Privacy, in plain language.

What this version stores

If accounts are enabled, we store a display name, email address, and the data required for secure sign-in. Emails are never shown on public reviews. We store your rating, preparation method, opinion, relationship disclosure, and any requests or reports you send.

Essential session cookies support sign-in. This version has no advertising or cross-site analytics. Session records do not store IP addresses or browser user agents. Contribution limits use account identifiers; expired counter buckets are pruned after approximately 24 hours.

When you choose a language, the essential preference cookie matcha-language remembers that choice for one year. At the language-neutral entry page (/), your saved manual choice takes priority over your browser’s language preference. A URL that includes a language always opens in that language, regardless of the cookie.

Images sent to moderators

Crop names, addresses, and other personal information before uploading. Images are decoded, checked, and re-encoded without metadata. They stay in private moderation storage, visible only to administrators, and do not automatically become public catalog photos.

Correction and deletion

You can edit reviews from your account. Account deletion removes reviews and sign-in data. Moderation submissions and audit entries needed for correction history are detached from the account. Private attachments are removed before account deletion and expire after 30 days when the configured maintenance job runs.