Privacy Policy

Last Updated: March 7, 2026

1. Introduction

Welcome to Plug & Sip ("we," "us," or "our"), a service operated by Leucocholy Media. Plug & Sip is a platform that helps remote workers, digital nomads, and students discover work-friendly coffee shops and cafes around the world. Our website is located at https://plugandsip.com.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile application, create an account, use our services, or interact with our platform in any way. It applies to all users of Plug & Sip across all platforms, including guests who browse without an account, registered users, venue owners, and administrators.

By accessing or using Plug & Sip, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our services. This Privacy Policy should be read in conjunction with our Terms of Service, which govern your use of the platform.

We may update this Privacy Policy from time to time, and we encourage you to review it periodically. If we make material changes, we will notify you through the platform or via email as described in Section 14 below.

2. Information We Collect

We collect information in several ways depending on how you interact with Plug & Sip. The types of information we collect fall into the following categories:

2.1 Account Information

When you create an account on Plug & Sip, we collect the following personal information:

• Email address — Used for account authentication, communication, and password recovery. Your email is stored securely and is never publicly displayed unless you choose to make it visible.
• Display name — A publicly visible name you choose for your profile. This appears alongside your reviews, photos, and other contributions.
• Bio — An optional text field where you can describe yourself. This is publicly visible on your profile page.
• Location — An optional field for your general location (city or region). This helps us personalize your experience with nearby cafe recommendations.
• Avatar/profile photo — An optional image you upload to represent yourself. Profile photos are stored securely and displayed publicly on your profile and alongside your contributions.
• Authentication credentials — We store hashed passwords and authentication tokens. We never store your password in plain text.

2.2 User-Generated Content

When you contribute to Plug & Sip, we collect and store the content you create, including:

• Reviews and ratings — Written reviews, star ratings, and any feedback you provide about cafes and coffee shops. Reviews are publicly visible and attributed to your display name.
• Photos — Images you upload of cafes, their interiors, amenities, or menu items. When you submit reviews, upload photos, or suggest cafe edits through our website or mobile app, this content is stored on our servers and may be visible to other users. Photos are moderated before being published.
• Cafe submissions — Information you provide when submitting a new cafe to our directory, including the cafe's name, address, description, amenities, and other details.
• Edit suggestions — Corrections or updates you suggest for existing cafe listings, such as updated hours, amenity changes, or other relevant information.
• Favorites — The list of cafes you save to your favorites collection. This information is associated with your account but is not publicly visible by default.

2.3 Activity Data

We track certain activity data to improve your experience, maintain the platform, and power features like gamification (points, badges, and leaderboards). This includes:

• Page views and navigation patterns — Which pages you visit, how long you spend on them, and how you navigate between them. This helps us understand which features are most useful and identify areas for improvement.
• Search queries — The terms and filters you use when searching for cafes, including location-based searches and amenity filters.
• Interactions — Actions you take within the platform such as favoriting cafes, following other users, viewing cafe details, and engaging with the gamification system.
• Points and achievements — Your contribution history, earned points, badges, tier progress, and reward redemptions as part of our gamification system.

2.4 Technical Data

When you access Plug & Sip, we automatically collect certain technical information:

• IP addresses — We collect and store partially masked IP addresses for security, rate limiting, and fraud prevention purposes. Full IP addresses are not retained in our long-term logs.
• Browser information — Your browser type, version, and language settings.
• Device information — Your device type, operating system, and screen resolution. When you use our mobile app, we also collect device platform information (iOS or Android) for push notification delivery and to optimize your experience. Our crash reporting service (Sentry) may collect device model, OS version, and app state at the time of a crash to help us improve app stability.
• Push notification tokens — If you use our mobile app, we collect device push notification tokens to send you updates about your activity, badges earned, and cafe recommendations. Tokens are stored securely and associated with your account. You can disable push notifications at any time through your device settings.
• Referral data — The URL that referred you to our website, if applicable.
• Timestamps — The date and time of your requests and interactions with our services.

2.5 Location Data

Our mobile app collects your precise location when you use the Explore map, search for nearby cafes, or check in at a cafe. Location data is transmitted to our servers during active use for distance calculations and is stored only as part of check-in records. We do not continuously track your location in the background. On our website, location data may be derived from your IP address or browser geolocation if you grant permission.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

Your information is essential for us to provide and maintain the core functionality of Plug & Sip. This includes displaying your reviews and contributions, personalizing your cafe recommendations based on your location and preferences, processing your cafe submissions and edit suggestions, managing your account and profile, and operating the gamification system (points, badges, tiers, and rewards).

3.2 Personalization

We use your activity data and preferences to tailor your experience on Plug & Sip. This includes showing you cafes near your location, highlighting cafes that match your preferred amenities, curating your activity feed with relevant updates, and recommending cafes based on your past searches and favorites.

3.3 Security and Fraud Prevention

We use technical data, IP addresses, and activity patterns to protect the platform and our users. This includes detecting and preventing fraudulent or abusive activity, enforcing rate limits to prevent service abuse, moderating user-generated content (including automated photo moderation), and investigating potential violations of our Terms of Service.

3.4 Analytics and Improvement

We analyze aggregated and anonymized usage data to understand how users interact with our platform, identify bugs and performance issues, improve existing features and develop new ones, measure the effectiveness of our content and features, and generate aggregate statistics about our user base and platform usage.

3.5 Communication

We may use your email address to send you service-related communications, including account verification and password reset emails, notifications about changes to your account or our policies, responses to your inquiries or support requests, updates about features that affect your account (such as reward redemptions or badge achievements), and, with your consent, promotional communications about new features or events. You can opt out of promotional communications at any time.

4. Cookies and Tracking Technologies

Plug & Sip uses cookies and similar tracking technologies to provide, secure, and improve our services. Below is a summary of the types of cookies we use:

4.1 Essential Cookies

These cookies are strictly necessary for the website to function and cannot be switched off in our systems. They include:

• Session cookies — Temporary cookies that maintain your session state as you navigate the website. These are deleted when you close your browser.
• Authentication cookies — Managed by Supabase Auth, these cookies store your authentication tokens securely, keeping you logged in and verifying your identity across requests.
• Security cookies — Used for rate limiting and preventing cross-site request forgery (CSRF) attacks.

4.2 Analytics Cookies

We use analytics cookies to understand how visitors interact with our website. These cookies collect information in an aggregated form and help us improve the platform. We use Google Analytics to gather statistical data about page views, session duration, and user flows. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

4.3 Advertising Cookies and Mobile Ad Tracking

We use Google AdSense to display advertisements on certain pages of our website. Google AdSense may use cookies to serve ads based on your prior visits to our website or other websites on the internet. You can opt out of personalized advertising by visiting Google's Ads Settings.

In our mobile app, we use Google AdMob to display advertisements. On iOS, we request your permission through Apple's App Tracking Transparency framework before any cross-app tracking occurs. You can change your tracking preferences at any time in your device settings. On Android, you can opt out of personalized ads through your device's privacy settings.

4.4 Managing Cookies

Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impair your overall user experience. Some features of Plug & Sip, particularly authentication and session management, require cookies to function properly.

5. Third-Party Services

We use several third-party services to operate and improve Plug & Sip. Each of these services may have access to certain data as described below. We encourage you to review the privacy policies of these third-party services.

5.1 Supabase

Supabase provides our database infrastructure, user authentication, and file storage. Supabase has access to all data stored in our database, including account information, user-generated content, and activity data. Supabase also manages authentication tokens and session data. For more information, see Supabase's Privacy Policy.

5.2 Stripe

Stripe processes payments for merchandise purchases and premium subscriptions on Plug & Sip. When you make a purchase, Stripe collects your payment information (credit card number, billing address, and related details) directly. We do not store your full payment card details on our servers. Stripe may also receive your name, email address, and shipping address for order fulfillment. For more information, see Stripe's Privacy Policy.

5.3 Vercel

Vercel hosts our web application and provides deployment infrastructure. Vercel has access to server-side request logs, including IP addresses, request URLs, and response codes. Vercel also provides analytics that help us monitor performance and uptime. For more information, see Vercel's Privacy Policy.

5.4 Google Analytics and Google AdSense

We use Google Analytics to collect and analyze usage data, such as page views, session duration, device type, and geographic region. Google Analytics uses cookies to track user interactions across sessions. We use Google AdSense to serve advertisements. AdSense may use cookies and web beacons to serve personalized ads based on your browsing behavior. The data collected by Google is subject to Google's Privacy Policy.

5.5 Mapbox

Mapbox powers the interactive maps on Plug & Sip. When you use our map features, Mapbox may collect your approximate location data (derived from your IP address or browser geolocation, if you grant permission), as well as interaction data with the map (pan, zoom, and marker clicks). For more information, see Mapbox's Privacy Policy.

5.6 AWS Rekognition

We use Amazon Web Services (AWS) Rekognition for automated content moderation of user-uploaded photos. When you upload a photo, the image is sent to AWS Rekognition for analysis to detect inappropriate or harmful content. AWS Rekognition processes the image and returns moderation labels; we do not store the image data within AWS beyond the processing request. For more information, see the AWS Privacy Notice.

5.7 Sentry

We use Sentry for error tracking and crash reporting in our mobile app. When a crash or error occurs, Sentry may collect device model, operating system version, app state, and stack trace information to help us diagnose and fix issues. Sentry does not collect personally identifiable information unless it is included in error messages. For more information, see Sentry's Privacy Policy.

5.8 Google AdMob

We use Google AdMob to serve advertisements in our mobile app. AdMob may collect device identifiers, usage data, and ad interaction data to serve and measure ads. On iOS, AdMob respects Apple's App Tracking Transparency preferences. The data collected by AdMob is subject to Google's Privacy Policy.

6. Data Sharing

We take your privacy seriously and do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information only in the following limited circumstances:

6.1 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This includes general statistics about platform usage, geographic distribution of users, and aggregate cafe review data. This information is used for business analysis, marketing, and improving our services.

6.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request. This includes responding to court orders, subpoenas, or other legal processes, and cooperating with law enforcement agencies when legally required.

6.3 Fraud Prevention and Safety

We may share information when we believe in good faith that disclosure is necessary to protect the safety, rights, or property of Plug & Sip, our users, or the public. This includes sharing data to investigate, prevent, or take action regarding suspected illegal activities, fraud, situations involving potential threats to the physical safety of any person, or violations of our Terms of Service.

6.4 Service Providers

We share information with the third-party service providers described in Section 5 above, solely to the extent necessary for them to provide their services to us. These providers are contractually obligated to use your information only for the purposes of providing their services and to maintain appropriate security measures.

6.5 Business Transfers

If Leucocholy Media or Plug & Sip is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

7. Data Retention

We retain your information for as long as necessary to fulfill the purposes for which it was collected and to comply with our legal obligations. Specific retention periods are as follows:

• Account information — Retained for as long as your account is active. If you delete your account, your personal information is anonymized immediately (see Section 8 for details).
• User-generated content — Reviews, photos, and other contributions remain on the platform even after account deletion, but are attributed to an anonymized user identifier rather than your personal profile.
• Activity logs — Detailed activity logs (page views, searches, interactions) are retained for 90 days and then automatically deleted.
• Administrative audit logs — Logs of administrative actions (content moderation decisions, user management actions) are retained for 365 days for accountability and compliance purposes.
• Aggregated data — Anonymized and aggregated statistical data (e.g., total review counts, average ratings, platform usage trends) may be retained indefinitely as it cannot be used to identify individual users.
• Technical logs — Server logs containing partially masked IP addresses and request data are retained for 30 days for security monitoring and debugging purposes.

8. Your Rights

Regardless of where you are located, we provide all users with the following rights regarding their personal information:

8.1 Access and Portability

You have the right to request a copy of the personal information we hold about you. This includes your account information, user-generated content, activity data, and any other information associated with your account. You can access much of this information directly through your profile settings. For a comprehensive data export, contact us at privacy@plugandsip.com, and we will provide your data in a commonly used, machine-readable format (such as JSON or CSV) within 30 days.

8.2 Correction

You have the right to correct inaccurate personal information. You can update your display name, bio, location, avatar, and other profile details directly through your account settings. For corrections to information you cannot access directly, contact us at privacy@plugandsip.com.

8.3 Deletion

You have the right to request deletion of your account and associated personal information. When you delete your account:

• Your personal profile information (email, display name, bio, location, avatar) is removed immediately.
• Your reviews, photos, and other contributions are retained but anonymized — they are no longer associated with your identity.
• Your points, badges, and gamification data are permanently deleted.
• Your activity logs are deleted according to the retention schedules described in Section 7.

To request account deletion, you can use the account deletion option in your profile settings or contact us at privacy@plugandsip.com.

8.4 Opt-Out Options

You can opt out of certain data collection and communications:

• Promotional emails — Unsubscribe using the link provided in any promotional email we send you.
• Analytics tracking — Use the Google Analytics Opt-Out Browser Add-on or configure your browser to block analytics cookies.
• Personalized advertising — Adjust your ad preferences through Google's Ads Settings or use an ad blocker.
• Location data — Deny or revoke browser geolocation permissions, or disable location access for the Plug & Sip mobile app in your device settings. Note that some features, such as "find cafes near me" and check-ins, require location access to function.
• Push notifications — Disable push notifications for the Plug & Sip mobile app through your device's notification settings. This will prevent us from sending you activity updates, badge notifications, and cafe recommendations via push.
• Mobile ad tracking — On iOS, manage your tracking preferences through Settings > Privacy & Security > Tracking. On Android, opt out of personalized ads through Settings > Privacy > Ads.

9. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

9.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected that information, the business or commercial purpose for collecting the information, the categories of third parties with whom we share the information, and the specific pieces of personal information we have collected about you. You may make up to two requests per 12-month period.

9.2 Right to Delete

You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions. We may retain information as necessary to complete a transaction, comply with legal obligations, detect security incidents, or exercise other rights as permitted by law.

9.3 Right to Opt-Out of Sale

We do not sell your personal information as defined under the CCPA. We do not exchange personal information for monetary consideration, and we do not share personal information with third parties for their own direct marketing purposes. Because we do not sell personal information, there is no need to opt out of such sales, but if our practices change, we will update this policy and provide a conspicuous opt-out mechanism.

9.4 Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices or rates, provide you a different level or quality of goods or services, or suggest that you may receive a different price or rate for goods or services because you exercised your privacy rights.

9.5 How to Exercise Your Rights

To exercise any of your CCPA rights, please contact us at privacy@plugandsip.com. We will verify your identity before processing your request by confirming your email address and matching it to the information in our records.

10. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent legislation provide you with additional rights and protections regarding your personal data.

10.1 Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent — Where you have given us explicit consent to process your data for a specific purpose, such as sending promotional emails or using analytics cookies.
• Contract performance — Where processing is necessary to fulfill our contractual obligations to you, such as providing the Plug & Sip platform services, managing your account, and processing purchases.
• Legitimate interests — Where processing is necessary for our legitimate interests (or those of a third party), provided your fundamental rights and freedoms do not override those interests. This includes platform security, fraud prevention, and analytics.
• Legal obligation — Where processing is necessary to comply with a legal obligation to which we are subject.

10.2 Your GDPR Rights

Under the GDPR, you have the following rights in addition to those described in Section 8:

• Right of access — You can request a copy of the personal data we process about you.
• Right to data portability — You can request your personal data in a structured, commonly used, machine-readable format and have it transferred to another controller where technically feasible.
• Right to rectification — You can request that we correct any inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — You can request the deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purpose it was collected or when you withdraw your consent.
• Right to restrict processing — You can request that we restrict the processing of your personal data under certain conditions, such as while we verify the accuracy of contested data.
• Right to object — You can object to the processing of your personal data for direct marketing purposes or where we rely on legitimate interests as the legal basis for processing.
• Right to withdraw consent — Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

10.3 Exercising Your GDPR Rights

To exercise any of your GDPR rights, contact us at privacy@plugandsip.com. We will respond to your request within 30 days, as required by law. If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

11. Children's Privacy

Plug & Sip is not intended for use by children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these age thresholds. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at privacy@plugandsip.com.

If we become aware that we have collected personal information from a child under the applicable minimum age without verification of parental consent, we will take steps to remove that information from our servers promptly. We may also delete the associated account to prevent further collection.

12. International Data Transfers

Plug & Sip is operated from the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States or other countries where our service providers maintain facilities.

Our primary database infrastructure is hosted by Supabase on servers located in the US East region. Our web application is hosted on Vercel's global edge network, which may process requests in various geographic locations to optimize performance.

The data protection laws in the United States and other countries may differ from those in your country of residence. By using Plug & Sip, you consent to the transfer of your information to the United States and other countries as described in this Privacy Policy. Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses approved by the European Commission for transfers of personal data from the EEA.

13. Security Measures

We implement a variety of security measures to protect your personal information and maintain the safety and integrity of our platform:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security). Our website is served exclusively over HTTPS.
• Encryption at rest — Sensitive data stored in our database is encrypted at rest using industry-standard encryption algorithms provided by our database infrastructure.
• Access controls — We implement role-based access controls to ensure that only authorized personnel can access user data. Our database uses Row Level Security (RLS) policies to enforce data access rules at the database level.
• Authentication security — Passwords are hashed using strong cryptographic algorithms and are never stored in plain text. We support secure session management with automatic token refresh and expiration.
• Rate limiting — We enforce rate limits on API endpoints to prevent brute-force attacks, credential stuffing, and other abuse. Authentication endpoints have stricter rate limits.
• Content moderation — User-uploaded photos are automatically scanned for inappropriate content using AWS Rekognition before being published. Content that fails moderation is flagged for manual review.
• Regular security practices — We conduct security audits of our codebase, including automated dependency vulnerability scanning and secret detection as part of our continuous integration pipeline.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security posture.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes:

• Minor changes — For non-material changes (such as clarifications or typographical fixes), we will update the "Last Updated" date at the top of this page.
• Significant changes — For material changes that affect how we collect, use, or share your personal information, we will provide prominent notice through one or more of the following methods: a banner or notification on our website, an email to the address associated with your account, or an in-app notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of Plug & Sip after any changes to this Privacy Policy constitutes your acceptance of those changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@plugandsip.com
• Entity: Leucocholy Media
• Website: https://plugandsip.com

For general inquiries not related to privacy, please visit our Contact page.

We aim to respond to all privacy-related inquiries within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.