Privacy Policy

Last updated: April 5, 2026

1. Who We Are

MixoGuide (“we”, “us”, or “our”) is an online cocktail management platform that helps you curate your home bar, manage your pantry, and discover recipes.

For any privacy-related enquiries, please contact us at: [email protected]

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account data

Full name
Email address
Password (stored as a one-way bcrypt hash — we never store the plain-text password)
Profile picture (when signing in with Google)
Email verification status and timestamps

2.2 App usage data

Pantry items: ingredients you own, quantities, units, expiration dates, and personal notes
Planned cocktails and planned collections
Cocktail ratings (1–5 stars)
Cocktail favourites
Shopping list items derived from your pantry

2.3 Authentication data

OAuth tokens issued by Google when you choose to sign in with Google (we only retain the identifiers needed to link your Google account)
JSON Web Tokens (JWT) stored in secure, HTTP-only cookies for session management

2.4 Technical data

IP addresses and request metadata processed in transit by Cloudflare (see Section 5)
Standard web server logs retained for security and debugging purposes

3. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

Purpose	Legal basis
Creating and managing your account	Performance of a contract (Art. 6(1)(b))
Storing your pantry and cocktail data	Performance of a contract (Art. 6(1)(b))
Sending account verification and security emails	Performance of a contract (Art. 6(1)(b))
Maintaining service security and preventing fraud	Legitimate interests (Art. 6(1)(f))
Google OAuth sign-in	Consent (Art. 6(1)(a)) — you initiate the OAuth flow

4. How We Use Your Data

To provide, operate, and improve the MixoGuide platform
To authenticate you and maintain your session securely
To personalise recipe recommendations based on your pantry
To send transactional emails (e.g. email verification, password reset)
To enforce our Terms of Use and comply with applicable law

We do not sell your personal data to third parties, nor do we use it for advertising.

5. Data Storage & Third-Party Processors

5.1 Hosting

Your data is stored on a dedicated Virtual Private Server (VPS) provided by Hetzner Online GmbH, located in Helsinki, Finland (European Union). Finland is subject to GDPR; no transfer outside the EEA occurs for primary data storage.

5.2 CDN & DNS — Cloudflare

We use Cloudflare, Inc. for DNS, DDoS protection, and CDN services. HTTP requests to MixoGuide pass through Cloudflare’s network. Cloudflare may process IP addresses and request metadata in accordance with their Privacy Policy. Cloudflare is certified under the EU–US Data Privacy Framework.

5.3 Google OAuth

If you choose to sign in with Google, your authentication is handled by Google LLC. We receive only the basic profile information (name, email, profile picture) you authorise Google to share. Google’s data practices are governed by their Privacy Policy.

6. Data Retention

Account data: retained for as long as your account is active. Deleting your account triggers deletion of all associated personal data within 30 days.
Session tokens (JWT): expire after 30 days of inactivity.
Server logs: retained for up to 90 days for security purposes, then deleted.

7. Your Rights Under GDPR

As a resident of the EU/EEA, you have the following rights:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure (“right to be forgotten”) — request deletion of your account and associated data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to restriction of processing — ask us to limit how we use your data in certain circumstances.
Right to object — object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

8. Cookies

We use only essential cookies necessary for authentication and session management. No advertising or tracking cookies are used. Please refer to our Cookie Policy for full details.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted HTTPS connections (TLS), bcrypt password hashing, HTTP-only secure cookies, and role-based access controls. No method of transmission over the internet is 100% secure; we encourage you to use a strong, unique password.

10. Children

MixoGuide is a platform related to alcoholic beverages and is intended solely for users who are of legal drinking age in their jurisdiction (and at a minimum 18 years of age). We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of MixoGuide after changes are posted constitutes your acceptance of the revised policy.