> For the complete documentation index, see [llms.txt](https://docs.brewfather.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.brewfather.app/legal/privacy-policy.md). # Privacy Policy How Warpkode AS collects, uses, discloses, retains, and protects personal data in Brewfather, and the choices available to users worldwide. **Last updated: 19 October 2026** {% hint style="info" %} **In short.** This summary is not a complete statement of how we process personal data. If it differs from the full Policy below, the full Policy applies. * Warpkode AS (Norway) is the controller. Contact: . * We process account and brewing data, AI Assistant requests, subscription and limited payment details, and usage and device data. * We use it to run, secure, bill and improve Brewfather and to send account and service emails. The newsletter is a separate list. * Brewfather runs mainly on Google Cloud in the US, and AI requests go mainly to OpenAI. Sections 6 and 7 list providers and transfer safeguards. * We do not sell personal data for money. * Session recording is off unless you turn it on, analytics can be turned off where the app offers it, and every mailing-list email has an unsubscribe link. * Depending on the law, you can access, correct, delete or export your data, object to some processing, and complain to Datatilsynet or your local authority. * We keep data only as long as needed. Deleted data can stay in backups for up to five weeks. {% endhint %} This Privacy Policy explains how Warpkode AS processes personal data when you use Brewfather. It is a notice. It is not part of our contract with you, and it does not ask for blanket consent. For each purpose we rely on the appropriate legal basis, and we ask for consent where the law requires it. ## 1. Controller and contact details The controller for the processing described in this Policy is: **Warpkode AS** (Norwegian private limited company, *aksjeselskap*)\ Registered in the Register of Business Enterprises (*Foretaksregisteret*)\ Organisation no. 921 463 146 MVA\ Head office: Florø, Norway\ Email: Brewfather is offered worldwide, and privacy rights and legal terminology vary by country. The rights in Section 10 apply where the relevant law applies. We may choose to honour a request more broadly. An organisation may use Brewfather, for example through a brewery workspace, to process personal data about other people. Our roles then depend on the facts and the applicable law. The organisation is ordinarily the controller of that data, and we act as its processor to the extent the actual processing makes us one. We remain the controller for our own purposes described in this Policy. If a data-processing agreement is required, the organisation must arrange it with us at before that processing begins. ## 2. Scope This Policy covers the Brewfather web and mobile applications, websites and documentation, public sharing pages, accounts, brewery workspaces, subscriptions, public profiles and Library, files, the AI Brewing Assistant, APIs, the Brewfather MCP server and other AI-agent connections, webhooks, support, the affiliate programme, device integrations, and Connected Apps (the "Service"). Some features described here exist only in some app versions, plans, or platforms. Third-party applications, AI clients, stores, payment sellers, hardware, and websites have their own privacy notices. A developer or AI client that gets data through the Brewfather API or MCP server ordinarily acts as a separate controller for its own processing, as the [API Terms of Service](/legal/api-terms-of-service.md) explain. ## 3. Personal data we process The data depends on the features you use. ### Account and profile data * email address, display name, public handle, profile image or avatar, country, language, time zone, unit preferences, and account identifiers; * sign-in provider, and authentication and security records, including multi-factor authentication and passkey public-key data if you turn them on; * the Terms revision you accepted, when you accepted it, and the app version you used; and * plan, feature, trial, storage, account-status, and account-deletion and recovery information. When you use social sign-in, we do not receive your password from Apple, Google, or Facebook. These providers process sign-in data under their own terms. ### Brewery workspace data If you create or join a brewery workspace, we process its name and settings, its members and their roles, invitations, and which member did what. If a member invites you, we receive your email address from that member. Workspace content can include production plans, calendars, locations, equipment, inventory lots and movements, suppliers and purchase orders, cellar and packaging records, serving and tap data, and analytics. ### Brewing and other User Content * recipes, batches, ingredients, inventory, equipment and other profiles, readings, fermentation and device data, notes, settings, and calculations; * files and images attached to recipes or batches, including file name, type, size, and previews; * public profile, Library, sharing, ratings, or other material you choose to make public; and * import, export, history, backup, and deletion metadata. User Content may contain personal data about you or other people. Do not submit another person's personal data unless you have authority and a valid legal basis to do so. ### AI Assistant data If you use the optional AI Brewing Assistant, we process: * prompts, conversation history, responses, feedback, and automatically generated conversation titles; * recipe, batch, reading, inventory, device, analytics, and other account or workspace context that you attach, select, or make available to the feature; * files and images you submit for AI analysis; * voice recordings you make for dictation, which we send to the AI provider to turn into text; * search queries based on your request, when web search is used; and * recipe details and directions you give when you ask for a generated recipe image. AI requests go mainly to OpenAI. We may also route a request through OpenRouter or Vercel AI Gateway, which forward it to the model provider selected for it. To continue a conversation, we may ask OpenAI to store the conversation state, which OpenAI then keeps under its own policies. When web search is used, the AI provider runs the search. To answer questions about Brewfather, the assistant can look up this documentation through GitBook, sending a query the model writes from your question. We do not deliberately include your name or email address in AI requests, but content you provide may contain personal data. Provider logging, retention, processing location, and training practices can differ by model and route. OpenAI states that it does not use API input and output to train its models by default, but it may keep stored responses and abuse-monitoring logs for a limited period. OpenRouter states that practices vary by provider. **Do not assume that a Brewfather AI request has zero retention or can never be used for provider training unless Brewfather expressly confirms that configuration for the relevant feature.** For provider details, see [OpenAI's business-data information](https://openai.com/business-data/) and [OpenRouter's privacy information](https://openrouter.ai/privacy). We use AI conversation data to: * provide the feature you ask for and keep the conversation history shown in Brewfather; * maintain security, administer credits, and diagnose failures; * answer a support request; and * comply with law or protect legal rights, as this Policy describes. We may also use feedback you give on answers, and samples of conversations with direct identifiers removed where practicable, to evaluate and improve the AI Brewing Assistant. We do not currently use AI conversations or User Content to train or fine-tune an AI model. If we plan to, we will tell you in advance and give you a way to opt out, or ask for your consent where the law requires it. Using aggregated or de-identified User Content to calibrate, test, or improve Brewfather's calculations, formulas, and default and reference data is not training or fine-tuning an AI model. ### Subscription and transaction data * seller, app store, transaction, customer, and order identifiers; * subscription product, price, currency, tax, status, start, renewal, cancellation, and refund information; and * limited payment-method information that a payment provider makes available, such as card brand, expiry date, or last four digits. Payment providers: * Paddle is the merchant of record for current web purchases. Paddle's checkout and Paddle Retain (formerly ProfitWell) run on the web app, and Boathouse provides the billing portal for Paddle subscriptions. * Apple and Google process in-app purchases. RevenueCat helps administer mobile subscriptions and entitlements using your Brewfather user ID. * Stripe processes legacy subscriptions and appears in historical transaction records. We do not receive full card numbers or card security codes from these providers. ### API, MCP, Connected App, integration, and device data * API-key name, scopes, workspace, expiry, creation, last-use, and revocation records; * request time, endpoint, response status, usage, rate-limit, network-address, and security records; * for Connected Apps, MCP, and other OAuth connections: the client's identity, the workspace and scopes you approved, consent, token, expiry, and revocation records, and security-audit events; * webhook and Custom Endpoint destinations, authentication tokens, payloads, and delivery status; and * data we receive from a device or integration you turn on, such as readings, device names and identifiers, logging IDs, network address, and account identifiers the third party uses. When you connect an AI client, such as ChatGPT, Codex, or Claude, through the Brewfather MCP server or a Connected App, it can read the data in the workspace and scopes you approve. Depending on those scopes, that can include recipes, batches, readings, logs and tasting reports, inventory, suppliers and purchase orders, planning and calendar data, equipment, cellar and serving data, analytics, device status, and workspace context such as locale, time zone, and unit system. The connection does not give the client your password, Brewfather sign-in tokens, payment details, or AI Brewing Assistant conversations. The client's operator processes the data it receives under its own terms and privacy notice. ### Technical, analytics, and communications data * IP address, approximate location based on IP, device and browser type, operating system, app version, language, time zone, referral URL, and diagnostic identifiers; * app interactions, such as pages viewed, features used, and clicks, and performance, crash, error, and security logs; * if you turn on session recording, recordings of how you use the app, with text and entered values masked; * survey responses and in-app feedback; * cookie, local-storage, offline-cache, notification, and preference data; and * support requests, emails, issue reports, and related correspondence. ### Email lists When you create an account, your email address, display name, and Brewfather user ID are added to our account mailing list in Mailchimp. We use it for onboarding and service emails about Brewfather and your account, not for marketing. Our newsletter is a separate list: if you sign up for it, we use your email address to send Brewfather news and offers. You can unsubscribe from either list at any time through the link in every email or by contacting us; unsubscribing from the newsletter also removes you from the account mailing list. We record whether you are subscribed and how you interact with our emails. ### Affiliate data If you follow a referral link, or apply for or take part in the affiliate programme, we may process referral identifiers and attribution, clicks, account or transaction identifiers, and conversions. We pass a referral identifier to Paddle with a web purchase. For Affiliates, we also process identity and contact data, website or channel information, commissions, payout and tax information, compliance records, and communications. ## 4. Sources of personal data We collect data: * from you, when you register, set up the Service, submit content, contact us, or use a feature; * automatically, from your device and your use of the Service; * from Apple, Google, Facebook, or another sign-in provider you choose; * from Paddle, Apple, Google, RevenueCat, Stripe, or another payment or subscription provider; * from hardware, Connected Apps, AI clients, webhooks, APIs, or integrations you authorise; * from an organisation or workspace member who invites you or manages an account for you; and * from affiliate, referral, support, analytics, security, and fraud-prevention providers. ## 5. Purposes and legal bases The legal bases below refer to the GDPR and substantially similar laws. In other countries, another lawful basis may apply. | Purpose | Data commonly used | Legal basis where GDPR applies | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Create and administer accounts and workspaces; provide recipes, batches, inventory, files, exports, integrations, support, and other requested features | Account, workspace, User Content, files, device, integration, support, and technical data | Performance of our contract; steps requested before contract | | Provide API, Connected App, MCP, and AI-client access that you authorise | Account, workspace, User Content, credential, authorisation, and request data | Contract and your instruction to share the data | | Provide paid plans, administer billing, entitlements, refunds, tax, accounting, and transaction support | Account, plan, transaction, and limited payment data | Contract; legal obligations; legitimate interests in payment administration and claims | | Provide the AI Assistant when you choose to use it | AI prompts, voice recordings, responses, selected context, files, account, usage, and feedback | Contract and your request to use the feature; consent where separately required | | Authenticate users and protect accounts, users, and the Service; prevent fraud, abuse, prohibited competitive access, and security incidents | Account, credential, API, device, network, usage, log, and transaction data | Contract; legal obligations; legitimate interests in security, integrity, enforcement, and fraud prevention | | Operate, diagnose, measure, and improve the Service, including its calculations, formulas, default and reference data, and the AI Brewing Assistant; develop features; and create aggregated or de-identified statistics and insights, including through product analytics and crash reporting | Technical, usage, diagnostics, and feedback data, and User Content and AI conversation data, de-identified or aggregated where practicable | Legitimate interests in reliable product operation, improvement, and insight, subject to your right to object; consent for session recording | | Measure advertising and app installs, including through Google tags on public sharing pages and the Facebook SDK in the mobile apps | Device and online identifiers, page and app events, and approximate location | Legitimate interests in measuring our marketing; you can object at any time | | Publish a profile, recipe, or link you deliberately make public; make public recipes searchable and available to copy; and feature public recipes and profiles in the Service and in our promotion of Brewfather | Selected User Content, profile data, and public-recipe owner identifiers | Contract and your request to publish; legitimate interests in promoting the Library and Brewfather, subject to your right to object; consent where required | | Communicate service, security, legal, billing, and support messages | Account, transaction, and communications data | Contract; legal obligation; legitimate interests in administering the Service | | Send onboarding and service emails through the account mailing list | Contact, account, and engagement data | Contract; legitimate interests in helping users get started and informing them about the Service, subject to your right to object and unsubscribe at any time | | Send the newsletter, other marketing emails, and surveys | Contact, preference, and engagement data | Consent; where the law allows it without consent, legitimate interests in marketing similar Brewfather services to existing customers; you can unsubscribe at any time | | Operate and police referrals and the affiliate programme | Affiliate identity, referral, conversion, payment, tax, and compliance data | Contract for Affiliates; legal obligations; legitimate interests in attribution, preventing abuse, and administering the programme; consent where required for attribution technologies | | Evaluate and complete a financing, merger, acquisition, reorganisation, or sale of all or part of the Brewfather business | Data relevant to the transaction, minimised and de-identified where practicable | Legitimate interests in financing, continuing, and transferring the business | | Comply with law, valid legal process, and regulatory requests; establish, exercise, or defend legal claims | Data relevant to the request, obligation, investigation, or claim | Legal obligation; legitimate interests in legal compliance and protection of rights | Where we rely on legitimate interests, we weigh necessity, proportionality, people's reasonable expectations, and the effect on them. You can object as Section 10 describes. You do not have to provide optional profile, public-sharing, newsletter, affiliate, file, integration, or AI data. Without account data and core User Content, we may not be able to provide the Service you ask for. Payment providers need transaction data for paid plans. ## 6. How we disclose personal data We disclose only the data reasonably necessary for the purpose. The table lists the providers we currently use, and the list after it covers other recipients. A current feature may not use every provider, and some appear only in some app versions or platforms. We may add or replace providers, and Section 13 applies to material changes. | Recipient | What it does for Brewfather | Privacy information | | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | Google Cloud and Firebase | Hosting, database, authentication, file storage, backend functions, push notifications, performance monitoring, Crashlytics crash reports, and Firebase Analytics in the mobile apps | [Firebase](https://firebase.google.com/support/privacy), [Google Cloud subprocessors](https://cloud.google.com/terms/subprocessors) | | Google Analytics and Google Ads | Measurement and advertising-conversion tags on public sharing pages and API documentation pages | [Google partner sites](https://policies.google.com/technologies/partner-sites) | | Google Fonts and Google Play services | Fonts in some app versions; Google sign-in and Play billing | [Google Privacy Policy](https://policies.google.com/privacy) | | Apple | Sign in with Apple and App Store purchases | [Apple Privacy Policy](https://www.apple.com/legal/privacy/en-ww/) | | Meta (Facebook) | Facebook Login; the Facebook SDK in the mobile apps can send app events and device identifiers to Meta | [Meta Privacy Policy](https://www.facebook.com/privacy/policy/) | | PostHog (EU hosting) | Product analytics, error tracking, surveys, and optional session recording | [PostHog Privacy](https://posthog.com/privacy) | | Sentry | Crash and error reporting in some app versions | [Sentry Privacy Policy](https://sentry.io/privacy/) | | Paddle, including Paddle Retain (formerly ProfitWell) | Merchant of record, web checkout, subscription and retention tooling | [Paddle Privacy](https://www.paddle.com/legal/privacy), [ProfitWell](https://www.profitwell.com/privacy-policy) | | Boathouse | Billing portal for Paddle subscriptions | Provider's website | | RevenueCat | Mobile subscription and entitlement administration | [RevenueCat Privacy](https://www.revenuecat.com/privacy) | | Stripe | Legacy subscriptions and historical transactions | [Stripe Privacy](https://stripe.com/privacy) | | Tolt | Affiliate and referral tracking | [Tolt Privacy](https://tolt.io/privacy-policy) | | Mailchimp (Intuit) | Account mailing list and newsletter email | [Intuit Privacy](https://www.intuit.com/privacy/statement/) | | Intercom | Customer support and chat, where used | [Intercom Privacy](https://www.intercom.com/legal/privacy) | | Email-delivery providers | Sending account, security, and notification emails | Provider's website | | OpenAI | AI Assistant, dictation, image generation, and web search | [OpenAI Privacy](https://openai.com/policies/privacy-policy/) | | OpenRouter and Vercel AI Gateway | Alternative AI routing to model providers | [OpenRouter](https://openrouter.ai/privacy), [Vercel](https://vercel.com/legal/privacy-policy) | | GitBook | Hosts this documentation and answers the AI Assistant's documentation lookups | [GitBook Privacy](https://www.gitbook.com/privacy) | | Algolia | Search of public community recipes | [Algolia Privacy](https://www.algolia.com/policies/privacy) | We also disclose personal data to: * **AI clients you connect**, such as ChatGPT or Codex (OpenAI) and Claude (Anthropic), and **Connected Apps, hardware and device services, webhook recipients, API developers, and other third parties you direct us to connect with**, such as Brewtools Cloud, RAPT, SmartPID, or Plaato; * **members of a brewery workspace**, who can see the workspace data their role allows; * **affiliate-platform, payout, tax, and fraud-prevention providers**; * **professional advisers, auditors, insurers, and financing sources**, and **prospective investors or buyers and their advisers** when we evaluate a financing, merger, acquisition, reorganisation, or sale of all or part of the Brewfather business, under confidentiality and limited to what the evaluation needs; * **a buyer, successor, or affiliate** that acquires all or part of the Brewfather business. It takes over our role for the data it receives, as controller under this Policy or as processor for an organisation. It follows this Policy until it gives notice of a change and meets any other requirement the law sets for that change; and * **courts, regulators, law enforcement, and other authorities** where the law requires or permits disclosure, or where disclosure is reasonably necessary to protect rights, safety, and the Service. Payment sellers, sign-in providers, AI clients you connect, and other third-party applications may act as independent controllers. Service providers that act for us are bound by contract as the applicable law requires. When you make User Content public, it is disclosed to the public or to anyone with the link. Public recipes may be indexed for search together with an identifier of the recipe's owner. Search engines, recipients, and archives may copy public content. We may use and disclose aggregated or de-identified information that no longer identifies anyone, and we take reasonable measures not to re-identify it. We do not claim that merely pseudonymised data is anonymous. ## 7. International transfers Warpkode AS is in Norway. Brewfather's backend, database, and file storage run mainly on Google Cloud in the United States. PostHog processes analytics in the EU. Other providers and recipients may process personal data in Norway, the EEA, the United Kingdom, the United States, and other countries where they or their subprocessors operate. Those countries may have different privacy laws. Where the law requires a safeguard for a transfer, we rely on: * for a provider in the United States: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework if the provider is certified under it, and otherwise the Commission's standard contractual clauses in our agreement with the provider, with supplementary measures where appropriate; * for the United Kingdom or another country with an adequacy decision: that decision; and * for other countries: standard contractual clauses. A transfer may also take place where it is necessary to perform a contract at your request, or where another statutory exception applies. You can get a copy of the safeguards that apply to your data by emailing . We may redact commercially confidential and security information. ## 8. Retention We keep personal data only as long as reasonably necessary for the purpose described, including to provide the Service, comply with law, resolve disputes, enforce agreements, prevent fraud and abuse, and maintain security. To decide how long that is, we consider account status, feature use, sensitivity, legal limitation and accounting periods, unresolved claims, and technical backup cycles. In general: | Data | How long we keep it | | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account data and User Content | While the account is active. The account-deletion process then removes them from active systems, subject to the exceptions below. Where the app offers a recovery period, deletion happens when that period ends. | | A free account not signed in to for 24 months | It may be closed and deleted after notice, as Section 13 of the [Terms of Service](/legal/tos.md) describes. | | Deleted account data in protected backups | **Up to five weeks**, until the ordinary backup cycle overwrites or deletes it. | | Transaction, tax, accounting, fraud, and legal-claim records | For the period the applicable law requires or permits. | | Security, API, access, and diagnostic logs | For a period proportionate to operational, abuse-prevention, and legal needs. | | Revoked API keys | Removed within about 90 days. | | OAuth and MCP connection records | Deleted 90 days after the connection's scheduled expiry or its revocation, whichever is later (up to about 120 days after an early revocation). | | Authorisation security-audit events | Up to about 400 days. | | Webhook delivery records | Up to 90 days. | | Product-analytics data (PostHog) | A limited period. Deleted when the account is deleted. | | Support and legal correspondence | As long as needed to resolve the matter and protect legal rights. | | Terms-acceptance records | As long as reasonably necessary to prove the agreement, administer the Service, and establish, exercise, or defend legal claims, subject to applicable limitation periods and law. | | Email-list data | Until you unsubscribe or it is no longer needed. After you unsubscribe, we keep a minimal suppression record so we can honour it. | | Affiliate records | While the relationship is active, and afterwards for payment, tax, fraud, audit, and legal purposes. | | AI conversations in Brewfather | They expire **365 days after a message was last saved in them** (renaming a conversation does not extend this), unless you delete them or the account earlier, subject to backups and legal exceptions. | | AI usage records and AI transaction records | Generally one year for usage records and three years for transaction records. | External AI providers apply their own retention practices, as Section 3 describes. Deletion may not remove: * aggregated or genuinely de-identified data; * data another user or workspace independently owns; * content already copied by a public recipient or a third party you connected; or * records we must or may keep under this section for tax, accounting, fraud prevention, security, dispute resolution, legal claims, or compliance with law. Where appropriate, we isolate data kept after deletion from ordinary use, and we use it only for the reason we keep it. [Account Deletion](/legal/account-deletion.md) describes the self-service process, the recovery period, and copies held by service providers that you can ask us to delete. ## 9. Cookies, local storage, and similar technologies The Service and documentation use cookies, browser local storage, IndexedDB, device storage, SDKs, tags, and similar technologies. They support sign-in, security, preferences, offline use, language, subscription status, checkout, referral attribution, diagnostics, analytics, and advertising measurement. * **Strictly necessary** technologies support sign-in, security, preferences, offline use, and checkout. * **Product analytics (PostHog)** uses a cookie and local storage, including before you sign in. Where the app offers it, you can turn product analytics off and choose whether to allow session recording under **Account → Data and privacy**. Session recording is off unless you turn it on. Browser Do Not Track and Global Privacy Control signals turn product analytics off. * **Referral and checkout** scripts from Tolt and Paddle run on the web app. * **Google tags** on public sharing pages and API documentation pages measure visits and advertising conversions. * **Mobile SDKs** from Firebase and Meta collect app-usage, crash, and device information in the mobile apps. Controls can vary by platform and app version. You can delete or block storage in your browser or device settings, but this may sign you out or stop security, offline, preference, or other features from working. You can also contact us to ask us to stop analytics or marketing processing. ## 10. Your rights and choices You can: * update many account and profile details in Brewfather; * revoke Connected Apps and AI-client connections; * create, revoke, and rotate API keys; * manage public sharing; * delete AI conversations; * export available data; * turn product analytics and session recording off where the app offers it; * unsubscribe from the account mailing list or newsletter; and * delete the account through the features described in the documentation. We do not sell personal data for money. Your local law may treat a disclosure described in this Policy, such as advertising measurement, as a "sale", "sharing", or targeted advertising that you have a right to opt out of. If so, you can opt out through an available privacy control or by emailing us. We do not use Brewfather personal data to make decisions about users based solely on automated processing that produce legal or similarly significant effects. ### EEA, Norway, and United Kingdom Where the GDPR, UK GDPR, or similar law applies, you may have the right to: * access your personal data, and get a copy of it and information about how we process it; * correct inaccurate or incomplete data; * have data deleted; * restrict processing; * receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible and legally required, have it sent to another controller; * withdraw consent at any time, without affecting processing before the withdrawal; and * complain to a supervisory authority. **Right to object.** You may object to processing based on legitimate interests, and you may object at any time to direct marketing. Norway's supervisory authority is [Datatilsynet](https://www.datatilsynet.no/). You may also complain to the authority where you live or work, or where an alleged infringement took place. ### Other regions Depending on where you live and whether the relevant law applies to Warpkode AS, you may have the right to know about, access, correct, delete, or get a portable copy of personal data; withdraw consent; opt out of certain targeted advertising, sale, sharing, or profiling; and appeal a refused request. Canadian users may also challenge our compliance. Australian users may make a privacy complaint and ask for access or correction. ### Making a request Email from the account email and describe your request. We may ask for information reasonably necessary to verify your identity and authority. An authorised agent must provide proof of authority where the law lets us require it. We will respond within the time the applicable law requires and explain any lawful limitation or refusal. We do not discriminate against anyone for exercising a privacy right. Where the applicable law requires it, after we correct, delete, or restrict personal data, we will tell each recipient we disclosed it to, unless this proves impossible or involves disproportionate effort, and we will tell you who those recipients are if you ask. Rights are subject to exceptions, including to protect other people's rights, security, legal privilege, and freedom of expression, and to meet legal retention duties. The in-app backup export is a convenience feature. It does not limit a statutory access or portability request, and it does not give a third party permission to use the Brewfather API. ## 11. Security We use technical and organisational measures designed to protect personal data appropriately for its nature and the risk. They may include access controls, encryption in transit, protected storage, logging, monitoring, backups, software updates, and incident response. No online service can guarantee absolute security. Protect your credentials, use a secure device and network, limit API and AI-client scopes, and review your public links, Connected Apps, and AI-client connections. Tell promptly if you suspect a compromise. If a personal-data breach requires notice, we will notify affected people and authorities as the applicable law requires. ## 12. Age eligibility and children Brewfather accounts are only for people who are at least 18, as the [Terms of Service](/legal/tos.md) state. We do not knowingly allow a person under 18 to keep an account. If you believe a person under 18 has provided personal data, contact us so we can investigate and take appropriate steps, which may include restricting or deleting the account and data, subject to applicable law. A parent or guardian may also contact us about a child's privacy rights. ## 13. Changes to this Policy We may update this Policy when the Service, our providers, the law, or our processing changes. We post the current version with its date. If a change materially affects how we use personal data, we will also notify you in another way, and ask for your consent where the law requires it. ## 14. Contact and complaints Send questions, requests, and complaints to . Writing "Privacy" in the subject line helps us route your message. We will investigate privacy complaints and respond within the time the applicable law requires. Brewfather © Warpkode AS\ Revision: 20261019 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.brewfather.app/legal/privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.