Your information
Privacy at Drinx
This policy explains what personal data Drinx collects in the app and on this website, why, who helps us process it, how long we keep it and what you can do about it.
Last updated: 8 October 2026
The short version
- We don’t sell your data, show you ads or let advertisers track you.
- Your drinks, lists and chats are private to your account unless you choose to share something.
- Our database, file storage and server live in Google’s Netherlands region. Some providers process data outside the EU (see section 9).
- Usage analytics never contain what you write or say. They are on when you create an account, and you can switch them off at any time in Profile → Privacy and data.
- “Delete account and data” in Profile removes your account and data. You can also ask us for a copy.
1. Who is responsible
Drinx (“Drinx”, “we”, “us”) is responsible for your personal data under this policy and is the data controller under the EU General Data Protection Regulation (GDPR). This policy is not a contract; our Terms of Use are. For any question or request about your data, email humans@thedrinxapp.com.
This policy covers the Drinx app for iPhone and iPad, including Community, Friends, drink messages, live sync between devices and usage analytics, the share pages at thedrinxapp.com/d/… and this website. It also covers new features as we release them (section 13).
2. The data we collect
Your account
Drinx needs an account: you sign in with Apple or Google. We receive that account’s identifier and basic profile details (name and email address). With Sign in with Apple you can choose to hide your email address behind an Apple private relay address. We do not ask for access to your Gmail, Drive, contacts or calendar. Earlier versions of Drinx could be used without an account: anything made that way moves into your account when you sign in.
What you create in the app
Your profile name and photo, saved and imported drinks, favourites, shopping list, pantry, measurement settings, chats with Drinx, photos you add, your taste profile, your Tried & made log (drinks you made, the date, an optional rating and note, and the place you chose) and, if you join Community or Friends, your username, profile photo and the drinks you share.
Voice
When you speak to Drinx instead of typing, Drinx records only while the timer is running. The recording is turned into text and then deleted (section 4).
Location
Only when you tap “Find places near me”, with iOS’s “While Using the App” permission, never in the background. We keep only the place you choose (its name, address and coordinates) in your Tried & made log.
Usage and diagnostics
Usage events, errors, slow moments and crash reports, linked to a pseudonymous account number (section 5). Never the content of what you write or say. Our server also keeps short technical logs (for example that a recipe import or voice message ran, with your account number), which we use to find and fix problems.
Notifications
A push token from Apple, if you allow notifications.
Website and support
Your email address (with the date and your browser’s language setting) if you join the waitlist, what you write if you email us, and the ordinary server logs our hosting provider needs to deliver and protect the site. This website has no advertising trackers and sets no cookies. Apart from the shared drink pages (section 5, “Shared drink pages on the web”), it has no analytics.
3. How we use your data and our legal bases
Under GDPR article 6 we need a legal basis for each use. These are ours:
| What we do | Legal basis |
|---|---|
| Create your account, store and sync your drinks, lists, chats and log across your devices | Contract (art. 6(1)(b)): this is the service you asked for |
| The AI features you use: recipe import, chat, voice, pantry, taste profile, suggestions, shopping units, drink pictures | Contract (art. 6(1)(b)) |
| Community, Friends, share links and drink messages, once you turn them on or use them | Contract (art. 6(1)(b)) |
| Finding places near you | Your consent, given through iOS’s location permission (art. 6(1)(a)); you can withdraw it in Settings on your iPhone or iPad |
| Push notifications | Your consent, given through iOS’s notification permission (art. 6(1)(a)) |
| Usage analytics and crash reports, to see which features help and to fix problems | Our legitimate interest in a working, improving app (art. 6(1)(f)), with a switch to turn them off at any time |
| Counting visits and button taps on shared drink pages, without cookies | Our legitimate interest in knowing whether sharing drinks works (art. 6(1)(f)) |
| Quality monitoring of AI steps (Langfuse) | Legitimate interest in finding and fixing wrong answers and errors (art. 6(1)(f)) |
| Automatic checks on usernames, profile photos, shared drinks and drink names; handling reports and blocks; rate limits and abuse prevention | Legitimate interest in keeping Drinx safe for everyone (art. 6(1)(f)) and, where it applies, legal obligation (art. 6(1)(c)) |
| The shared recipe catalog and shared drink pictures (not linked to your account) | Legitimate interest in not processing the same recipe twice and in suggesting good recipes to everyone (art. 6(1)(f)) |
| The website waitlist | Your consent (art. 6(1)(a)); ask us and we remove you |
| Answering your emails | Contract or legitimate interest, depending on the question |
| Keeping records the law requires and answering lawful requests from authorities | Legal obligation (art. 6(1)(c)) |
Where we rely on legitimate interest, we have weighed it against your interests: the data is pseudonymous where possible, kept for a limited time, never used for advertising, and you can object (section 10). Drinx does not make decisions about you with legal or similarly significant effects by automated means. Automatic content checks can hide a username, photo or shared drink; you can ask a person to review that at humans@thedrinxapp.com.
4. AI features
Drinx uses AI service providers to power features such as suggestions, chat, recipe import, voice input, taste extraction, content checks and drink pictures. They process data on our behalf:
| Provider | What it does for Drinx | Where |
|---|---|---|
| Google Vertex AI (Gemini) | Suggestions, chat, recipe import, pantry and taste extraction, shopping units, content checks | Google’s global endpoint, may be outside the EU |
| OpenAI | Speech-to-text for voice, and drink picture generation | United States |
| Supermemory | Your private taste memory, used for suggestions | United States |
| Langfuse | Quality monitoring of AI steps | EU |
What they receive. Only what a feature needs: what you send it (a chat or voice message, a recipe link, pasted text or photo, what you tell Drinx about your pantry or taste), relevant context from your account (for example recent messages in that chat, pantry ingredient names, your taste profile and taste memory, drinks you made recently and the first name in your profile) and, for drink pictures, only the drink’s name, type and ingredients. We never send your email address. Supermemory never receives your chats, photos or name, and Langfuse records are linked only to your pseudonymous account number.
No training. Under their business terms, Google and OpenAI may not use this data to train their models. Supermemory and Langfuse may only use it to provide their service to us.
Legal basis. Providing the features you use is part of our contract with you (art. 6(1)(b)). Content checks and quality monitoring rely on our legitimate interest in a safe app that works well (art. 6(1)(f)), see section 3.
Retention. Google and OpenAI process requests to return an answer and may keep them only briefly under their terms to detect abuse (OpenAI for up to 30 days). Voice recordings are deleted from your phone and our server as soon as they are turned into text. Taste memory stays until you delete your account. Other retention periods are in section 7.
Transfers. Some of these providers process data outside the EU, under the safeguards in section 9.
Recipes you import are added, without your name or account details, to a shared Drinx recipe catalog so the same recipe isn’t processed twice, and they can be suggested to other users. Drink pictures are shown to everyone who views that drink. Please don’t import private notes or put personal information in drink names. Offline, or when a cloud step can’t be reached, Drinx uses Apple’s on-device tools where available, and nothing leaves your phone for that step.
5. Usage analytics and crash reports
To learn which parts of Drinx people use and to find and fix problems quickly, the app and our server send usage events to PostHog, our analytics provider, on its EU Cloud (data stored in the EU). An event describes what you did, never what you wrote: for example “opened a drink from Suggested”, “finished setting up by voice” or “sent a chat message of 20 to 50 characters”. Events carry the app version, device model (iPhone or iPad), iOS or iPadOS version, language and region setting, and your measurement units. Once you sign in, your pseudonymous account number also carries a short summary used to group results, for example how you set up Drinx, your taste type and preferred strength, how many drinks you made, tried or saved, your pantry size, whether Community is on, the day you joined and your country from your region setting. Diagnostics go there too: errors, moments where the app froze, how long common actions took, and for the AI steps which feature ran, how long it took, what it cost and whether it worked.
We never send your email address, your name, chat or voice text, notes, photos, recipes you typed or your location. PostHog receives your IP address as part of the connection; we have set it not to keep it or use it to work out where you are. Events are linked to your pseudonymous account number (before you sign in, a random number for that app install), the same one quality monitoring uses. We don’t use this data for advertising, don’t combine it with data from other companies’ apps or websites, and don’t sell or share it. Session recording is off.
When the app crashes, Firebase Crashlytics (Google) receives a crash report: where in the code it happened, the names of the last few screens and actions before the crash, the app version, device model (iPhone or iPad), iOS or iPadOS version and your pseudonymous account number.
Your choice: analytics and crash reports are on by default. The sign-in screen tells you this when you create an account, together with our Terms of Use (section 3.4). Turn off “Share usage analytics” in Profile → Privacy and data and Drinx stops sending both from that device, and within a few minutes our server stops sending any usage events or diagnostics about you to PostHog, whichever device you use; switching it back on restarts them. Quality monitoring of AI steps (section 4) continues, because it is how we run and check those steps, not analytics. What was already sent stays until it expires (section 7) or you delete your account.
Shared drink pages on the web
When you open a shared drink page (thedrinxapp.com/d/…), the page can tell PostHog, on its EU Cloud, that it was opened and which of its buttons you tapped (for example “Join the waitlist” or “Open in Drinx”), with the kind of device (iPhone or iPad, Android or computer), the kind of place the link came from (a messaging app, social media or something else, never the address) and a one-way code for that link, so we can see how often a shared drink leads to someone trying Drinx. The page address is sent without the link’s code. We never send the link itself, the drink’s name, who shared it or anything that identifies you, and we don’t build a profile of you.
These pages use no cookies and store nothing on your device for this, so we can’t recognise you from one visit to the next. PostHog receives your IP address as part of the connection; we have set it not to keep it. If your browser sends Do Not Track or Global Privacy Control, the page sends nothing. We do this on the basis of our legitimate interest in knowing whether sharing works (art. 6(1)(f)); the events are kept like other usage analytics (section 7).
7. Where your data is stored, sync and retention
Your app data are stored in Google Firebase (Firestore and Cloud Storage), in Google’s Netherlands region (europe-west4). Our server functions run in the same region. Your sign-in account (Firebase Authentication), push messaging and crash reports are Google services that are not tied to one region (section 9). Drinx keeps a copy on each device where you’re signed in so the app works offline. With live sync, changes to your shopping list, pantry and favourites reach your other devices within about a second while the app is open. When you remove an item, a small marker (which item, that it was removed, and when) stays for 30 days so your other devices learn about the removal; then it is deleted.
| Data | How long we keep it |
|---|---|
| Account and app data (drinks, lists, pantry, chats, log, taste profile and memory, Community and Friends profile) | Until you delete it or your account |
| Voice recordings | Deleted by us as soon as they are turned into text; OpenAI keeps them for at most 30 days |
| Removal markers for synced lists, pantry and favourites | 30 days |
| Friends activity in feeds | 90 days (a shared drink: while it is shared) |
| Drink messages | 365 days, or until either account is deleted |
| Share links | Until you turn the link off or delete your account; a turned-off link’s record is deleted 30 days later |
| The copy of a drink you shared | While a link or drink message uses it, then about 30 days |
| Link preview images (drink picture and name) | Until no shared drink uses them; checked every night |
| Links we removed for breaking our Terms | Hidden at once, record kept 180 days so a decision can be reviewed |
| Trending counting codes | 2 weeks |
| Usage analytics events (PostHog) | 12 months |
| Crash reports (Crashlytics) | 90 days |
| Quality monitoring records (Langfuse) | Only as long as we need them to find and fix problems; deleted sooner on request |
| Push tokens | Until you sign out or delete your account; a token that stops working is removed the next time we try to use it |
| Waitlist email address | Until we tell you Drinx is available, or until you ask us to remove it |
| Waitlist abuse code (one-way code from your IP address) | 1 hour |
| Reports and moderation decisions | As long as needed to keep Drinx safe and handle disputes |
| Support emails | As long as needed to help you and meet legal obligations |
| Server technical logs (Google Cloud Logging) | 30 days |
| Shared recipe catalog and drink pictures (not linked to your account) | Indefinitely |
8. Who processes data for us
We don’t sell your personal data. We share it only with these providers, which process it for us under data processing terms, and only for the purposes above:
- Google Firebase and Google Cloud: sign-in, database, file storage, server functions, push messaging (Firebase Cloud Messaging), server logs and website hosting; Netherlands region for the database and file storage.
- Google Workspace: the humans@thedrinxapp.com mailbox.
- Google Vertex AI (Gemini): recipe import, chat, pantry, taste profile, suggestions, recipe search, shopping units and content checks.
- OpenAI: speech-to-text for voice, and the image model that creates drink pictures.
- Supermemory: your private taste memory.
- Langfuse (EU): quality monitoring of AI steps.
- PostHog (EU Cloud): usage analytics and diagnostics.
- Firebase Crashlytics (Google): crash reports.
- Discord: private alerts to the Drinx team about reports (username, account number and reason).
- Apple: Sign in with Apple, Apple Maps for nearby places (on your iPhone or iPad) and push notifications. Google: Sign in with Google. Apple and Google handle sign-in under their own privacy policies.
Some services receive data directly from the app but don’t work for us: to find a drink picture online, DuckDuckGo receives a search phrase based on the drink’s name and ingredients, and to show a recipe website’s icon it receives that website’s address (no account data, never your own photos), and the websites that host the pictures shown receive your IP address when the app loads them. Their own privacy policies apply.
We may also disclose data when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of Drinx, in which case we’ll tell you before your data falls under a different policy.
9. International transfers
We store your app data in the EU. Some processing happens outside the European Economic Area: Gemini requests are handled on Google’s global Vertex AI endpoint, so Google may process them in data centres outside the EU; OpenAI, Supermemory and Discord are based in the United States; Firebase Authentication, Firebase Cloud Messaging and Crashlytics are global Google services that may process data in the United States; Apple and Google may process sign-in data globally; and DuckDuckGo (section 8) is based in the United States. Where personal data goes to a country without an EU adequacy decision, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, with extra safeguards where needed. You can ask us for more information about these safeguards.
10. Your rights and choices
Under the GDPR you have the right to:
- Access your personal data and get a copy.
- Correct it. Most of it you can edit directly in the app.
- Delete it. Choose Profile → Privacy and data → Delete account and data. This removes your sign-in, synced app data, Tried & made log, taste profile, taste memory and suggestions, Community and Friends profile and photo, follows, blocks, activity and drink messages, shared drinks and share links, push tokens, your usage analytics in PostHog and that device’s copy. If you used Sign in with Apple, Drinx also revokes its access to your Apple ID. Crash reports expire after 90 days and server logs after 30 days. Quality monitoring records are not removed automatically; email us and we delete yours. Your share pages stop working at once (cached copies within about 10 minutes) and preview images that only your drinks used are deleted. Copies others saved of drinks you shared stay with them, without your name.
- Portability: get the data you gave us in a machine-readable format. Email us.
- Object to processing based on legitimate interest, including analytics and quality monitoring. Turning off “Share usage analytics” in Profile → Privacy and data stops analytics and crash reports from that device straight away, and our server’s analytics about you within a few minutes.
- Restrict processing while a question about your data is being resolved.
- Withdraw consent at any time, for example for location or notifications in Settings on your iPhone or iPad, without affecting what happened before.
- Complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you can also contact the authority where you live. We’d appreciate the chance to help first.
For any request, email humans@thedrinxapp.com from the address linked to your account if you can. We answer within one month and may ask you to confirm it’s you. Google may keep limited information under its own policies, and copies in your device backups follow your Apple backup settings.
11. Children and age
Drinx is not meant for children. You must be at least 16 to use Drinx, and recipes with alcohol are only for people of legal drinking age where they live (18 in the Netherlands). We don’t knowingly collect data from children under 16. If you believe a child is using Drinx, email us and we will delete the account.
12. Security
Data is encrypted in transit and at rest. Access rules limit your private data to your own account, and only the small Drinx team can reach our systems. Voice recordings are deleted after transcription and photos stay in your private storage. If a personal data breach puts your rights at risk, we’ll notify the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay where the law requires.
13. Changes to this policy
Drinx keeps developing, and this policy covers new features as they are released. When we change how Drinx handles your data, we update this page and the “Last updated” date at the top. We tell you about material changes to how we process your data in the app or by email before they take effect. Where a change needs your consent, we ask for it first.
14. Contact
Questions, requests or complaints about privacy: humans@thedrinxapp.com.
6. Sharing with other people
Nothing you make is shown to other people unless you choose to share it.
Community
Community is off until you turn it on in Profile. To join, you pick a username and a profile photo (your Drinx photo, or your Google account photo, which Drinx then downloads from Google). Other signed-in Drinx users can see your username and photo next to the drinks you share. A shared drink shows its recipe, its generated picture and your username, never your photos, chats or taste memory. With Community on, tapping “Made it!” counts toward Trending without your name: we count each person once per drink per week with a one-way code that is deleted after two weeks, and a drink only appears once at least five people made it. Each night we group people with Community on by the kinds of drinks they make, using their taste memory, so “For you” can show what people with similar taste are making; groups have at least 20 people, a drink only shows when at least five of them made it, and nobody can see who is in a group. Turning Community off stops counting and sharing, hides the drinks you shared and removes you from taste groups.
Friends
With Friends, people can follow you and you can follow them. If your account is private, people must ask to follow you. You decide, for each of your makes, favourites and taste, who can see it:
Drinks you share to Community are always public. We record when you agreed to these settings and which version you saw. Activity in friends’ feeds (for example “made a Mojito”) is kept for 90 days; a drink you shared stays in feeds while it is shared. You can block someone: that removes follows in both directions, they can no longer see you or send you drinks, and they are not told. You can mute someone without them knowing. You can report a person or something they shared; reports are reviewed by the Drinx team, who are alerted through a private moderation channel with the username, account number and reason, and a short one-way code instead of the reporter’s account. An account with several reports from different people is hidden while we review it.
Share links
You can create a link to one of your drinks (thedrinxapp.com/d/…). Anyone with the link can open its page, without an account. The page shows the drink’s name, picture, short description, ingredients with amounts and safety warnings (such as allergens or raw egg); the method and nutrition stay in the app. It says who shared it: your @username, or your first name if you switch on “Show my first name on shared links” in Privacy settings, and you can leave the name off a link. The preview image that chat apps show is the drink’s picture with its name, never your name or photo. Links are unlisted: we don’t list them anywhere and we ask search engines not to index them, but anyone you send a link to can pass it on. A link doesn’t expire: it works until you turn it off or delete your account. Visits to a share page are counted without cookies and without storing anything on the visitor’s device, under a one-way code for the link, never the link itself, your account or the drink’s name.
When you share a drink, Drinx keeps a copy of it as it was at that moment, so a later edit in your library doesn’t change what others see. That copy is kept while a link or drink message uses it and deleted within about 30 days after the last one is gone. A turned-off link stops working straight away (copies cached by our web host within about 10 minutes) and its record is deleted 30 days later. A recipient who saved the drink keeps their own copy, with a pseudonymous pointer to your account that no longer leads to anyone once you delete it.
Drink messages
You can send a drink to someone in the app. A drink message contains only the drink, no text, captions or attachments. Only people who follow each other can send each other drinks, and blocked people can’t send you drinks. A drink you sent can’t be unsent. You can report or block from any drink you received. Drink messages are deleted after 365 days, or earlier when either of you deletes their account.
Notifications
Drinx only asks to send notifications once you use Community or Friends. If you allow them, your push token is stored with your account in Firebase Cloud Messaging and notifications go through Apple’s Push Notification service. Signing out or deleting your account removes the token; you can turn notifications off in Settings on your iPhone or iPad.