What we track. What we don't.

What we track

Page views. Two tools.

• Vercel Analytics: cookieless, runs by default, counts page loads and rough traffic geography. No personal data.
• Google Analytics 4: sets cookies, runs only if you accepted on the consent banner. Helps us see which teas and articles people read most so we know what to write more of.

Account data. Only when you sign in. Saved in Supabase:

• Profile: display name, handle, the date you joined.
• Bookmarks: the teas and teahouses you saved.
• Tasting notes: body, brewing method, optional rating, flavour tags. Default private; you toggle per note to share with the tea table.
• Teahouse notes: short notes you wrote after visiting a teahouse. Default private.
• Suggested flavour tags: when you add a flavour that isn't in the dropdown, your suggestion goes into a queue so we can review it and add it to the curated set for everyone.

Security telemetry. Two automated, anonymous streams that help us keep TEAKI safe.

• Browser security reports: when our Content Security Policy would block a resource, your browser sends a small JSON report (which page, what was blocked, your browser type) so we can spot misconfigurations. No personal data; no account data; only fires if our policy is over-strict for your device.
• Cloudflare Turnstile: when you sign up, sign in, or request a password reset, a bot-check widget runs. Cloudflare evaluates browser signals (IP, user-agent, behavioural patterns) for the moment of that submission to decide human vs bot. Cloudflare's privacy policy applies to this transient evaluation; we receive only the pass/fail result.

Errors. Crash reports via Vercel hosting. No personal data attached.

What we don't

• No ads. None planned, none ever.
• No cross-site tracking. Your TEAKI activity stays at TEAKI.
• No data sales.
• No persistent browser fingerprinting. Cloudflare Turnstile evaluates browser signals at the moment of an auth request only, not stored, not used to identify you across sessions.

Cookies and local storage

Cookies set after you accept analytics:

• _ga and _ga_* (Google Analytics): count distinct visitors and sessions, roughly 13-month expiry.
• Supabase session cookie if you signed in: keeps you logged in, removed on sign out.

If you rejected analytics on the consent banner, the GA cookies are never set. Google Consent Mode v2 enforces this with ad_storage, ad_user_data, and ad_personalization permanently denied, so even if GA loads, it can't place advertising cookies.

Local browser storage: small entries we set on your device, never sent to our servers:

• Your consent decision (so the banner doesn't ask you again on every page load).
• Whether you've dismissed the install banner or the sign-up prompt, and how recently.
• Pages you've visited this session: used by the sign-up prompt to decide whether to show. Cleared when you close the browser.
• Your Supabase login token, if you're signed in. Stored locally; sent to Supabase only when you make an authenticated request.

Where your data lives

TEAKI uses a small number of trusted third parties to run the service:

• Supabase: hosts your account, bookmarks, and notes.
• Vercel: hosts the website and serves it to your browser.
• Google: Google Analytics (only if you accepted), Google Fonts, and Sign in with Google. If you use Sign in with Google, Google confirms the account and passes us your name and email so we can create your TEAKI profile. Nothing else.
• Apple: Sign in with Apple. If you use it, Apple confirms the account and passes us your email (or a private relay address if you chose to hide your real one) so we can create your TEAKI profile. Nothing else.
• Cloudflare: Turnstile bot-check on auth forms.
• Resend (EU region): sends our account emails (sign-up confirmation, password reset) and, if you opted in, the newsletter. Processes the recipient address and message contents purely for delivery.

Some of these process data in the US. EU and UK users: standard contractual clauses apply where required.

Newsletter

The newsletter is opt-in. If you tick the box when you create your account, or join from My Teaki, we record that choice and when you made it. Letters come from [email protected], sent through Resend. To personalise them we use only your own activity in TEAKI, like the teas you saved and the notes you wrote, and nothing else. Every letter has an unsubscribe link. One tap stops them, and we keep the timestamp of that too.

Native app permissions

The TEAKI iOS and Android apps ask for these device permissions on first use.

• Location. Used to show teahouses and tea events near you on the map. Your location stays on your device. TEAKI never uploads it to our servers or shares it with third parties. You can decline and still use every other part of the app.
• Notifications. Used to alert you when your brew timer finishes a steep. You can decline or turn these off in your device settings at any time.

The app does not access your camera, photos, contacts, calendar, or microphone.

Change your mind

If you accepted and want to opt out (or vice versa), tap the button below. The consent banner reopens; pick again.

Reopen consent banner

Contact

Questions, corrections, requests under UK GDPR (access, deletion, export): [email protected].

TEAKI is run by RI Studio Ltd, the data controller for your information, registered at 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.

Last updated: 2026-10-12.