Privacy Policy

Effective date: October 8, 2026

Epic Foundry LLC ("we", "us") operates Milo Roams, a US café-discovery app. This policy covers related services. Website waitlists have a separate notice.

1. The short version

We don't sell your personal information or share it for cross-context behavioral advertising.
Location is optional. You can browse your selected region without it.
We use account information, preferences, and café activity to provide and improve discovery.
Analytics use a hashed account identifier, not your email or exact coordinates. The app currently has no separate analytics toggle.
Start account deletion in Me → Delete account.
Questions: [email protected].

2. What we collect and why

Sign-in: Apple or Google supplies a sign-in identifier, email (possibly Apple's private relay), and any available name. We store account and session information to authenticate you. Café discovery requires an account.
Preferences: onboarding answers include drink and roast preferences, atmosphere, practical needs, price comfort, roam style, and home region. We use these to personalize results.
Café activity: saved cafés, manually marked visits, recommendations, structured feedback, searches, filters, ranking sessions, impressions, and interactions help deliver results and improve recommendations. Enabled event or progress features may also record interactions.
Public names and safety: where public recommendations are available, we collect your chosen profile name, consent to public sharing, recommended cafés and publication times, reports and reasons, block relationships, and moderation records to provide public discovery and prevent abuse.
Location: with iOS permission, approximate or precise coordinates reach our backend for nearby results and distance filters. We don't continuously collect background location. Without permission, region-based browsing remains available.
Technical information: app/build and operating-system versions, network and security logs, IP addresses, and device/browser information help operate and protect the service. Network services receive your IP address independently of location permission.
Support and café reports: if you write to us from the app or our support page, we collect your message, your reply email, an optional name and topic, your app and iOS versions and, when you are signed in, your account id, plus a scrambled form of your IP address to limit repeats. A café report (Report a problem) sends the café, what's wrong, an optional note of up to 500 characters and your account id, with no email. Please don't put anything private in a message or note. Emails to [email protected] stay in our mailbox, with any attachments you choose to send.

We also obtain public or authorized business information, such as café names, addresses, hours, and websites. External merchant, map, ordering, or event pages have their own privacy practices.

3. Analytics

When configured, PostHog records onboarding, discovery, café actions, preferences, feedback, public-profile, publish/withdraw, report/block, and enabled event/progress interactions, with approved categories, café/region and session identifiers, ranking context, and app/OS versions.

Signed-in events use a hashed account identifier. This is pseudonymous information, not anonymous data. Limited pre-sign-in events use an anonymous SDK identifier.

We don't send PostHog your chosen profile name, report text, the identity of someone you report or block, your email, Apple/Google sign-in identifiers, raw backend user ID, café names, exact coordinates, unrestricted search text, or free-form feedback/support messages. Automatic screen/interaction capture, session replay, automatic error capture, surveys, and push capture are disabled. Feature flags are answered on the device. Remote-configuration requests still carry normal network metadata; the project is configured to discard client IP data and disable event IP geolocation.

The app has no separate analytics switch. Contact support for privacy requests. Account deletion suppresses new analytics capture, but previously queued offline events may still upload and require further cleanup.

We use these providers to operate the service:

Supabase: authentication, account/app data, database, and backend infrastructure.
PostHog: analytics described above, using its US cloud.
Apple MapKit: maps, nearby search, and directions.
Apple and Google: sign-in.
Resend: your recipient email and confirmation message to send the account-deletion email.
Slack: our team reads support messages and café reports there, including the message, reply email (not for reports), topic or café, and app and iOS versions.
Cloudflare Turnstile: on our website's support form, checks that a person is writing; it may read browser information.
Website, hosting, security, communications, and support providers: information needed to deliver those services.

Business listing sources include Google Places, separate from consumer analytics. Providers deliver services to us. We may disclose information for legal compliance, rights/safety, abuse investigations, or corporate transactions, subject to law.

Public recommendations, where available: any signed-in user can see your profile name, recommended cafés, and publication times on café lists and your profile. Your Apple/Google identity, sign-in email, location, saved cafés, private visit log, and taste answers are not displayed. Choose a name mindful that others may recognize it. Older recommendations stay private until you publish them. Sharing requires consent; Make all public requires separate confirmation.

Withdraw any recommendation at any time; it leaves public display and counts, subject to refresh, without undoing visits. Recommendations stay private while the feature is unavailable. Named endorsements are public user content. No star ratings, free-form comments, behavioral ads, paid placements or purchases are offered. Listing views don't disclose private identity/location to merchants.

Reports, blocks, and moderation: you can report a profile name or block a user. Blocking hides each person's public name and recommendations from the other; block relationships are private. We use reports to review names and may reject or hide a name or suspend public recommending. We aim to act on reports within 24 hours; this is a target, not a guaranteed resolution deadline. The reporter is never revealed to the reported person or other users, and their identity is not shown in the staff moderation interface. Report abuse to [email protected].

5. Your choices

Control location permission and Precise Location through iOS Settings. The Me tab shows permission status and opens Settings. Explore searches published café names, addresses, and areas; it isn't a general ZIP-code lookup.

Remove saves in the app. Where available, manage your name or withdraw all recommendations in Me → Profile; withdraw individually using Recommended on the café. Manage blocks in Blocked roamers. Withdrawal preserves your account and private visits. Contact support for corrections unavailable in the app.

If we send marketing email, unsubscribe through the message or contact support. Service-related messages may continue. Our website may use cookies or similar technologies with notice and choices where required. We don't currently respond to browser Do Not Track signals.

6. Keeping and deleting your data

Start deletion in Me → Delete account, or email support. Apple-created accounts require confirmation with the matching Apple ID. Cancelling before acceptance keeps your account. After acceptance you're signed out, and cleanup runs asynchronously with status in the app.

Deletion removes authentication, profile, preferences, saves/visits, recommendations, feedback and linked records. We work to remove linked analytics profiles/events, but cleanup can be delayed or incomplete. Events recorded before you signed in are not removed. Previously queued offline events may upload later; contact support for cleanup. Apple/Google accounts and public café listings remain.

Released names, including after changes or account deletion, stay reserved for 90 days, unlinked to any account, to prevent impersonation. Reports/audits may retain names and safety details for abuse prevention or legal needs, with account references cleared on deletion.

Support messages and café reports: the scrambled IP address is deleted after 2 days. After 12 months we remove the reply email, name and account link and keep the text; deleting your account does this at once. Slack keeps its copy under our workspace settings.

We retain account data for your account, and support/security logs for requests, abuse prevention, legal obligations, or claims. Completed deletion-job records are scheduled for purge 90 days after completion; this is not a 90-day deadline for deleting all personal data. Staff audit records may remain with account references cleared. Backup copies may remain until their rotation completes. PostHog events are subject to the project's retention settings. Backup/event retention criteria do not promise fixed deletion deadlines. Aggregated or de-identified information may remain indefinitely.

7. Privacy rights

Depending on law, request access, correction, deletion or portability at [email protected], subject Privacy Request, with your sign-in email and request. Identity/agent verification may apply. We don't discriminate for exercising rights.

For California residents, where California privacy law applies, categories collected in the preceding 12 months may include identifiers, network activity, optional geolocation, user-provided content, and preference inferences. Sources and purposes are in §2; provider categories are in §4; retention criteria are in §6. The current app doesn't collect purchase records.

We don't sell information or share it for cross-context behavioral advertising. Authorized precise location supports nearby discovery, not sensitive inferences or ads. We'll provide any opt-outs required by future processing.

8. Children, security, storage, and contact

Children: Milo Roams isn't directed to children under 13. We don't knowingly collect their information; contact us if this occurs so we can delete it.

Security: we use reasonable safeguards, but no system is completely secure. Protect your device and Apple/Google credentials and report suspected unauthorized access.

Storage: the service is designed for United States users. Our Supabase backend is in the US West (Oregon) region, and PostHog uses its US cloud. Providers may process information elsewhere, where laws may differ.

Changes: we'll post updates with a new effective date and provide additional notice when required by law.

Contact: Epic Foundry LLC — [email protected]. Legal notices: [email protected].