How personal data is handled
Privacy Notice
This notice explains how the BeerRun team ("we" and "us") handles personal data. Agreement to the Terms of Service is a contract action; acknowledging this notice is not blanket consent to all processing described below.
1. Data collected and its sources
BeerRun processes information that you submit or create, including:
- account data: username, password hash, authentication identifier, and dated Terms acceptances;
- beer-run data: run name and visibility, membership role, and invite participation;
- drink entries: drink type, brand, quantity, alcohol percentage, date, time, and timezone;
- precise location coordinates when you choose to share your device location;
- photos you choose to upload; and
- messages and evidence sent when you contact us or report content.
Your browser and network also send technical request data needed to deliver the site, such as IP address, browser/device information, requested URL, and request time. BeerRun does not add IP addresses or user agents to Terms-acceptance evidence and does not use them for advertising or analytics. Ordinary server or reverse-proxy access logs may process this data as part of operating and securing the service.
2. Purposes and lawful bases
| Purpose | Main data | Lawful basis |
|---|---|---|
| Create accounts, authenticate users, record Terms agreement, and provide beer-run features | Account, acceptance, membership, entry, location, and photo data | Contract — Article 6(1)(b) GDPR |
| Keep the service secure, diagnose failures, prevent abuse, and perform proportionate human moderation | Account, request, security, content, and report data | Legitimate interests in secure and lawful operation — Article 6(1)(f) GDPR |
| Respond to rights requests, lawful orders, and qualifying security incidents | Identity, contact, account, audit, and incident data | Legal obligation — Article 6(1)(c) GDPR, where applicable |
Device permission for geolocation lets you control whether the browser supplies coordinates. It does not turn every other processing activity into consent-based processing. If a future optional feature genuinely relies on consent, it will be requested separately and can be withdrawn without affecting earlier lawful use.
3. Public and private visibility
Public beer runs, their entries, usernames, map locations, rankings, and photos can be viewed by anyone who can reach the site. Private beer-run data is intended for authenticated members of that run. Run owners can see membership information and use owner controls. A valid invite link exposes limited run-identifying information before a recipient joins. Do not submit another person's data unless you have a fair and lawful reason to share it with that audience.
4. Storage and recipients
Application data and uploaded photos are stored on our Netherlands-hosted system. No outside company is given access to stored account, run, entry, or photo data as part of normal operation. Data is shown through BeerRun to the public or beer-run members according to the selected run's visibility. We may access it when reasonably necessary to secure or maintain the service, or disclose it when law requires.
BeerRun currently has no routine backup system. Loss or deletion may therefore be permanent. The absence of backups reduces secondary copies but creates a significant availability and resilience risk.
5. External browser services
The main application currently asks your browser to load Google Fonts, Leaflet
and marker-cluster files from unpkg.com, and map tiles from
OpenStreetMap tile servers. Those providers receive ordinary request metadata,
which can include your IP address, browser information, requested resource,
time, and referring page. Their own notices govern their independent processing.
BeerRun does not use these requests for ads or audience analytics. The Terms
and Privacy pages themselves use local styling and do not need those assets.
6. Storage on your device
The app stores your access token and limited interface settings, such as the selected beer run and display preferences, in your browser. This is necessary for login continuity and the requested interface; it is not used for advertising or cross-site tracking. Logging out removes the access token. You can also clear site data through your browser, which may sign you out and reset preferences.
7. Retention
Account, acceptance, membership, entry, and photo data is kept while needed to provide the account and selected beer runs. You can delete individual entries or permanently delete your account through Account settings. Deleting an entry removes its photo. Deleting your account removes your entries and their photos. Other users' accounts, entries, and photos are not deleted. If you own a beer run, you must delete that run before deleting your account. Security, rights-request, dispute, or legal-obligation records are kept only as long as reasonably needed for that purpose.
BeerRun does not create an analytics profile or separate long-term marketing history. Operational logs, if enabled by the server or proxy, should be kept for a short security and troubleshooting period chosen and documented by us.
8. Security
We use safeguards intended to protect personal data and limit access to it. No system is completely secure. Keep your password and invite links private, use a supported browser, and report a suspected breach promptly.
9. What BeerRun does not currently do
BeerRun does not currently use advertising, behavioural analytics, payment processing, automated decision-making, or profiling that produces legal or similarly significant effects. It is not designed for children and account use is restricted to adults aged 18 or older.
10. Your data-protection rights
Creating an account is optional. If you create one, you choose whether to add drink entries, share your device location for an entry, or upload an optional photo. These choices are voluntary, but they are not blanket consent to every processing activity; the lawful bases we use are explained in section 2.
You can delete individual entries or permanently delete your account through Account settings without emailing us. Account deletion removes your account, memberships, entries, Terms-acceptance records, and photos uploaded for your entries. If you own a beer run, you must delete that run first. Other users' accounts, entries, and photos are not deleted.
You may also contact us to request access, correction, restriction, portability, or objection where those rights apply. We may ask for proportionate proof of identity. These rights can have legal limits, which we will explain if relevant.
11. Changes and contact
This notice will be reviewed when BeerRun's data practices change. Its version and effective date will be updated, and material Terms changes may require a new affirmative agreement.
Data controller: Matei Penca
Privacy contact: matei.penca1@gmail.com