Privacy Policy
What CupCura collects, what it does not, and how to control it. Written in plain language rather than boilerplate.
Last updated 21 October 2026
CupCura is an independent editorial publication about coffee, tea, and botanical beverages. This policy explains exactly what happens to data when you visit cupcura.com.
The short version
Reading CupCura requires no account and we run no mailing list. We do not sell or rent visitor data to anyone, ever.
Four third parties are involved in a visit. Google Analytics measures how the site is used and receives nothing until you consent. Google AdSense serves the advertising that pays for the site, and serves non-personalised ads without advertising cookies until you consent. Microsoft Clarity records anonymised session replays and heatmaps, and follows the same consent rule as the other two (see below). Supabase stores the optional account described below, and receives nothing at all unless you choose to create one.
What we collect
Analytics data
We use Google Analytics 4 (measurement ID G-B39X2YRJBW) to understand which guides people find useful and where the site is slow. When you consent, Google Analytics may collect:
| Data type | Example | Purpose |
|---|---|---|
| Pages viewed | /beverage/beverage-yemen-mocha | Identify which guides are read |
| Approximate location | Country and city level | Understand our readership |
| Device and browser | Mobile Safari on iOS | Fix layout and performance problems |
| Referral source | A search engine or a link | Understand how people find us |
| Outbound link clicks | A click on a gear recommendation | Measure whether recommendations are useful |
IP anonymisation is enabled, so your full IP address is not stored by Google Analytics.
Consent and cookies
CupCura uses Google Consent Mode v2, and what happens before you choose depends on where you are:
| Where you are | Before you choose |
|---|---|
| UK, EU, EEA and Switzerland | Analytics and advertising run in cookieless mode. No _ga cookie is written and no identifier is stored for you. Nothing changes until you consent. |
| Everywhere else | Analytics and advertising are active by default, as permitted in those jurisdictions. Declining switches them off and clears the signals. |
In the UK, EU, EEA and Switzerland the choice is collected by Google's consent management platform (a certified Consent Management Platform that follows the IAB Transparency and Consent Framework). It shows its own message on your first visit, lets you accept, decline or pick purposes, and keeps your choice in its own storage on cupcura.com. CupCura's own banner (described below) appears only where Google's message is not shown, and never together with it.
On CupCura's own banner, pressing Decline applies everywhere, regardless of region, to Google Analytics, AdSense and Microsoft Clarity. You can change your mind at any time by clearing site data for cupcura.com, which brings the message or banner back.
| Storage item | Type | Lifetime | Set when |
|---|---|---|---|
| cupcura-consent-v1 | Browser localStorage | Until you clear it | When you answer CupCura's own banner, to remember your choice |
| _ga | Cookie | 2 years | Only after you accept |
| _ga_B39X2YRJBW | Cookie | 2 years | Only after you accept |
| _clck | Cookie (Microsoft Clarity) | 1 year | UK, EU, EEA and Switzerland: only after you accept. Elsewhere: unless you decline |
| _clsk | Cookie (Microsoft Clarity) | 1 day | UK, EU, EEA and Switzerland: only after you accept. Elsewhere: unless you decline |
The cupcura-consent-v1 entry is written only by CupCura's own banner, stores nothing but the word "granted" or "denied", is not an identifier and is never transmitted. Google's consent message keeps its own record of your choice (and the standard consent string) in storage on cupcura.com; that is Google's, it is not listed above, and clearing site data removes it too.
What we deliberately do not collect
- No newsletter or marketing email list
- No account required to read anything on the site. An optional account exists for ratings, reviews and saved drinks — see Accounts below for exactly what it stores
- No contact form submissions stored on a server. The contact route opens your own email client; your message goes directly to us and passes through no CupCura system.
- No fingerprinting and no cross-site tracking
- No sale or sharing of personal information as defined by the CCPA/CPRA
Microsoft Clarity
CupCura uses Microsoft Clarity to understand how pages are actually used — where readers scroll to, what they click, and where a layout is confusing them. Microsoft acts as our data processor for this.
Clarity is materially more invasive than page counting, and it is worth saying so plainly rather than listing it as another analytics tool. It records a reconstruction of your session: pointer movement, clicks, scrolling and the pages you moved between. It does not record keystrokes in form fields, and text you type is masked before it leaves your browser.
It follows your consent choice. In the UK, EU, EEA and Switzerland it does not load until you accept (on CupCura's banner) or consent to the measurement purposes in Google's message. Everywhere else it runs by default and pressing Decline stops it. We place you by your browser's time zone, so some visitors outside those regions are asked as well. If you would rather never be recorded, you can also block clarity.ms in your browser or content blocker.
Microsoft's own account of what Clarity collects and how long it keeps it is at privacy.microsoft.com.
Accounts
Everything on CupCura is free to read with no account. An optional account exists for readers who want to rate drinks, write reviews, post a photo, keep a shelf, or sync saved drinks across devices. Creating one is the only way any personal data reaches a CupCura system.
Accounts are handled by Supabase (supabase.com), acting as our data processor on infrastructure in the Asia Pacific (Tokyo) region. If you create one, Supabase stores:
| Data | Why | Kept until |
|---|---|---|
| Your email address | Identifies the account and allows a password reset | You delete the account |
| A hashed password | Signs you in. We never see, store, or transmit the password itself | You delete the account |
| Your ratings and reviews | Shown on the drink pages you contributed them to | You delete them, or the account |
| Photos you upload | Shown alongside your review | You delete them, or the account |
| Your shelf and saved drinks | Sync the lists across your devices | You delete them, or the account |
| Sign-in timestamps and IP | Security: detecting unauthorised access to your account | 90 days |
Ratings, reviews and photos are published on the site under whatever display name you choose. Everything else is visible only to you when signed in.
Deleting your account removes the email address, the password hash and the private lists immediately, and anonymises or removes published reviews at your choice. Ask from the account page, or email info@cupcura.com from the address on the account.
If you never create an account, none of the above applies and no CupCura system holds anything about you.
Vendor accounts
Sellers can apply to list products in the separate vendor directory through the vendor portal. A vendor application stores, in the same Supabase project:
| Data | Who can see it | Kept until |
|---|---|---|
| Business name, description, website, logo, categories and country | Public once the vendor is approved | The vendor deletes the profile, or asks us to |
| Contact name, email, phone, business address and registration number (all optional except where you choose to give them) | Only the vendor's own team and CupCura's editors | The vendor deletes the profile, or asks us to |
| Listings, images and the history of moderation decisions | Listings and images are public once published; the history is visible only to the vendor's team and CupCura's editors | The vendor deletes them, or the profile |
| Who changed what, and when | CupCura's editors (an audit log used to investigate misuse) | While the profile exists; deleted on request once it is closed |
We use vendor contact details only to deal with the application and the listings. We do not sell them, share them with advertisers, or use them for marketing.
Advertising
CupCura displays advertising through Google AdSense (publisher ID ca-pub-3162839445320098). The AdSense script loads only on the home page and on article, guide and drink pages, and never on a page that asks search engines not to index it.
Advertising is governed by the same consent choice that controls analytics (Google's message in the UK, EU, EEA and Switzerland, CupCura's banner elsewhere), through Google Consent Mode v2:
| Your choice | What Google may do |
|---|---|
| If you decline, and by default in the UK/EU/EEA/Switzerland | Serves non-personalised ads only. No advertising cookies are written and no advertising identifier is stored for you. Ads are selected from general page context, not from anything about you. |
| If you accept | May set advertising cookies and use them to personalise ads and measure their performance. |
Google and its partners may set the following once you accept advertising consent. These are Google's cookies, not ours, and are governed by Google's own privacy policy:
| Cookie | Set by | Typical purpose |
|---|---|---|
__gads, __gpi | Ad selection, frequency capping, and measurement | |
IDE, test_cookie | DoubleClick | Ad delivery and effectiveness measurement |
You can control ad personalisation directly at Google Ad Settings, independently of any choice made on this site. Declining on our banner does not remove ads — it removes the personalisation and the cookies behind it.
Third-party vendors, including Google, use cookies to serve ads based on a visitor's previous visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to CupCura and to other sites. You can read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites, and you can opt out of personalised advertising at aboutads.info or, in the EU and UK, youronlinechoices.com.
Affiliate links
Some equipment and bean recommendations are affiliate links. These are ordinary outbound links; the retailer, not CupCura, receives your visit and handles any purchase under its own privacy policy. See our Affiliate Disclosure for the full commercial picture.
Changing your mind
To change or withdraw your consent at any time, use Cookie settings in the footer of any page: it reopens Google's message, or CupCura's own banner where that is the one in use. Clearing your browser's site data for cupcura.com also brings the message or banner back on your next visit. Declining does not reduce access to any content on the site.
Your rights
If you are in the UK, EU, or EEA, the GDPR gives you the right to access, correct, erase, restrict, or object to processing of your personal data, and to lodge a complaint with your national supervisory authority. If you are a California resident, the CCPA/CPRA gives you the right to know, delete, correct, and opt out of sale or sharing.
If you have never created an account, CupCura itself holds no record of you and such a request resolves to Google Analytics and Google AdSense data. Google is the processor for both; you can also install Google's own opt-out browser add-on to block analytics collection across all sites.
If you do have an account, we hold the data listed under Accounts above, and can export, correct or erase all of it on request.
To exercise any right, email info@cupcura.com. We aim to respond within 30 days.
Data transfers and retention
Google Analytics and AdSense data is processed by Google on infrastructure that may sit outside your country, under Google's own contractual safeguards. Our GA4 property uses a 14-month retention window, after which event-level data is deleted automatically.
Account data is processed by Supabase in the Asia Pacific (Tokyo) region. For readers in the UK, EU or EEA this is a transfer outside your jurisdiction, made under the Standard Contractual Clauses in Supabase's data processing agreement. It is retained until you delete the account.
Children
CupCura is written for adults and covers caffeine dosage and botanical safety. It is not directed at children under 13, and we do not knowingly collect data from them.
Contact
Questions about this policy: info@cupcura.com
Reach the editorial team
Corrections, privacy requests, image licensing, and security disclosures all go to the same address.
info@cupcura.com