Privacy Policy

Fourth Wave is a coffee-shop discovery app. The Android app uses your approximate location to find specialty coffee near you. It also collects anonymous usage events (like "searched" or "viewed a shop") and crash reports, keyed to a random ID that isn't tied to your identity — and you can switch all of that off in Settings. We don't collect personal profiles, we don't sell data, and we don't use advertising trackers.

Fourth Wave is an independent project. Contact: hello@fourthwave.app.

• Approximate device locationwhen you open the app or tap refresh. Used only to query coffee shops nearby and to compute travel times to each shop. The fix is cached in the app for the session and re-requested when you move >500 m or five minutes pass.
• Coordinates pass through our backend but are not kept.Your search coordinates transit our server (and Google's Places and Directions APIs) to fulfill the search you initiated. They are not stored in our database and not written to our application logs.
• Typed addresses are cached briefly. If you type an address (for example in Meet Up mode), the address text and its geocoded result are cached on our server for about 30 days so repeat lookups don't re-query Google. The cache is not linked to you or to your install ID.

The app collects first-party usage events so we can see which features get used and which shops people actually look at. Specifically:

• What an event contains:an event name (things like a search, a screen view, a shop card tap, opening a shop's details, tapping navigate or share), a timestamp, and — for shop-related events — the public Google Maps place ID of the shop. Events never contain your coordinates.
• How it's keyed:a random install ID (a UUID generated on first launch). It is not your name, email, phone number, advertising ID, or any account identifier — the app has no accounts. It exists so we can rate-limit ingestion and honor deletion requests. You can see your install ID in the app's Settings.
• How long we keep it: events are deleted from our server after 180 days by an automatic weekly purge job.
• Demand signals: the place IDs of shops surfaced in your results are also reported in aggregate so we can prioritize enriching the shops real users see.

Release builds of the app use Firebase Crashlytics (Google) to report crashes and related diagnostics — stack traces, device model, OS version, and a Firebase installation ID (a non-advertising device identifier). Crash reports help us fix bugs; they are processed by Google LLC under Google's privacy policy. Crash reporting follows the same in-app toggle as usage data (see below) and can additionally be disabled remotely by us via a server-side kill switch.

Settings → "Share anonymous usage data"controls both usage events and crash reporting. It is on by default; switch it off and the app stops sending both. Location use for search itself is not affected — that's the app's core function and never leaves a trail on our servers either way.

• No advertising IDs (no Google Advertising ID, no IDFA). No third-party advertising SDKs.
• No persistent user account. The app does not require sign-in.
• No precise location storage. Your coordinates leave the device only to serve the search you initiated (our backend in transit, Google Places, Google Directions) and are never persisted on our servers. Usage events never include coordinates.
• No contacts, photos, microphone, or other device permissions beyond location.

• Google Places API (Google) — to discover and identify coffee shops. Your query coordinates are sent to Google when you refresh. Subject to Google's privacy policy.
• Google Directions API (Google) — to compute travel times between you and a shop.
• Firebase Crashlytics (Google) — crash reporting in release builds, controlled by the in-app toggle.
• Supabase — our backend (database + edge functions). Hosts the anonymous usage events and the address cache described above; standard request logging.
• Vercel — hosts this website. Standard request logging.

Standard server logs from our hosting providers (request timestamps, IP addresses, user-agent strings) are retained for short windows for security and abuse prevention.

Fourth Wave is not directed at children under 13 and we don't knowingly collect data from them.

The app has no accounts, so there's no profile to access or export. The one thing we hold that's yours is the usage-event history keyed to your random install ID. To delete it, email hello@fourthwave.app with the install ID shown in the app's Settings screen and we'll delete the matching records within 30 days. (Without your install ID we have no way to know which events are yours — that's by design.) Any other concern, same address; we'll respond promptly.

When this policy changes the date at the top updates. Material changes will be announced on the home page of fourthwave.app.