Privacy Policy

1. Who we are

This policy is for QTea's Cha (you may also see the name QTeaCake) at qteascha.com. We are an independent project based in Fort Wayne, Indiana, United States.

This policy covers the public website, the shop map, the tea guide, the order page, waitlist and contact forms, and any AI recommendation tool we show on the site.

2. Notice at collection

Depending on how you use the site, we may collect:

• Identifiers — name and email, if you send a form or join the waitlist.
• Customer records / messages — the text of a contact message or a shop suggestion.
• Internet activity — searches, filters, shop clicks, and affiliate-link clicks, stored as analytics events.
• Location — a city, zip, or address you type; or coordinates from your browser if you tap “use my location.”
• Preferences you type into the AI tool — used only to generate tea recommendations.

We use this to run the map, answer you, send waitlist notes, measure which places are tea deserts, and (on the order page) see which product links people follow. We do not use it to sell advertising profiles.

3. What we collect, in detail

Information you give us

• Waitlist: email address.
• Contact form: name, email, and message.
• Suggest a shop: shop name, address or website, and any notes you add.
• AI sommelier (if you use it): the preference text you type.
• Admin or business accounts: if we give you a login, the email and password you use to sign in (password is handled by Firebase Authentication, not stored by us in plain text).

Information collected automatically

• Standard server and hosting logs (IP address, browser type, pages requested, approximate time) from our host and from Firebase.
• Analytics events we write ourselves: location search text, shop clicks, filter choices, “tea desert” searches (when the nearest listed shop is far away), and affiliate clicks. These events are not tied to your name unless you also submitted a form.

Location

Typed searches (city, zip, or address) are sent to Google’s Geocoding API so we can place you on the map, and the search text may be stored in our analytics. Precise GPS is requested only if you tap the location button; your browser will ask first. We use those coordinates on your device to sort nearby shops. We do not require an account to search.

What we do not collect today

• Payment card numbers (we do not take payments on this site).
• Social Security numbers or government IDs.
• Photos or file uploads from visitors.
• Health data, beyond whatever you might type into a free-text box.

4. How we use information

• To show the map, distances, and shop details you asked for.
• To add you to the waitlist and email you about the project.
• To reply to messages and review shop suggestions.
• To understand where people search and find nothing nearby (“tea deserts”), so we know where the directory is thin.
• To generate AI tea recommendations from the preferences you type.
• To see which affiliate products are clicked, so we know what to keep listing.
• To keep the site secure and to fix bugs.
• To comply with law, or to protect the site, our users, or listed shops if we have a good-faith need to.

5. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do use service providers that process data for us:

• Google (Firebase / Google Cloud) — database, hosting, authentication for staff tools, and email sending through Firebase extensions.
• Google Maps Platform — map display and geocoding of addresses you search.
• Google Fonts — we load typefaces from Google’s servers, which may receive your IP address.
• Anthropic — if you use the AI sommelier, your preference text and a short list of nearby shops are sent to generate the recommendation. We do not use that text to train our own models.
• Vercel (or whatever host is serving the site) — page delivery and logs.
• Affiliate merchants and networks — if you click “Shop” on the order page, that merchant (and any network they use) will see that you came from our link. That is how a commission is tracked. See our Terms.

We may also disclose information if required by law, to respond to a valid legal process, or if the project is transferred (for example, if someone else takes over running QTea's Cha). We would expect the new operator to honor this policy or to notify you of changes.

Shop listings themselves are public. If we publish a shop you suggested, the public listing is about the shop, not about you. We do not put your email on the map.

6. Cookies and similar technology

The public map does not depend on an advertising cookie banner. The site and its providers may still set cookies or local storage for:

• Keeping a signed-in admin or business user logged in.
• Google Maps and Firebase functioning.
• Remembering UI state in your browser.

We do not currently run Meta Pixel, Google Ads, or a third-party ad network on this site. If that changes, we will update this policy and, where the law requires a choice, we will offer one.

You can block cookies in your browser. Some features (especially staff login and the map) may stop working if you do.

7. Artificial intelligence

If you use “personalized tea recommendations,” you are asking an AI model to suggest teas, brewing methods, or classes from nearby listings. That tool:

• Sends the text you type, plus shop names and offerings, to our AI provider.
• Is for inspiration, not professional, medical, or dietary advice.
• Can be wrong, incomplete, or out of date. Check with the shop.
• Is not a companion, therapist, or crisis service.

Do not put passwords, payment details, or sensitive personal information into the preference box. We do not need them to recommend a tea.

8. How long we keep information

• Waitlist, contact, and shop suggestions: until we no longer need them to run the project, or until you ask us to delete them, whichever comes first — unless we must keep a record (for example, a dispute or a legal hold).
• Analytics events: kept to study search patterns. They are not a profile of you by name.
• AI preference text: used to generate a response. We do not keep a public history of those chats on the site.

We do not currently offer a self-serve “download my data” or “delete my account” button for visitors, because most visitors never create an account. Email us through the contact form and we will handle the request by hand.

9. Your choices

• Emails: waitlist and confirmation emails are optional. Ask us to remove you and we will. Future marketing emails will include a way to unsubscribe.
• Location: decline the browser prompt, or type a city instead of sharing GPS.
• AI: simply do not open the recommendation tool.
• Access / correction / deletion: use the contact form with the subject “Privacy request.” Tell us the email you used. We may need to verify it is you.
• Do not sell or share: we do not sell personal information. If you still want to make that request, use the same form.

10. State and other privacy rights

Some U.S. state laws (including California’s CCPA/CPRA and Indiana’s consumer data law) give residents rights to know, delete, correct, or opt out of certain sharing — usually once a business crosses a size or data threshold. QTea's Cha is a small project and may not meet those thresholds today.

We will still make a good-faith effort to honor access, deletion, and correction requests from anyone, not only from residents of those states. We will not discriminate against you for asking.

If a paid agent submits a request, we may require proof that they are authorized. We will not honor requests we cannot verify.

If you are in the EEA, UK, or Switzerland: we are based in the United States. Information you submit will be processed in the U.S. using the providers named above. The legal bases we would rely on are: performing the service you asked for (a search, a message, a waitlist signup), our legitimate interest in running and securing a small directory, and consent where you clearly opt in (for example, joining the waitlist).

11. Children

The site is for a general audience interested in tea. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child gave us information, use the contact form and we will delete it.

12. Security

We store visitor submissions in Firebase with access rules that keep waitlist emails, contact messages, and suggestions readable by administrators, not by the public. Data in transit to Google and our host uses HTTPS.

No website is perfectly secure. Do not send passwords, bank details, or anything you would not put in a postcard through the public forms.

13. Changes

If we add accounts, payments, subscriptions, SMS, new analytics, or new AI tools, we will update this policy and change the effective date at the top. Material changes will be posted on this page. Continued use of the site after an update means you accept the revised policy.

14. How to reach us

For privacy questions or requests, use the Contact form on the site and start your message with “Privacy request.” We operate from Fort Wayne, Indiana, United States.

Related: Terms of Use.