Last updated: October 17, 2026
The short version: our analytics use no cookies and never store IP addresses, the only cookie we set keeps you signed in, and we don't sell your data or use advertising trackers.
What we collect when you browse
For each page view, our own analytics record the page address, the site that referred you (domain only), your device type, your country and a visitor code. The visitor code is a one-way hash of your IP address and browser details, mixed with a random salt that changes every day and is discarded within 36 hours. It lets us count daily visitors but can't reveal your IP address or follow you across days.
If your browser sends a Global Privacy Control or Do Not Track signal, we don't record your page views at all.
When you click a buy button, we record the product, the retailer, the page you clicked from, your device type, your country and the same daily visitor code. We also keep site search terms, with nothing about who searched.
Cookies and browser storage
Signing in sets one cookie: a random session token, marked HttpOnly and Secure, that expires after 60 days without use or when you sign out. We store only a hash of the token. Cloudflare, which protects the site, may set a strictly necessary security cookie when it checks for bots.
Your browser also remembers a few things locally: light or dark mode, recent searches and your compare list. They stay on your device and are never sent to us.
Member accounts
An account stores your username and how you sign in: a password hash made with scrypt (we never see your password), passkey public keys, or both. With a passkey, your fingerprint, face or device PIN never leaves your device. If you add them, we also store an email address, display name, avatar, bio, location and favorite brew method.
We store your community activity too: threads, replies, votes, ratings, tasting logs, saved products, reports and notifications. Your username, profile and posts are public; your email address never is. For security, each session records your browser type and a hashed IP address, and we log sign-in attempts to stop password guessing.
Bot protection and safety screening
When you sign up or post, Cloudflare Turnstile checks that you're a person. It processes signals from your browser, including your IP address, and tells us only whether the check passed. Posts are also screened by an automated safety model that runs on Cloudflare's network.
Embedded videos
YouTube and TikTok players load only after you press play. Until then you see a preview image served from our own servers. Once you press play, YouTube (through its privacy-enhanced youtube-nocookie.com domain) or TikTok may set cookies and collect data under its own policy.
Newsletter and contact messages
If you subscribe to the newsletter, we store your email address, where you signed up, the date and an unsubscribe token. Every issue has a one-click unsubscribe link. If you unsubscribe, we keep your address marked as unsubscribed so we don't email you by mistake, unless you ask us to delete it. Our email delivery service receives your address only to send it.
The contact form stores your name, email address, message and a hashed IP address to prevent abuse.
Third parties
- Cloudflare hosts the site and our data, and runs bot protection and safety screening. Requests pass through its global network, so data may be processed outside your country.
- YouTube and TikTok, only when you press play on a video.
- Google Analytics, only if we turn it on. It's off in our standard setup, and because it sets cookies and processes IP addresses, we'll update this policy before enabling it.
- Retailers you click through to, such as Amazon, TikTok Shop or a brand's store, under their own privacy policies.
We don't sell or rent personal information, and we don't share it for advertising.
How long we keep data
| Data | How long |
|---|---|
| Page views | 400 days |
| Buy-button clicks | 2 years |
| Site search terms | 180 days |
| Sign-in attempt logs | 30 days |
| Sign-in sessions | Until you sign out, or 60 days without use |
| Account and posts | Until you delete your account |
| Newsletter subscription | Until you ask us to delete it |
| Contact messages | Until we delete them |
Your choices and rights
To get a copy of your data, correct it, or delete your account or anything else we hold, send a request through the contact page with the email address or username on the account. We'll confirm it's you and complete the request within 30 days, wherever you live. Deleting your account removes your profile, sign-in details, posts, replies, votes, ratings and tasting logs. Copies in our database provider's backups expire within 30 days.
Children
Coffee Reviews isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has created an account, tell us and we'll delete it.
Changes and questions
If we change this policy, we'll update the date at the top and post a notice on the site for significant changes. Questions about privacy? Use the contact page.