Loading CoffeeScore…
Loading CoffeeScore…
Tap the cassette or START for sound.
Win tapes in quizzes. Find them in your Music Collection.
Privacy notice
Effective October 27, 2026. Updated October 28, 2026.
Coffee Is Me Inc operates CoffeeScore at coffeescore.org. This policy explains how we handle personal information when you visit, register, play coffee quizzes, save progress, buy or use Coins, join challenges, share content, or contact us. CoffeeScore is intended for adults aged 18 and older. Features such as social login, purchases and challenge emails apply only when offered and enabled.
Contact us about privacyWe receive information you provide, information generated by your use of CoffeeScore, and information from a sign-in, payment or delivery provider you use. We use the categories below to operate requested features, maintain accurate records, support players and protect the service.
You can browse without registering. All quizzes, including free quizzes, require a registered account with a verified email. Leaderboard scores appear with your chosen nickname; a real name is not required. Earlier guest progress remains available to claim into an account.
Please do not put medical details, government identification numbers, card numbers or other unnecessary sensitive information in your display name, quiz feedback or support messages. Health & Coffee is an educational quiz; we do not ask you for a medical history to play it.
| Category and examples | Purposes | Recipients where needed |
|---|---|---|
| Identifiers and account records: name, email, display name, account/provider IDs, verification status and optional provider profile image. | Create and identify your account, sign you in, recover access, respond to requests and deliver requested messages. | Hosting/infrastructure providers; email delivery providers; your selected sign-in provider; public visitors for public display fields described below. |
| Credentials and technical information: protected password representation, sign-in tokens, session identifiers, IP address, browser/device information, request timestamps and security logs. | Authenticate you, maintain sessions, prevent abuse, investigate errors and protect accounts. Credentials are sensitive information used for account and security functions. | Hosting, infrastructure and selected authentication providers; authorized personnel who need access for these functions. |
| Learning and game activity: questions presented, answers, timing, scores, attempts, saved rounds, missed-question review, earned mascots, outfits, music and Crew progress. | Grade and resume play, explain answers, select review questions and preserve earned progress. Scores/timing also support challenge results where applicable. | Hosting providers and authorized administrators; public visitors only for permitted profile, activity, leaderboard or shared content. |
| Commercial records: Coin balances, purchases, exchanges, coupons, gifts, claims, referrals, refunds, payment references and transaction history. | Process requested purchases, keep the wallet accurate, prevent duplicate credits/debits, fulfill offers and handle payment disputes or accounting obligations. | Payment and hosting providers; authorized administrators; professional advisers or authorities where necessary and legally permitted. |
| Preferences and communication records: language, timezone, optional flag/avatar, privacy/email choices, consent and withdrawal timestamps, message content, delivery records and suppression status. | Apply your settings, deliver requested or permitted mail, respect withdrawals and investigate delivery problems. | Hosting and email providers; authorized administrators; a challenge sponsor only for the consented disclosure described below. |
| Challenge participation and invitations: event entry, attempts, ranks, rewards, invitation attribution and sponsor-specific permission. Prize delivery details may be requested separately when needed. | Run the event, attribute invitations, award eligible rewards, apply event rules and arrange an earned prize or requested perk. | Hosting providers; event administrators; named sponsors/fulfillment providers for specifically disclosed purposes; public results where permitted. |
| Feedback and support: comments, question reports, emails, attachments you choose to send and the related question/attempt reference. | Respond to you, review content, resolve problems and keep an appropriate support record. | Authorized support/content reviewers and infrastructure or communication providers needed to handle the request. |
Leaderboard results use your chosen nickname. A real name is not required. Public profile and community activity settings separately control profile details and activity sharing; these settings start selected for new accounts and can be changed in your Dashboard. Previously saved leaderboard-name visibility preferences no longer replace nicknames with anonymous labels. Your account email, credentials and wallet history are not displayed as public profile information.
Community activity requires both public profile and public activity settings. Turning either off hides your previous activity from our community feed. Opting back in permits future activity. Other public displays follow their applicable privacy settings and event rules.
When you choose to share a result, collectible, café postcard or challenge invitation, the card or link may disclose the visible player name, score, artwork and other information shown in the sharing preview. Sharing through another application gives that application the content you select. A downloaded image or a link copied by another person can remain outside our control after you change your settings.
Joining or playing a challenge does not by itself give its sponsor permission to receive your email address for marketing. Sponsor email sharing is a separate choice. You may opt in for a named sponsor at the event, or enable the Dashboard preference that applies this permission to sponsors of challenges you join. The automatic-sharing preference starts off. An event-specific decline or withdrawal takes priority.
For a consented sponsor list, the current export contains your email address, the challenge identifier, and the consent timestamp/source. It does not contain your password, wallet history or private answers. Exports are limited to actual participants with current sponsor-specific permission after the event ends.
We do not receive money or exchange contact lists for other valuable consideration. Sponsor permission does not affect challenge eligibility, ranking or draw chances. We do not sell your personal information for money or disclose it for cross-context behavioral advertising.
You can withdraw permission before a future disclosure through the event's sharing controls or by contacting us. Turning off the automatic preference stops that preference for future events; also withdraw any existing event permission you want to stop. Once information has been disclosed, the sponsor handles its own communications under its privacy notice. Use the sponsor's unsubscribe/contact route to stop those messages; you can also contact us for help with a privacy request. Withdrawal does not recall copies already delivered.
If you win a prize or request a participation perk, the event must separately explain any details needed for delivery, the recipient and the purpose. We use those details for fulfillment, not as permission for unrelated sponsor marketing.
We use Hetzner for hosting, Cloudflare for configured domain/network services, Resend for enabled email delivery, and Stripe for enabled hosted checkout and payment processing. Their access depends on the feature and configuration. Google receives authentication requests if you choose enabled Google sign-in; Apple will receive them if Apple sign-in is introduced and you choose it. Sign-in providers give us the identity information and tokens needed to create or access your account. Apple may provide a private relay address instead of your ordinary email.
Card entry takes place on Stripe's hosted checkout rather than in a CoffeeScore card-entry form. CoffeeScore retains purchase and payment-reference records needed to grant Coins and handle refunds; providers may separately process billing and fraud information under their own notices.
Optional administrator AI authoring can send a teaching brief and quiz metadata to OpenAI when enabled. Quiz grading uses stored answer keys, not a live AI decision about a player. Administrators must keep player records and unnecessary personal information out of authoring briefs. If a feature needs a materially different use of player information, we will disclose it before starting that use.
We may disclose information to advisers or authorities when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, or address fraud. A merger or transfer of the service may require disclosure to the successor or transaction advisers subject to appropriate confidentiality and applicable law. We will not use a business transfer to remove your applicable privacy rights.
Third-party sign-in, payment, sponsor, sharing and linked websites have their own privacy practices. This policy describes CoffeeScore's processing, not every independent use by those organizations.
We use first-party cookies and browser storage for sign-in, guest ownership, registration confirmation, sound and animation choices, and reliable request handling. These support account access, guest progress and actions such as avoiding duplicate Coin charges.
We do not set a referral-attribution cookie or save invitations in local or session storage. An invitation applies when you create a new account directly from its signup link. Google signup may carry the invitation in its short-lived authentication state. Once the account is created, we keep a server-side referral record so eligible rewards can be credited after verification. Leaving the signup page does not reserve an invitation for a later visit.
| Storage | Purpose | Duration |
|---|---|---|
| Account session/authentication cookies | Keep you signed in and support safe authentication. | The current session expires after seven days and can be renewed during use; authentication-state items may be shorter-lived. |
| Guest cookie | Associate this browser with guest progress and a later account claim. | Thirty-day cookie lifetime. Expiry does not itself delete associated server records. |
| Local browser storage | Remember audio/music and animation choices. | Until you clear it or the application replaces the preference. |
| Session browser storage | Remember request references and return destinations; prevent unintended repeated actions. | For the browser's page session or until the app removes the item. |
| Adult registration confirmation cookie | Remember your explicit 18+ confirmation while a new account is created, including a sign-in provider return. It contains a signed notice version and expiry, not your birth date. | Thirty minutes. It is a self-declaration, not independent age verification. |
You can manage cookies/storage through your browser. Blocking or clearing them can sign you out, remove local preferences, or prevent this browser from reconnecting to guest progress. Account records are separate from browser storage.
We do not currently use advertising pixels or third-party behavioral analytics in CoffeeScore. We may consider analytics later, but will review its data flows, update this policy and provide any required choices before activation.
CoffeeScore currently does not track your activity across unrelated websites for advertising. We do not change the essential session/game functions described above in response to a browser Do Not Track setting. Independent providers may collect technical information when you interact with their services; review their notices and settings.
Global Privacy Control is a separate signal used to express an opt-out of sale or sharing where applicable. We currently do not sell information or share it for cross-context behavioral advertising. Any future processing subject to a legally required opt-out will require a working signal/choice mechanism before it is enabled. A privacy signal is not permission to disclose your email to a sponsor.
Verification, password recovery and necessary account/security messages support the service you request. Optional review reminders, progress nudges, offers and campaigns follow their separate preferences and consent requirements. Choosing an optional email category does not authorize public profile activity or sponsor marketing.
You can manage offered email categories, pauses and timing in your Dashboard, use an unsubscribe link in an optional email, or contact us. Unsubscribing from optional messages does not stop a password-reset email you request or necessary security notices. Delivery and suppression records help us respect your choices and investigate failures.
Sponsor messages require their own unsubscribe process. Our emails may contain images and links; loading an image or opening a link generates ordinary network requests. We do not currently use a dedicated email open/click tracking program. We will disclose any future tracking and provide any required choices before starting it.
Verified accounts and their learning progress remain available while the account is open, unless a reviewed deletion request or another lawful account action applies. Clearing browser cookies does not delete server records.
Our approved cleanup schedule targets unclaimed guest play after 90 days without activity and unverified registrations after 30 days. Automatic personal-data cleanup is currently disabled while deletion and recovery safeguards are completed. These targets do not mean that all older guest or unverified records have already been removed. Expired authentication and routine database security records are cleaned separately; our routine technical-record target is 30 days.
When a reviewed account closure can safely proceed, we revoke sign-in access, remove credentials and ordinary personal and learning records, hide public profile details, stop optional account messages and withdraw future sponsor-marketing permission. Unused Coins are forfeited on completed voluntary closure, without a change-of-mind refund, except where law requires otherwise. Purchased Coins have no time-based expiration while the account stays open.
Closing an account does not erase every historical record automatically. We review transaction receipts, the Coin ledger, challenge entries and final results, referral receipts, dispute records and other retained information separately. We keep only what is necessary for a documented purpose such as accounting, resolving a dispute or completing an existing prize obligation, with restricted access and a reviewed retention period. A protected historical record is not by itself a legal reason to retain personal information indefinitely.
A limited privacy-case contact remains available so we can answer a request after account access is removed. Request correspondence and contact details are scheduled for removal two years after resolution, unless a specific lawful requirement applies. Minimal request outcomes and erasure references may be retained to document the response and prevent deleted information returning during recovery.
Our database-backup retention target is 90 days. Backup copies and hosting or provider logs have separate expiry controls; we do not represent that every external copy already meets that target. Deleted information can remain in restricted backups until they expire. Before a restored backup is used as a live service, the operator must reapply reviewed deletion records. Recovery records use internal identifiers rather than names or email addresses.
Live data erasure is currently paused until independent recovery protection is configured. We continue to accept and review privacy requests during this pause, explain any processing limitation and follow applicable response obligations. An account request is not treated as completed just because it was received or account access was removed.
You can request access to, correction of or deletion of your information through Account → Settings → Privacy requests and account deletion, or by emailing [email protected]. You do not need an account to contact us. You may also write to Coffee Is Me Inc at 619 Lindaro St, San Rafael, CA 94901.
We record the request and verify ownership before disclosing information or closing an account. We do not ask for your password or full payment-card number. If an authorized agent contacts us, we may ask for information reasonably needed to verify authority and identity.
A deletion request does not immediately close the account. We review holds, pending payments, disputes and prize obligations first, explain the effect on saved play and unused Coins, and record the review. Once safe erasure is available, ordinary personal data and credentials can be removed. Any necessary retained records, provider or sponsor copies and backup-recovery obligations require further review. We confirm the outcome and any lawful exceptions through the case contact; the account may no longer be available to show status after closure.
For an access request, we review and assemble the responsive account, game, transaction, communication and other records before providing a secure copy. An internal core-record export is not automatically a complete response. For corrections, we verify the requested change and explain any lawful limit. A factual transaction record is not changed merely to create a different wallet balance.
We ask relevant providers and sponsors to handle information within the applicable request scope, or explain when a recipient must handle a request separately. Withdrawing permission prevents future sponsor-marketing exports; it cannot remotely erase a file already received by a sponsor. Contact us through the privacy mailbox for follow-up after account closure.
California residents may have rights under applicable privacy law to know/access personal information, correct it, request deletion, opt out of sale or sharing, and limit certain uses of sensitive information. These rights depend on the law's applicability and permitted exceptions. Nothing in this policy waives a right you have under California law.
If the California Consumer Privacy Act, as amended, applies to our processing, we will use its required request procedures and response periods, including acknowledgment within ten business days and a substantive response to a verified access/correction/deletion request within forty-five calendar days, with a permitted notified extension where necessary. We will not retaliate for exercising applicable rights.
To raise a California request, use the contact methods in Section 9. Our current no-sale/no-advertising-sharing practice and separate sponsor permission are described in Sections 3 and 6. Credentials are used for account/security purposes; we do not use them to infer advertising characteristics. You can also request information about applicable disclosures for third-party direct marketing under California Civil Code section 1798.83.
We will reassess which California privacy requirements apply as our business and data practices change, and provide additional notices and choices where required.
Registration and invitation rewards use account verification and server-side attribution records to credit each eligible reward once. The current registration offer is eight Silver Coins. An eligible new account created directly through a friend's invitation can earn ten Silver Coins for each person after verification. Visiting an invitation does not award Coins, and an existing account does not become a qualifying referral by signing in through a link. We do not retain a 30-day referral cookie for a later signup. Existing earned referral rewards remain saved.
Sponsor marketing permission is separate from these rewards and does not change challenge eligibility. For an offer subject to California financial-incentive notice requirements, we will provide its terms, participation and withdrawal methods, and the required explanation of the value of the information before enrollment.
CoffeeScore is intended for people aged 18 and older. People under 18 should not create accounts or submit personal information. If you believe a minor has provided personal information, contact [email protected] so we can investigate and take appropriate action, including deletion where required.
We do not offer children's accounts or a parental-consent account program.
New account registration requires an explicit confirmation that you are aged 18 or older. This is your declaration; we do not collect a birth date or independently verify age through this confirmation.
We use safeguards appropriate to the service, including protected passwords, secure production connections, access controls and protected provider configuration. No system guarantees perfect security. Contact us promptly if you suspect unauthorized access; do not include passwords in your message.
Our service providers may process information in locations outside your home state or country. We remain responsible for describing CoffeeScore's use and applying protections required for our processing. Use of a foreign provider does not waive applicable privacy rights.
We will post the current policy with its effective/update date at coffeescore.org/privacy. For a material change, we will provide a prominent website notice or account email as appropriate before the change takes effect, and seek permission where required. We will not treat continued browsing as blanket consent to optional marketing, sponsor sharing or a materially incompatible new use of information.
Privacy notices explain data practices. Any separate Terms of Use govern the relevant service terms; they do not remove privacy rights that cannot lawfully be waived.
Coffee Is Me Inc 619 Lindaro St San Rafael, CA 94901 United States
Privacy, deletion and support requests: [email protected]. Please identify CoffeeScore and the type of request. If you need this policy in another accessible format, contact the same address.