Your shelf is personal. Our policy is specific.

CocktailSteps is operated by LUQ Labs. This policy explains how we handle information when you visit cocktailsteps.com, create an account, scan a shelf, or use the AI Coach.

Effective August 20, 2026

Information we handle.

Category	Information	Why we use it
Account and profile	Account identifier, email address, display name, avatar URL, login provider, and authentication session information.	Create and secure accounts, sign visitors in, and display account information. Supabase handles authentication. When a visitor chooses Google sign-in, Google also processes the login.
AI usage and administration	Daily usage date and count, usage limit, account suspension status and reason, administrator membership, and administrative audit records.	Enforce fair-use limits, prevent abuse, secure the service, and administer accounts.
Product activation metrics	Daily aggregate counts for fixed free-account buttons and AI successes. For an account's first successful AI request, we also keep the account identifier, UTC time, and whether the feature was shelf scan, Fast Coach, or Pro Coach.	Measure the path from site visits to account creation and first useful AI result, and monitor whether requested AI features succeed. We do not include the visitor's question, image, recipe, URL, IP address, device identifier, or advertising ID in these product records.
Shelf scan	A shelf photo compressed in the browser, its media type, and the ingredient-identification request.	Send the image to OpenAI to suggest ingredients for the visitor to confirm. CocktailSteps does not save the image in its application database or application logs.
AI Coach	The visitor's question, recipe and step identifiers, and selected ingredient identifiers.	Send the requested context to OpenAI and return a constrained coaching answer. CocktailSteps does not persist the question or answer in its application database.
Browser state	A legal-drinking-age confirmation boolean and ingredient identifiers in the visitor's confirmed bar inventory, plus a boolean recording dismissal of the current free AI announcement.	Avoid repeating the age prompt in the same browser session and provide recipe matching, requested Coach context, and the visitor's announcement preference.
Technical and security data	IP address, user agent, request headers, timestamps, security signals, and service logs handled by our infrastructure and security providers.	Deliver the site, maintain reliability, authenticate requests, detect abuse, and protect accounts.
Aggregate use and performance data	Cloudflare Web Analytics, formerly Browser Insights, uses a JavaScript performance beacon to handle page path, referrer, browser, operating system, device category, country, page-load timing, Core Web Vitals, and an in-memory page-load identifier. The beacon does not read or write cookies, local storage, or session storage.	Understand aggregate site use, diagnose page performance, and monitor the real-user Core Web Vitals that protect the visitor experience. We do not use these metrics for advertising personalization or to build visitor profiles.
Advertising and consent choices	A visitor's consent or objection choice and, where applicable, a TCF consent signal. Google may also handle IP address, user agent, browser and device characteristics, page and referrer context, coarse location inferred from IP address, ad requests, impressions or interactions, fraud signals, and cookies or browser identifiers where the visitor's choice and law permit.	Present and remember privacy choices, decide whether an ad request is allowed, deliver and measure manually placed ads, manage frequency, and detect invalid or abusive activity.
Support communications	Email address and the content a person sends to our support.	Respond to requests and keep an appropriate support record.

Passwords are submitted to Supabase Auth and are not stored as plaintext in the CocktailSteps application database. The age prompt is a self-confirmation; we do not collect a birth date, identity document, or precise location for that prompt.

How AI requests are handled.

OpenAI requests use store: false, which prevents CocktailSteps from creating stored Responses API application state. It does not mean that no provider retention can occur. OpenAI may retain API abuse-monitoring logs containing customer content for up to 30 days by default, or longer where legally required. OpenAI states that API content is not used to train its models unless the customer opts in.

Learn more in OpenAI's API data controls. Do not submit shelf photos containing people, identity documents, addresses, or other information that is not needed for ingredient recognition.

How we use information.

Provide recipes, accounts, shelf scanning, and AI coaching.
Authenticate users and keep account sessions secure.
Apply daily AI limits and prevent fraud or misuse.
Measure account creation and successful AI feature activation.
Manage advertising choices and, when allowed, deliver and measure ads.
Operate, troubleshoot, and protect the website.
Respond to support, privacy, and legal requests.
Comply with law and protect rights, safety, and property.

Where applicable, our legal bases include performing the service a user requests, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where the law requires it.

Service providers and disclosures.

We use the following providers to operate CocktailSteps:

Vercel for hosting, content delivery, functions, and service logs.
Supabase for authentication, account profiles, and database records.
Google when a visitor chooses Google OAuth sign-in.
Google AdSense and Google Privacy & Messaging for consent management, manually placed ads, ad measurement, and invalid-traffic prevention.
OpenAI for shelf-image recognition and AI Coach responses.
Cloudflare Turnstile for bot and account-abuse protection.
Cloudflare Web Analytics for cookie-free aggregate use and real-user performance measurement.

Providers process information under their own terms and data practices. We may also disclose information when required by law, to investigate abuse or protect safety and rights, or as part of a merger, acquisition, financing, or transfer of the service. Any successor would remain subject to applicable privacy obligations.

Advertising, privacy choices, and product metrics.

We do not sell personal information for money. CocktailSteps uses Google AdSense only on a limited set of eligible Explore and non-zero-proof recipe pages. We do not place ads in account, AI, scan, Guided Make, legal, or zero-proof experiences. An ad request is not allowed until the visitor confirms legal drinking age. Where consent is required, no programmatic ad request is made before consent or after a rejection or withdrawal.

Some privacy laws define disclosures for targeted or cross-context advertising as a sale or sharing even when no money changes hands. To the extent those definitions apply, visitors can use the footer's Privacy choicescontrol to reject or withdraw consent and opt out of programmatic advertising. We also honor supported Global Privacy Control signals by suppressing programmatic ad requests. Exercising an advertising choice does not limit the site's core features.

Third-party vendors, including Google and Google-certified ad networks, may place and read cookies in a visitor's browser or use web beacons, IP addresses, and other identifiers as a result of serving an ad on CocktailSteps. Google's advertising cookies enable Google and its partners to serve ads based on a visitor's prior visits to CocktailSteps and/or other sites on the Internet, subject to the visitor's choices and applicable law.

Visitors can manage or opt out of personalized advertising through Google's Ads Settings. Google explains how it uses information from sites and apps that use its services, and publishes information about certified third-party advertising vendors. Those controls supplement the CocktailSteps Privacy choices control. Google may process advertising data for ad delivery, measurement, security, and other purposes described in the Google Privacy Policy and its advertising technologies notice.

CocktailSteps does not install a behavioral analytics or ad-targeting SDK. On the production site, Cloudflare automatically injects its Web Analytics performance beacon into public HTML. The beacon measures the current page and browser performance without cookies or persistent browser storage. Because Cloudflare injects it at the network edge, the beacon may load before a visitor answers the age prompt. It is non-ad, cookie-free performance measurement and does not send or authorize an ad request. Cloudflare states that its real-user monitoring service receives the source IP address as part of normal HTTP delivery, discards it at the nearest Cloudflare data center, and does not store it in the beacon service's core databases or logs. Learn more in Cloudflare's RUM beacon documentation.

CocktailSteps keeps limited first-party server-side product metrics: fixed signup-button counts, account creation records already required to provide an account, successful AI request counts, and the first successful AI feature for an account. Signup-button and daily success totals are aggregate records without a visitor or session identifier.

Security providers such as Cloudflare may process technical signals for bot detection and service improvement as described in their own notices, including Cloudflare's Turnstile Privacy Addendum.

Retention.

Account and profile data is generally retained while the account is active. Usage, security, suspension, and audit records are retained for the time reasonably necessary to operate and protect the service, resolve disputes, enforce agreements, and meet legal obligations. Support communications are retained as appropriate for the request and our legal obligations. The first-AI-success milestone is deleted when its account is deleted. Aggregate daily product counts may be retained for trend and reliability comparisons because they are not tied to a visitor or account.

The application does not persist shelf photos or Coach conversations in its database. Provider logs remain subject to provider retention and legal requirements. The age confirmation lasts for the browser session; saved inventory remains until it is replaced or browser storage is cleared. See our Cookies & Browser Storage notice for details.

Google retains advertising, consent, security, and measurement records according to the visitor's choices, its configuration, its policies, and legal requirements. Retention varies by data type and circumstance, so we do not assign a single Google retention period. Withdrawing a choice stops future programmatic ad requests from CocktailSteps but does not necessarily delete records previously retained by a provider.

Security and international processing.

We use reasonable administrative, technical, and organizational safeguards, including HTTPS and access controls. No transmission or storage method is completely secure, so we cannot guarantee absolute security.

CocktailSteps and its providers may process information in the United States and other countries. Where required, transfers are handled using legally recognized safeguards.

Your choices and rights.

Depending on applicable law, a person may request access, correction, deletion, restriction, objection, or a portable copy of personal information. A person may also complain to the relevant privacy authority. We may need to verify a request and may retain information where the law permits or requires it.

Visitors can open Privacy choices in the footer at any time to review, reject, or withdraw an advertising choice. Supported Global Privacy Control signals are treated as an opt-out from programmatic advertising. Browser controls can also clear stored choices or block optional advertising storage. Rejecting or withdrawing consent does not affect recipes, account access, or AI features, although it may cause the consent message to appear again after stored choices are cleared.

California residents may request information about our collection, use, and disclosure practices and exercise any rights available under applicable California law. We do not offer financial incentives for personal information and will not discriminate for exercising a legal privacy right. We do not claim that every California privacy statute applies to LUQ Labs regardless of its statutory thresholds.

Send requests to [email protected]. The service does not currently provide a self-service export or account deletion button; requests are handled through this contact channel.

Children and legal drinking age.

CocktailSteps is not directed to children under 13 and does not knowingly collect their personal information. Alcohol-related content and account-based AI features are intended only for visitors who have reached the legal drinking age where they are located. If you believe a child has provided personal information, contact us so we can review and delete it where required.

Changes to this policy.

We may update this policy as our services or legal obligations change. We will update the effective date and provide additional notice on the site or by email when appropriate for a material change.

Contact.

Operator: LUQ Labs
Location: California, United States
Email: [email protected]