Privacy Policy

Last updated: August 18, 2026

1. Who We Are

Rindr is a web application for keeping a cheese-making journal, available at rindr.cloud. The service is operated by DevOps Solutions Ltd, a company incorporated in Hong Kong (hereinafter "we", "the service").

For data processing inquiries: info@rindr.cloud

2. What Data We Collect

• Account: username, email address, password hash.
• Profile (optional): first name, last name, dairy name, address, avatar.
• Cheesemaking data: recipes, batches, brewing logs, photographs.
• Technical data: IP address at registration and login (for brute-force protection).

3. How We Use Your Data

• Providing service features: journal keeping, recipes, statistics.
• Sending email verification codes during registration and password changes.
• Protecting your account from unauthorized access.

We do not use your data for advertising or profiling. We disclose data to service providers only for the purposes and in the limited scope described below.

4. Data Storage and Sub-processors

We operate a distributed multi-region architecture:

• Application server (FastAPI + PostgreSQL): Hostinger, Boston, United States. Stores user accounts, recipes, batch journals, AI chat messages, and dairy publication state.
• Image storage: Cloudflare R2 object storage for recipe photos, batch step photos, and dairy logos. Database records hold only the storage path; the binary files live in R2.
• Transactional email (verification codes, password changes, admin notifications): Alibaba Cloud DirectMail, Singapore region.
• In-App Purchases on iOS (when subscribed): Apple App Store and RevenueCat (United States) — they receive the subscription identifier and your device-side anonymous customer ID, and notify our server when the subscription state changes.

Passwords are stored exclusively as bcrypt hashes.

5. AI Assistant

The AI assistant is disabled by default. Before enabling it, Profile settings show the selected response provider, jurisdiction, and a link to its privacy policy. The selection does not change automatically: a new provider applies only after the setting is saved, and an unavailable or invalid value fails without rerouting the request to another response provider.

To generate a response, the selected provider receives: the current message; current recipe and batch context (active step, targets, recorded measurements, ingredients, and notes); up to the latest 20 user and AI text messages from that batch; and, only when explicitly submitted, the current photo resized to at most 1280 pixels. Rindr does not add the user's name, email, or account ID to AI prompts. Photos are excluded from later text-chat history.

Response providers are:

• Anthropic Claude — Anthropic PBC, United States; transfers may include other countries; Privacy Policy.
• Qwen — Alibaba Cloud Model Studio international service, Singapore; international transfers may include China and other countries; Privacy Policy.
• DeepSeek — Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China; data is processed and stored in China; Privacy Policy. DeepSeek is text-only, so a photo is not sent to another AI provider.

When literature search is enabled, the current message text alone may additionally be sent to Qwen's embedding API. Account data, the full recipe, batch context, and chat history are not included in that request.

6. Your Rights

• Access: you can view all your data within the application.
• Correction: you can edit your profile data in Settings.
• Deletion: you can delete your account and all associated data in "Profile → Delete Account". Data is permanently deleted.
• Request: upon request to info@rindr.cloud, we will provide an export of your data or delete it manually.

7. Cookies and Analytics

Within the application (rindr.cloud/app) and the iOS app: only technical localStorage entries (JWT authorization token, language preference). No analytics cookies, no third-party tracking, no advertising.

Public landing pages (rindr.cloud/, /privacy, /terms, /dairies, /dairies/<name>): we load Google Tag Manager (container GTM-NCRNZVP5), which in turn loads Google Analytics 4 to measure visitor interest in our marketing pages. Google Analytics receives anonymized traffic data (page views, session duration, referrer, country, device type, anonymized IP). No personally-identifying information is collected from these pages, and the tracking does not extend into the logged-in app.

8. Changes to This Policy

In case of significant changes, we will notify users by email. The current version is always available on this page.