Privacy Policy

Last updated 18 October 2026

This policy explains what personal data RoastHUD (roasthud.com) processes, why, and what your rights are. It follows the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU/EEA, the General Data Protection Regulation (GDPR).

Who is responsible

RoastHUD is run by Philip Pavo, Winterthur, Switzerland, as a private individual. For anything about your data, write to hello@roasthud.com.

What we collect

  • Account: your email address and, if you sign in with Google, your name and profile picture. We create a public handle (e.g. @name) from your email.
  • Email preferences: whether you have turned off the emails described under "Emails we send", and whether the reminder has already been sent to you.
  • Sign-in sessions: a session record with the IP address and browser of the device you signed in from, kept to keep you signed in and to protect accounts.
  • Your roasts: when you paste a share link from Roest or Roast World, we fetch that log and store it: temperature curves, roast events, weights, roast and machine names, and bean details. When you upload an Artisan or Stronghold file, we store the same, plus the other settings and notes saved in it. Plus anything you add: a public note and private notes, bean inventory, origin, farm, varieties and process.
  • Logs opened without an account: on the roast log viewer pages, anyone can open an Artisan or Stronghold file or a share link. We read it to show the roast and don't keep it. If you choose "Save this roast" before signing in, we hold the file or link for up to one day, under a random code in your sign-in link, and delete it once the roast is saved to your account.
  • Roest sync: if you connect your Roest account, we store the API client id and secret you enter (the secret encrypted) and your Roest username and machine names. We use them only to read your roast logs from Roest, never to change anything there. Disconnecting in Settings deletes them; your imported batches stay. Batches hidden by your sync filters, and synced batches you delete, are kept as a small record (log id and roast details, without the curve) so they aren't imported again.
  • Usage statistics: aggregated page views via Vercel Web Analytics (page path, referrer, country, browser and device type), and counts of how the main buttons and steps are used (for example which "Get started" button was clicked, or whether an import worked). These events say which button and where, never who: no names, emails or roast contents. It uses no cookies and no cross-site identifiers; visitors are counted with a hash that is discarded after 24 hours. Usernames in profile URLs and query strings are removed before anything is sent.
  • Abuse protection: short-lived request counters by IP address to rate-limit sign-in emails and the roast log viewers.

Why we use it

  • To provide the service you asked for: your account, your batches, charts, cards and inventory (performance of a contract).
  • To keep the service secure and working, and to understand which pages are used (legitimate interest).
  • To email you about your own account: a welcome email and a reminder, as described below (legitimate interest in helping you get started with the service you signed up for). You can object at any time.

We don't sell your data, show ads, or use it to profile you.

Emails we send

  • Sign-in links, when you ask for one, and notices about the service, such as significant changes to this policy or the terms. These are needed to run your account and can't be turned off.
  • A welcome email when you create your account, and a reminder if you haven't imported a roast a few days later. The reminder is sent once. If we add other emails about using RoastHUD, they follow the same rules and the same switch.

Welcome and reminder emails come from Philip Pavo at philip@roasthud.com, and you can reply to them. Every one has an unsubscribe link that works without signing in, and you can switch them off in Settings. Unsubscribing takes effect immediately and changes nothing else about your account. We don't send advertising for other companies and don't share your address with anyone for their marketing.

What is public

New batches are private: only you can see them. If you make a batch public, anyone with its link can see it, including your handle, bean details, numbers and your public note, and it appears on your public profile. Public batches and profiles are listed in our sitemap, so search engines and AI assistants can find and show them. Private notes are only ever shown to you. You can make a batch private again at any time.

Service providers

We rely on these providers, who process data on our behalf. Some are in the USA; transfers are covered by the providers' data processing terms and standard contractual clauses.

  • Vercel (USA): hosting and web analytics.
  • Neon (USA): database.
  • Resend (USA): sending sign-in, welcome and reminder emails.
  • Google (USA): sign-in, only if you choose "Continue with Google".

When you import or open a roast, we request it from Roest or Roast World using the link you provided. We don't send them your personal data.

Cookies

We use one essential cookie to keep you signed in. There are no advertising or tracking cookies, so there's no cookie banner.

How long we keep it

Your account, batches, beans and email preferences are kept until you delete them. Sign-in sessions expire after 7 days of inactivity; sign-in links after 10 minutes; rate-limit counters after minutes. Deleting your account removes your account, batches, beans and sessions immediately.

Your rights

You can ask for access to your data, a copy of it, correction, or deletion, and you can object to its processing, including to the welcome and reminder emails (use the unsubscribe link or Settings). You can delete batches yourself, and your whole account in Settings. For anything else, write to hello@roasthud.com. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local data protection authority.

Children

RoastHUD is not meant for children under 16.

Changes

If this policy changes, we update the date at the top. For significant changes we'll let account holders know by email.