Privacy Policy

Last updated: October 2026

Cuppa is operated by Sideprojects Unit Trust (ABN 37 511 050 834). We take your privacy seriously and want to be upfront about what data we collect, how we use it, how long we keep it, and what we don't do with it.

This policy complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What We Collect

Information you give us

• Email address: only if you create an account or subscribe to our newsletter. If you subscribe through a sign-up form inside one of our Facebook or Instagram ads, Meta passes us the email address you entered there, with your consent to receive the newsletter.
• Display name: if you set one for comments and leaderboards.
• Optional profile details: your broad age range, birthday, gender and morning drink preferences, only if you choose to provide them so we can personalise Cuppa.
• Comments and replies: anything you post in community discussions.
• Location: the suburb or postcode you enter for weather and fuel prices. If you tap “use my location”, your device's GPS coordinates are used to look up your suburb (via OpenStreetMap's Nominatim service) and to fetch local weather and fuel prices. The coordinates are kept only in your own browser, not in your account. Until October 2026, signed-in members' coordinates were also copied to their account when it synced; we have deleted those copies, although database backups made before then still hold them until the backups expire (see section 7).
• Comparison forms: if you complete a “Compare” form, the name, email, phone number, postcode and answers you enter (which can include your date of birth, gender, smoking status and occupation). See section 4 for how these are passed to Compare Club.
• Feedback: any message you send us through the app, and the email address you give us to reply to (or your account email if you're signed in).

Information collected automatically

• Visitor ID: a randomly generated identifier stored in your browser's localStorage so we can personalise your experience without requiring sign-in.
• Browsing preferences: your chosen news topics, text size and display settings.
• Reading and usage activity: which articles you open and for how long, which cards you see, tap and spend time on, and where an article appeared in your feed, so we can improve recommendations.
• Comment history: your posted comments, linked to your account or visitor ID.
• Game progress: scores, streaks and progress in crosswords, quizzes and other games.
• First visit details: the page you first landed on, the site that referred you, any campaign tags in the link, and your browser and device type.

What we do NOT collect

• No sharing of your article reading history with advertising platforms. Advertising measurement is limited to the ad-attributed visits, sign-ups and comparison enquiries described below.
• No background or continuous location tracking. Your GPS is only read when you tap “use my location”, and only at that moment.
• No financial or payment information.
• No contacts, photos, or other device data.

We do not sell your data to anyone. Full stop. The advertising-related sharing we do is the measurement described in the “Advertising measurement” section below, and you can opt out of it.

2. Analytics

We use Plausible Analytics, a privacy-friendly analytics tool. Plausible:

• Does not use cookies
• Does not collect personal data
• Is fully GDPR and privacy-law compliant
• Provides only aggregated, anonymous visitor statistics

This means we can see how many people visited Cuppa today, but Plausible can't identify you individually.

We also keep our own first-party analytics on our Sydney servers to understand how Cuppa is used and where visitors come from. These records hold your visitor ID, the pages, articles and cards you view, your device type and browser, and the referral source (for example, the link that first brought you to Cuppa). They are linked to your visitor ID (and your account, if you're signed in) and are never sold or shared. Section 7 lists how long each kind of record is kept. For signed-in members we also keep a summary of which days you used Cuppa, so we can understand how often members come back; it is deleted with your account.

If you subscribe to our newsletter, our email provider records whether you open an email and which links you click, so we can measure engagement and stop emailing people who are no longer interested. Our records of the links you click do not include your email address. You can avoid this tracking by not opening the emails or by unsubscribing at any time.

Advertising measurement

We advertise Cuppa on Meta (Facebook and Instagram), Google and OpenAI. Campaign tags (UTM parameters) tell our own analytics which ad brought a visitor to Cuppa. For visitors attributed to these ads, we also use the relevant platform's measurement tools on our landing pages and sign-up flow, including when the ad links to the main Cuppa app.

• Meta: a pixel measures ad landing visits. When a visitor who arrived from one of our Meta ads types an email address into the sign-up box on one of our landing pages, we send Meta a hashed (scrambled) copy of that address straight away, before the address has been confirmed. We send another hashed copy when the account is confirmed. If an ad-attributed visitor completes a comparison form and the enquiry is accepted, we send a hashed copy of the email address entered in the form. Each of these events also carries the connection details described below and Meta's own click references.
• Google: the Google tag uses advertising click identifiers and reports completed new registrations with a deduplication identifier.
• OpenAI: the measurement pixel reports ad arrivals and completed new registrations, with an event identifier to avoid counting a registration twice. It uses the ad click reference and the website's origin to attribute events. We retain the click reference and attribution marker in this browser's localStorage for up to 30 days after an ad arrival. We use image requests, without loading OpenAI JavaScript or automatic form matching. We do not supply email addresses, phone numbers, account identifiers or form contents to OpenAI.
• We do not send these platforms your article reading history, comments, optional profile details, precise location or comparison-form answers. Measurement requests also expose normal connection information such as your IP address and browser type to the receiving platform.

See Meta's privacy policy, Google's privacy policy and OpenAI's privacy policy.

Opting out: use the button below or the “Stop future ad tracking” link on our ad landing pages. This sets cuppa_ads_optout in this browser and stops future advertising conversion events from this device, including for comparison forms. Initial events may already have happened before you opt out. Cuppa also works with ad blockers. Opting out does not change your account or stop our own first-party analytics. You will need to opt out separately in other browsers or after clearing browser storage.

Stop future ad tracking

3. How We Use Your Data

Purpose	Data used
Personalise your news feed and experience	Topic preferences, reading history, and any optional profile details you provide
Show weather forecasts	Suburb or postcode you entered, or your device location if you allow it
Show nearby fuel prices	Suburb or postcode you entered, or your device location if you allow it
Enable comments and community features	Email, display name, visitor ID
Save articles and sync preferences	Account data, visitor ID
Track streaks, badges, and game progress	Visit timestamps, game scores
Send the newsletter and account emails	Email address, newsletter preferences, email open and click records
Improve the service	The first-party usage records described in section 2, and anonymous aggregate counts

4. Third-Party Services

Cuppa connects to these third-party services to provide its features. Only the minimum data needed is shared with each:

Service	What it does	Data shared
GNews	News article aggregation	News topic queries
WillyWeather	Weather forecasts (BoM-licensed Australian data)	Location coordinates (from your suburb, or your device GPS if you allow it)
Open-Meteo	Turns a suburb name you type into map coordinates, and suggests suburbs as you type	The suburb or place name you enter, sent from your browser (so Open-Meteo also sees your IP address)
OpenStreetMap (Nominatim)	Turns GPS coordinates into a suburb name, and looks up postcodes you type	Your device GPS coordinates when you tap “use my location”, or the postcode you enter, sent from your browser (so Nominatim also sees your IP address)
TheMealDB	Recipe suggestions	Recipe search queries
OpenRouter / Anthropic (and the AI models they route to)	Content curation, summaries, and AI-generated community comments and replies	Article titles and topics. When generating a reply in a comment thread, the text and display names of the comments in that thread, which can include comments other readers wrote
NSW Government	NSW fuel prices	Location area
WA Government	WA fuel prices	Location area
QLD, SA & VIC Governments	QLD, SA and VIC fuel prices	Location area
Resend	Email delivery (newsletter and sign-in emails)	Your email address, and the email itself; Resend reports back opens, clicks and delivery problems
Google / Facebook / Apple	Optional sign-in	Used only if you choose to sign in with them. The provider confirms your email and name to Cuppa
DigitalOcean Spaces	Database backup storage	Backup copies of the Cuppa database, which include account details
Plausible	Privacy-friendly analytics	Anonymous page views (no personal data)
Meta (Facebook)	Measures our ad campaigns (ad-attributed visits, sign-ups and comparison enquiries), and delivers newsletter sign-ups made inside our ads	Hashed email when an ad-attributed visitor signs up or makes an accepted comparison enquiry; page view on ad landing pages. Never your reading history. Opt-out available (see “Advertising measurement”)
Google Ads	Advertising attribution and new-registration measurement	Ad click identifiers, campaign tags and a registration event identifier; connection information
OpenAI Ads	Advertising attribution, ad arrivals and new-registration measurement	Ad click reference, website origin, event identifiers and connection information. No customer form data or reading history. Opt-out available above
Compare Club (Alternative Media Pty Ltd)	Insurance and energy comparison enquiries, only when you complete a “Compare” form on Cuppa	The details you enter in that form (name, email, phone number, postcode, age and your answers, such as your current fund), so a Compare Club specialist can call you. Cuppa is paid a referral fee for each valid enquiry; it never changes the price you are offered

Most content services (news, weather, recipes, fuel prices) receive no information that identifies you, only search queries or an approximate location area. The exceptions: Open-Meteo and OpenStreetMap receive the suburb, postcode or GPS coordinates your browser sends them, along with your IP address; our AI providers (OpenRouter/Anthropic) receive the text and display names of the comments in a thread when generating an AI reply in it; Resend receives your email address to deliver the newsletter and sign-in emails; Google, Facebook or Apple verify your identity only if you choose to sign in with them; DigitalOcean stores our database backups, which include account details; Meta receives the hashed email and measurement data described in “Advertising measurement” above; Google and OpenAI receive the advertising measurement data described above; and Compare Club receives the contact details and answers you enter into a comparison form, and only when you submit it. Compare Club handles that enquiry under its own privacy policy and collection notice, which are linked on the form before you submit.

5. Cookies and Local Storage

Cuppa primarily uses your browser's localStorage rather than traditional cookies. This stores:

• Session tokens: to keep you signed in
• Preferences: news topics, text size, weather location, fuel location, and your “use my location” coordinates if you allowed it
• Game progress: scores, streaks, crossword and trivia progress
• Cached feed data: for faster loading
• Visitor ID: your anonymous identifier

This data lives on your device. When you're signed in, your preferences, game progress and saved items are also synced to your account so they follow you to other devices. Your exact location coordinates are never synced.

We also set short-lived security cookies when you open a sign-in, confirmation or social sign-in link. They only protect that step and expire within minutes.

Advertising measurement also uses click-reference cookies and local attribution markers as described above. These are separate from your account and game preferences.

6. Where Your Data Is Stored

Cuppa's own database is stored on DigitalOcean servers in Sydney, Australia, and backed up to DigitalOcean storage. The third-party providers listed above may process or store the data we share with them in other countries under their own privacy policies.

All connections to Cuppa are encrypted using HTTPS/TLS.

7. Data Retention

These are the periods our systems apply automatically. “Deleted with your account” means it goes as soon as you delete your account (see section 8).

Data	How long we keep it
Your account (email, display name, profile details, synced preferences and game progress, saved articles, the topics we work out you like reading, and your café's neighbourhood listing)	While your account is open; deleted with your account. An account started with an email address that is never confirmed and never used is deleted after 7 days.
Sign-in sessions	Up to 180 days after you last used Cuppa on that device. A sign-in link lasts 1 hour, a newsletter confirmation link 24 hours, and a session issued before your email address is confirmed 7 days.
Page views, article clicks and reading time, card views and taps, and which articles were shown to you	90 days
First visit details (landing page, referrer, campaign tags, browser and device type)	Kept while you keep visiting; deleted once the record is a year old and you have not visited for 90 days
Sign-up and landing-page activity (which ad or page you came from, sign-up steps)	180 days
Days you used Cuppa (signed-in members)	While your account is open; deleted with your account
Anonymous totals (for example, how many people viewed a card each day)	Kept indefinitely; they contain no visitor ID or account
Email send history (which emails we sent you, and whether they were delivered, opened or clicked)	180 days. Records of clicked links: 90 days
Game scores and leaderboard entries	90 days
Comments and replies on news stories	Shown while the story is on Cuppa (at most 90 days after it was published); every copy is deleted within a further 90 days
Replies in community discussions, and quick poll votes	Kept while the discussion or poll results are shown on Cuppa
Notifications	30 days
Push notification subscriptions	Until you turn notifications off, your browser stops accepting them, or you delete your account
Shared café links	180 days
Feedback you send us	Up to 2 years; your email address is removed from it if you delete your account
Comparison enquiries	Your name, email, phone number, postcode, answers, connection details and Compare Club's response are deleted 90 days after you submit the form, or straight away if you delete your account. A one-way, salted fingerprint of your phone number and email address is kept a little longer (90 days by default, never more than a year) only to stop the same enquiry being sent twice. Compare Club keeps its own copy under its policy.
News stories we link to	The story list is cleared after about a week (up to 90 days for stories readers commented on). A title-and-link archive is kept so old links keep working. This is not personal data.
Database backups	Up to 365 days (every copy for the last week, one a day to 30 days, then one a month). Data you delete, including a deleted account, can remain in these backups until they expire. Backups are private. We use them to recover from a failure, and the latest one is also loaded each night into a private, password-protected test copy of Cuppa that only our team can reach, so we can check changes before they go live.
Local storage on your device	Stays on your device until you clear your browser data

8. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access your personal information: ask us what we hold about you
• Correct any inaccurate or outdated information
• Request deletion of your account and associated personal data
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

You can delete your account yourself with “Delete my account” in Settings, or by emailing us. Deleting your account removes your account, profile, saved articles, comments, notifications, push subscriptions and the record of days you used Cuppa, and the contact details and answers from any comparison enquiry. Some records are kept without anything that identifies you: replies you posted stay in their discussions as “A Cuppa reader”, game scores stay on past leaderboards without your name, and usage and email records stay in our totals with your account and email address removed until their normal deletion date. Backups follow the backup period in section 7.

To exercise any of these rights, just email us. We'll respond within 30 days.

9. Children's Privacy

Cuppa is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we'll delete it promptly.

You must be at least 18 to create an account on Cuppa.

10. Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we'll let you know through the app. Continued use of Cuppa after changes are posted means you accept the updated policy.

11. Contact Us