pourtrait DISCOVER · CONNECT · POUR
@pourtrait_nl

Privacy Policy

Last updated: 11 August 2026

Pourtrait is a social discovery app for specialty coffee, built in Amsterdam. This policy explains what we collect, why, and what you can do about it. If something here is unclear, write to us at the address at the bottom.

Pourtrait is operated by RadTech, a sole proprietorship (eenmanszaak) registered in the Netherlands under KvK number 42100167. RadTech is the data controller for the personal data described in this policy.

Your account

There are no passwords. You can sign in with Google, or with your email address, in which case we send a one time code and entering it proves the account is yours. If you choose Google, Google tells us your email address, your name and a link to your Google profile picture, and Google learns that you signed in to Pourtrait. We store your email so we can recognise you on your next visit and send those codes. We also keep the display name and any profile details you choose to add.

Location

Location is optional. If you allow it, we use your device location only to find specialty cafes near you and to show them on the map. You can use the app without granting location access (you just look up cafes manually instead). We do not track your location in the background, and we do not build a movement history. One exception: if you submit a cafe that is missing from the map, it is pinned to where you are standing whenever we have a fix, and that single set of coordinates is stored with the submission and linked to you, because someone has to be accountable for a listing.

What you create in the app

The content you add includes:

Some of this is meant to be social. Your pours, ratings, follows, and posts can be visible to other people in the app. Treat anything you publish as public unless the app clearly says otherwise.

Baristas and cafes named in the app

Pourtrait lets people credit and rate the barista who made a drink, and it lists cafes. This can include the name and workplace of a real barista who has not signed up themselves. We show this only in a professional context, the person as the barista who made a coffee at a named venue, never anything about their private life, and we rely on our legitimate interest, and the interest of the people using the app, in an honest guide to who makes great coffee. This is the same basis that courts in the European Economic Area have accepted for platforms that list and review named professionals.

We limit this on purpose. A name credited on a pour appears on that cafe's page from the first credit. A separate profile page for that person is created once five different people have credited the same name at the same cafe, or sooner if someone, including the barista, claims it. Whichever way it happens, the rating average stays hidden until at least three different people have rated them, so no one is publicly scored on one or two opinions. A barista can claim their profile, reply to it, ask us to hide it, or have it removed. If you are a barista named in the app and want to object to or delete your profile, contact us at the address below. We will respond without undue delay, and at the latest within one month, as the law requires. Cafe owners can do the same for a venue listing.

If drinkers credit pours to a barista who has not signed up, we may reach out once, by Instagram, to let them know and invite them to claim or remove their profile. We do not email unregistered baristas, and one message from us saying "no thanks" ends it.

Photos

Logging a pour never involves a photo. The image attached to each pour is a generated "pour signature" drawn from your taste values, not a picture from your camera or library, and logging a drink does not ask for camera or photo library access.

Photos exist in one place only. If you have claimed a barista profile you can add a picture of yourself and a cover image to it, and if you have claimed a cafe you can add a cover image to that page. Nothing else in the app takes a photo from you. Choosing one opens your device's own photo picker, which hands us the single file you pick, so the app never asks for access to your photo library and never sees the rest of it.

Treat any photo you add as public: profile pictures and cover images are shown to anyone who can see that page. They are stored with Supabase, our database provider, in a storage bucket that serves them over a public link. Do not upload a picture you would not want a stranger to see, and do not upload a picture of someone who has not agreed to it. Deleting your account takes these images off the page and makes their links stop working. You can also replace or remove a photo at any time while the page is yours, though that takes it off the page rather than out of storage: if you want the file itself gone before you delete your account, email us at the address below and we will remove it.

The camera is used for exactly one thing: if you are staff at a cafe running a loyalty card, scanning a customer's stamp QR code opens the camera. Nothing is recorded, and the app reads only the code.

Notifications

If you allow notifications, your device gives us a push token and we store it against your account, so it is personal data. We use it to tell you when someone credits one of your pours, follows you, or posts an update from a cafe or barista you follow. Push messages are delivered through Expo's push service, which passes them to Apple or Google to reach your device, and the message text can name the other person involved, for example "Sam credited you for a pour at Cafe Vogue".

Inside the app you can turn off four kinds of notification: new followers, posts from a cafe you follow, posts from a barista you follow, and pours logged by people you follow. Credits for your own pours always push. To stop all of them, withdraw the permission in your device settings; the rest of Pourtrait keeps working. Signing out on a device removes that device's token, and deleting your account removes the tokens for every device you used.

Companies that help us run the app

We use these providers to operate Pourtrait. They process data only on our instructions.

When you open the map in the app, your approximate location and map requests are handled by Mapbox so it can serve the right tiles. The coverage map on this website is different: it uses CARTO tiles and does not use Mapbox. Each provider has its own privacy terms.

Mapbox, Expo, Cloudflare, Google, ImprovMX, GitLab, CARTO and unpkg are based in the United States, so some processing happens outside the European Economic Area, as does the delivery of a push message once Apple or Google takes it. Where that happens, it is covered by standard contractual clauses or an equivalent safeguard recognised under GDPR.

This website

If you leave your email on this site to hear when your city opens, or tell us which city to map next, we store that with Supabase and use it for exactly that, one email when your city is ready, or as input to our rollout planning. Nothing else, no newsletter unless you ask for one, and you can ask us to delete it at any time at the address below. This website sets no advertising or analytics cookies.

Analytics

We use PostHog to understand which features people use, so we can improve the app. It records interaction events such as logging a pour, following a cafe or barista, applying a filter, finishing the guided tour, and which screens you view, along with basic technical details like your device type, operating system, and app version. PostHog also derives an approximate location, at country or city level, from the network address the event arrives on. That is separate from the device location described above and is not your GPS position. These events are linked to your account so we can tell repeat use from one off use.

Analytics events are not tied to the rest of the deletion described below. If you delete your account, the events already recorded stay with PostHog under the account identifier they were captured against, and we use them only as history for how the app has been used. They hold no name, email or address, and nothing you typed. If you want them removed as well, email us and we will ask PostHog to delete them.

What we deliberately do NOT send to analytics: the text you type into search (we record only how long a query was, never the words), your notes on a pour, or the contents of your posts. PostHog runs in its European region, so this analytics data stays within the European Economic Area.

Crash reports

When the app crashes or hits an error it cannot recover from, it sends a report to Sentry so we can find the cause and fix it. A report holds the error itself, the app version, your device model and operating system version, and a short trail of what the app was doing just before it failed: which screens were open, that a tap happened, and which network requests were made.

That trail is deliberately stripped of anything about people. The screen is recorded as its template, so "a barista profile" rather than which barista. A tap is recorded as the name of the button in our source code, never the words printed on it, because a button on this app can be labelled with someone's name. Network requests are recorded as the address only, with everything after the question mark removed, which is where names, email addresses and login codes would sit. We never send your name, your email address, your account identifier, a barista's name, anything you typed, or a screenshot. Sentry generates a random identifier for each installation of the app, so we can tell one crash on ten phones from ten crashes on one, and that identifier is not connected to your account.

Crash reports run on our legitimate interest in an app that works, not on your consent, so they are not covered by the analytics switch described above. They are the minimum needed to diagnose a fault and they identify nobody. There is no in-app switch for them today; you can object to this processing by emailing us at the address below, and we will handle the objection the way the law requires. Sentry runs in its European region, so this data stays within the European Economic Area, and reports are deleted on Sentry's normal retention schedule.

We do not sell your data

We do not sell your personal data, and we do not share it with advertisers. Pourtrait has no advertising network and no advertising trackers built into it. The only analytics is the product analytics described above, never used to target ads.

Why we are allowed to process this

Your email and login are processed because they are necessary to provide the app to you (contract). Location is processed only with your consent, and you can decline it and still use the app. Push notifications, and any picture you choose to put on a page you claimed, are likewise processed on your consent, and each can be declined or withdrawn on its own. Product analytics run only if you turn them on, on the Edit profile screen: they are off by default, so they rely on your consent, and declining leaves the app fully usable. Crash reports are different from product analytics: they carry no name, no account and nothing you typed, and they run on our legitimate interest in an app that does not break, so the analytics switch does not govern them. Public content moderation and abuse prevention, and listing and rating the baristas and cafes described above, rely on our legitimate interest in a safe and honest guide to great coffee, weighed against the rights of the people involved.

How long we keep it

We keep your account for as long as it is active. If you delete it, we erase who you are and keep what you contributed, in a form that no longer points back to you. Your email address, name, photo, Instagram handle, occupation and home city are deleted outright. The pours, ratings and notes you logged stay in the app without your name on them.

We do this because a rating is not only about you. Cafes and baristas are scored on the pours people logged, so deleting yours would quietly rewrite someone else's public reputation, and a barista would lose ratings because an unrelated person closed their account. Keeping the contribution anonymised is what makes those scores honest. Content other people created, such as a pour someone logged at a cafe where you worked, likewise stays as part of their record, with your name unlinked from it.

If you want your contributions removed as well, not just anonymised, email us and we will look at it individually. We will delete them where the law requires us to, and we will tell you either way.

Your rights

If you are in the European Economic Area, the GDPR gives you rights over your personal data. These include the right to:

To exercise any of these, email us at the address below and tell us what you want. We will respond within the time the law allows. You also have the right to complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

You can delete your account from inside the app at any time. If you no longer have the app installed, you can request deletion by email instead.

Deleting your account

You can delete your Pourtrait account and its data at any time, in two ways.

In the app: open Pourtrait, go to your Profile, open Account and settings, and tap Delete account. You are asked to type the word delete to confirm, because this cannot be undone. Your identity is then erased immediately and you are signed out.

By email: if you cannot access the app, email contact@pourtrait.nl from the address on your account and ask us to delete it. We verify the request and complete it within 30 days.

What gets erased: your email address and sign-in, your name, your Instagram handle, your occupation and home city, any picture, cover image, tagline or note you put on a page you claimed, whose links stop working, the push tokens for every device you used, your follows and follow requests, your likes, your blocked list, and your loyalty stamps and rewards. If you had claimed a barista profile or a cafe, it is unlinked from you and goes back to being unclaimed and unverified. You are signed out and cannot sign back in.

What stays, without your name on it: your pours, tasting notes and ratings, any replies and posts you left, the answers you gave about a cafe's amenities, your confirmations that a cafe exists, and any cafe you submitted. These keep the app's scores accurate and are no longer connected to you or to any address. Three things are deleted outright rather than kept this way: rename requests you made as a cafe owner, and any loyalty stamps and rewards you collected or handed out as staff.

What we may also keep: aggregate information that identifies nobody, and anything we are required to keep by law. Backups are purged on their normal rotation, so in normal operation a copy may persist there for up to 90 days.

If you want more than that: email contact@pourtrait.nl and ask. We will explain exactly what is still held, and delete the contributions themselves where the law requires it.

Children

Pourtrait is intended for adults. It is not designed for, or directed at, children under 16.

Changes to this policy

If we change how we handle data, we will update this page and change the date at the top. Significant changes will be flagged in the app.

Contact

Questions, requests, or concerns about your data: contact@pourtrait.nl.