Privacy Policy

breadkultur ("we", "us", or "our") operates the website breadkultur.com, a community platform for sourdough bakers. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

For privacy questions, contact us at privacy@breadkultur.com.

We collect only the data necessary to provide the service:

• Account data: Email address, display name, and password (stored as a secure hash).
• Profile data: Avatar image, biography, location (optional — you choose what to share).
• Location data: When you list a starter, you provide a city-level location (city, country, and optionally zip code). We store the geographic coordinates of the city or zip code center — never your exact street address. You control what others see via the location visibility setting in your profile.
• Browser geolocation: If you use the map view or "nearest first" sorting, your browser may ask for your location. This data stays entirely in your browser and is never sent to our servers or stored.
• Content you create: Posts, comments, starter listings, and messages you send to other users.
• Usage data: Pages visited, session duration, and general location (country/city level), collected with your consent by Google Analytics for usage analysis and by Vercel Speed Insights for performance monitoring.
• Authentication tokens: Session cookies to keep you logged in.

• To provide, operate, and improve the breadkultur platform.
• To send you transactional emails (welcome, password reset, message notifications).
• To enforce our community guidelines and Terms of Service.
• To analyse aggregated usage patterns and improve site performance.

We do not sell your data to third parties. We do not use your data for advertising.

Under GDPR, we process your data on the following legal bases:

• Contract performance: Processing necessary to provide the service you signed up for.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Consent: For optional features such as email notifications.

We share your data only with the following third-party service providers:

• Supabase — Database hosting and authentication (EU data residency available).
• Vercel — Website hosting and performance analytics.
• Google Analytics — Usage analytics (only with your consent). Data is processed by Google LLC. See Google Privacy Policy.
• Resend — Transactional email delivery.
• Mapbox — Map display and location search. When you search for a location or view the map, your search query is sent to Mapbox. Mapbox does not receive your account information. See Mapbox Privacy Policy.

All providers are contractually bound to protect your data and may not use it for their own purposes.

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data by editing your profile.
• Erase your data by deleting your account.
• Portability — request an export of your data in a machine-readable format.
• Object to or restrict certain processing.
• Lodge a complaint with your national data protection authority.

To exercise any of these rights, email us at privacy@breadkultur.com.

We use industry-standard security measures including encrypted data transmission (TLS), bcrypt password hashing, and row-level security on all database tables. However, no system is completely secure and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The "last updated" date at the top reflects the most recent revision.