Last updated: 26 August 2026
This Privacy Policy applies to the website coffeeally.com. It explains what personal data we process when you visit this site, why we process it, and what rights you have.
In brief: CoffeeAlly is currently a blog and nothing more. There is no sign-up, no contact form, no newsletter, no comment section, and no advertising or tracking cookies. What we process is essentially the technical data that any website necessarily receives when a page is requested.
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Terms & Confetti
Gawan Langer
Reichsstraße 17
40217 Düsseldorf
Germany
Email: apps.telescope@gmail.com
We have not appointed a Data Protection Officer; we are not currently legally required to do so.
In plain language: This is who is accountable for this website and for how your data is handled. These details match our legal notice (Impressum).
We process personal data only where it is necessary to operate and secure the website, or where there is a legal basis for doing so. We do not sell data, we run no advertising networks, and we do not build user profiles.
In plain language: We collect only what we actually need, and we pass nothing on to advertisers.
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. On our behalf, Vercel processes the technical access data that your browser transmits automatically with every page request:
| Data | Example |
|---|---|
| IP address | the address at which your device is reachable on the internet |
| Date and time of access | 26 Aug 2026, 14:03 |
| URL requested | /en/blog/espresso-basics |
| Referrer URL | the page you came from, where transmitted |
| Browser and device identifier (user agent) | browser type, version, operating system |
| Volume of data transferred and status code | 42 KB, 200 |
Purpose: delivering the website, ensuring operational security, defending against attacks, and troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
Retention: Vercel stores these log entries only briefly, for operational and security purposes. We neither retain nor analyse them ourselves.
Transfer to the USA: Vercel Inc. is based in the United States. A data processing agreement under Art. 28 GDPR is in place. Vercel is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision of the European Commission; EU Standard Contractual Clauses have additionally been agreed. Despite these safeguards, access by US authorities under US law cannot be entirely ruled out.
Vercel's privacy notice: https://vercel.com/legal/privacy-notice
In plain language: For a website to reach you at all, your device has to tell the server where to send the page. That produces technical log entries — this happens on every website on the internet. Our host is based in the USA and is officially recognised for handling European data.
We use strictly necessary cookies only. We use no marketing, advertising, or tracking cookies. A cookie consent banner is therefore not required.
| Cookie | Purpose | Applies to | Lifetime |
|---|---|---|---|
| Language preference (next-intl) | Remembers whether you want to read the site in German, English, Spanish, or French | all visitors | up to 12 months |
| Supabase auth session | Keeps editorial team members signed in to the protected area (/admin) | signed-in editorial members only | session / until sign-out |
Legal basis: Section 25(2) no. 2 TDDDG (storage is strictly necessary to provide a service you have expressly requested) together with Art. 6(1)(f) GDPR.
You can delete or block cookies at any time in your browser settings. If you do, the site will no longer remember your language choice.
In plain language: The only cookies on this site remember your language and — if you are on our editorial team — your login. Nothing here follows you across other websites.
We do not currently use any analytics or audience-measurement software. No evaluation of user behaviour takes place.
In plain language: We currently don't count who visits this site or which articles get read.
We use Supabase for our database, sign-in, and file storage. The project we use runs in a region within the European Union; the data does not leave the EU. A data processing agreement under Art. 28 GDPR is in place.
For visitors to the public pages (home page, blog) no personal data is collected through this — there is no registration and no login.
Editorial accounts: accounts exist only for members of our editorial team. They are created manually; there is no public self-sign-up. The data processed consists of an email address, an encrypted password, and sign-in timestamps.
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR in the context of the respective contributor or author relationship.
Retention: for the duration of the collaboration; the account is deleted when it ends.
In plain language: As an ordinary reader you have no account here at all — accounts exist only for our editorial team, and that data sits on servers in the EU.
Images are uploaded exclusively by members of the editorial team; visitors cannot upload anything. On upload, all EXIF metadata — GPS location data in particular — is automatically stripped server-side before the file is stored. Images are held in Supabase Storage (EU region) and served from there.
In plain language: Photos often carry invisible extra information, such as where they were taken. We delete that automatically before an image goes online.
The typeface used on this website, "Manrope", is served from our own server. It is downloaded and bundled when the site is built. Loading a page therefore creates no connection to Google's servers, and no IP address is transmitted to Google for this purpose.
In plain language: Many websites load their fonts straight from Google, which tells Google who is visiting. We don't do that.
Our website is verified in the Google Search Console. Verification works via a confirmation file on our server; no Google tracking script is embedded in the website. The Search Console lets us see which search terms lead people to our pages. Google collects this data in the course of ordinary Google searches in any case; it is shown to us in aggregate form only and allows no conclusions about individuals.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information on Google's data processing: https://policies.google.com/privacy
In plain language: We see anonymous statistics about which Google searches bring people to us. Google gains nothing additional about you from this — there is no Google code running on our site.
This website currently has no contact form, no newsletter sign-up, and no comment function. No data entered by you is therefore collected.
If you write to us by email, we process your email address and the content of your message solely in order to deal with your enquiry (Art. 6(1)(f) or (b) GDPR), and we delete the correspondence once it is no longer needed and no statutory retention periods apply.
We embed no maps, videos, social media widgets, ad networks, or other third-party content via iframes or external scripts. Visiting this website therefore creates no unnoticed connections to third parties.
In plain language: No embedded YouTube, no Google Maps, no Facebook buttons — and so no silent connections to those companies either.
| Recipient | Role | Location / place of processing |
|---|---|---|
| Vercel Inc. | Hosting, delivery of the website | USA (DPF-certified, Standard Contractual Clauses) |
| Supabase | Database, sign-in, file storage | Region within the EU |
| Google Ireland Ltd. | Search Console (aggregate search statistics only, no script on the site) | Ireland / EU |
Beyond this, we disclose data only where we are legally obliged to do so (for example to law enforcement authorities). We do not sell data.
| Data | Retention |
|---|---|
| Server log files (Vercel) | briefly, for operational and security purposes |
| Language cookie | up to 12 months, or until you delete it |
| Auth session (editorial only) | until sign-out |
| Editorial accounts | for the duration of the collaboration |
| Email correspondence | until the matter is settled, subject to statutory retention periods |
You have the following rights regarding your personal data:
An informal message to [contact email] is enough to exercise any of these. We respond within one month.
Right to lodge a complaint: You may complain to a data protection supervisory authority at any time, in particular in the Member State of your residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). A list of the German supervisory authorities is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html
In plain language: You can ask at any time what we have stored about you, and require us to correct or delete it. An email is enough. If you are not satisfied with our answer, you can complain to the data protection authority.
This website is accessible worldwide and available in several languages. We apply the standards described above regardless of where you are: no advertising tracking, no sale of data, no profiling.
Note for California residents: We do not sell or share personal information within the meaning of the California Consumer Privacy Act (CCPA/CPRA). To the best of our assessment we do not currently meet the thresholds that make this law applicable. Independently of that, you can exercise the rights set out in Section 14 from outside the EU as well, using the email address given there.
The content of this website (coffee guides) is aimed at an adult audience. We do not knowingly collect personal data from children and we do not target minors. We do not process special categories of personal data under Art. 9 GDPR (such as health, religious, or political data).
The website is served exclusively over encrypted HTTPS (TLS); you can recognise this by the padlock symbol in your browser's address bar. Passwords for editorial accounts are stored in hashed form only. Access to the editorial area is limited to a small, defined group of people.
No system is entirely secure. Should a personal data breach occur that is likely to result in a high risk, we will notify the competent supervisory authority within 72 hours and inform those affected without undue delay (Art. 33, 34 GDPR).
We update this policy when our website or the legal situation changes. The version published on this page is the one that applies; the date at the top shows its current status.
Planned change: CoffeeAlly is intended to grow into a platform with public user accounts and user-generated content. That will change the scope of data processing considerably. This Privacy Policy will be revised in full before those features launch.
For questions about data protection or to exercise your rights, contact us at:
Terms & Confetti, Gawan Langer
Reichsstraße 17, 40217 Düsseldorf, Germany
Email: apps.telescope@gmail.com
This Privacy Policy was drafted on the basis of the website's technical documentation. It is not legal advice. Please have it reviewed by a qualified lawyer specialising in IT and data protection law before publication — in particular the details on the controller, international transfers, and audience measurement.