation LLC dba CafeNode

United States

Contact: support@cafenode.app

Privacy requests: privacy@cafenode.app