Privacy Policy

This privacy policy applies to the Workspace Nomad app for mobile devices and web browsers, together with any related services operated by Brink Development, LLC (collectively, the "Application"). Brink Development, LLC is hereby referred to as the "Service Provider".

Workspace Nomad is a guide to coffee shops that people contribute to. You can read all of it without an account. An account is only needed in order to write something.

Information You Provide

If you create an account, the Service Provider collects:

• Your email address, and your name if you choose to give one
• Your password, which is stored only by the Service Provider's authentication provider (Clerk) and is never visible to the Service Provider

If you contribute, the Service Provider collects what you submit:

• Reviews — ratings, prices, notes, and the free text you write about a visit
• Photographs you upload of a shop, its menu board, or a drink
• Short video clips (up to six seconds) you upload of a shop, without their sound. See "Video clips" below
• A photograph's location, if you leave "Include the photo's location" ticked when you upload it on the website: the GPS coordinates stored in the photograph, and the accuracy your camera recorded for them. See "Photographs, and what is removed from them" below
• Recommendations — whether you would recommend a shop for a given purpose, and any note explaining why
• Saved lists — the shops you save, the names you give your lists, and whether you mark a list public
• Quick checks — one-tap answers about a shop, such as whether it has WiFi
• Reports and blocks — if you report content, what you reported and any explanation you write; if you block an account, a record that you have blocked it

What is public, and what is not. Reviews, photographs and recommendations are published on the Application and are visible to anyone, attributed to your name or, if you have not set one, your email address. Saved lists are private by default and are visible only to you unless you mark a list public. Your email address is not published alongside your reviews unless you have chosen to use it as your display name.

Blocking is private, and one-directional. If you block an account, that record is visible only to you and is used only to hide that person's reviews, photographs and recommendations from your own view of the Application. The person you block is not told, nothing of theirs is removed for anyone else, and their use of the Application is unaffected. You can see and undo your blocks at any time in Profile › Blocked accounts. Reports are separate: a report is read by a person, and is not shown to whoever posted the content.

Information Collected Automatically

The Application collects:

• Your device's Internet Protocol address, and standard web server request logs (the pages requested, the time and date, and the browser or app version making the request)
• The date you last signed in, retained as a per-day record so the Service Provider can see how much the Application is being used

Apart from a photograph's coordinates, which you choose to send as described below, and the wifi speed test described next, the Application does not collect your device's location.

The wifi speed test asks for your location. Before each test, the website asks your browser for your device's location and checks that you are near the place whose wifi you are testing; a test is only recorded from there. The location is sent with the result so the Service Provider can repeat that check, and is then discarded: it is not stored, not attached to the reading, and not shown to anyone. If you refuse location permission, the test does not run. The region shown to you in the mobile app is one you pick yourself; on the website it may be inferred from your IP address by the Service Provider's hosting provider in order to pick a default city, and that inference is not stored against your account.

The Application does not contain third-party advertising, third-party analytics SDKs, or tracking across other companies' apps and websites. It does not use the App Tracking Transparency permission because it does not track you.

Photographs, and what is removed from them

Photographs are stripped of their metadata on your device, before anything is uploaded. A photograph taken on a phone normally carries the GPS coordinates where it was taken, a timestamp, and device identifiers; the Application decodes and re-encodes every image before it leaves your device, so the image that is uploaded and published carries none of it.

The photograph's location is the one exception, and it is your choice. When you upload a photograph on the website, a box labelled "Include the photo's location" is shown and is ticked by default. While it is ticked, the GPS coordinates recorded in the original photograph — and the accuracy the camera reported for them, if any — are read on your device and sent alongside the stripped image. Untick it and they are not sent. Nothing else from the photograph's metadata is ever sent: not the time it was taken, not the camera or phone it was taken on. The mobile app does not send a photograph's location.

The coordinates are used only to check where a shop is — comparing the locations of a shop's photographs with each other and with the shop's map pin, so that a misplaced pin or a photograph of the wrong shop can be found. They are never published and are not shown to other users. They are stored separately from the photograph, linked to it, and deleted when the photograph is deleted, including when you delete your account. If you use a photograph's location to place a new shop's pin, that pin is published as the shop's location, as any pin is.

Video clips

Faces are blurred before a photograph is stored. When you upload a photograph, it is checked for people's faces (by Google Gemini, below), and every face found is blurred before the photograph is stored or published; the unblurred original is not kept. This is done on a best-effort basis: a face that is very small, turned away or partly hidden may not be found, and is then published as it was taken, so look at a photograph of other people before you upload it. For a video clip, the still frame is blurred but the clip itself is not.

A video clip is converted on your device, before anything is uploaded: it is cut to its first six seconds, reduced in size, and its sound is removed entirely — the uploaded clip has no audio track, so conversations recorded in the background are never sent. Like a photograph, the clip is re-encoded, so the location, timestamp and device details your phone recorded in it are not carried into the uploaded file. Unlike a photograph, a clip's location is never sent, whether or not "Include the photo's location" is ticked. One still frame is taken from the clip on your device and uploaded with it, to show where the clip cannot be played. The clip and its still frame are published like a photograph, and deleted together.

Receipts. If you scan a till receipt to record prices, the payment block is blacked out on your device before the image is sent, and you can adjust or add to the areas covered before sending. The redacted image is read once to extract prices and is never stored — there is no copy on the Service Provider's systems and none in the published Application.

Artificial Intelligence

The Application uses AI services to read information from images and from businesses' own websites, and to search spots by meaning. Where this involves data you submitted, it is described here so you can decide before submitting it:

• Google Gemini receives every photograph you upload of a shop — and, for a video clip, the one still frame taken from it, never the clip itself — in order to sort it — a menu board, a till receipt, the inside or outside of the shop, food or drink — to find the faces in it so they can be blurred, and to read the prices from menu boards and till receipts. A photograph of the inside of a shop is also described — its furniture, materials, lighting and decoration — so that the shop's interior style can be suggested and searched for. A receipt you scan with the receipt scanner is redacted on your device first. A receipt uploaded as an ordinary photograph is not redacted: it is recognised, read for prices and then discarded, and is never stored or published. Receipt images are not retained by the Service Provider. Google processes these images as a service provider to the Service Provider. Google does not use them to train or improve its models. It keeps them, with the question asked and its answer, for up to 55 days solely to detect and prevent abuse of its service, and during that time authorised Google staff may review content its safety systems flag. See Google's privacy policy.
• Cloudflare Workers AI receives the text you type into the spot search, and descriptions of the spots themselves, in order to find spots by meaning as well as by name. It does not receive your account information. The search text is not stored by the Service Provider; like any request to the website, it may appear in Cloudflare's request logs.
• Anthropic (Claude) is used to read publicly published business information, such as a coffee shop's own website, in order to propose facts about that business for review. It does not receive your account information, your reviews, or your photographs. See Anthropic's privacy policy.

No AI service is given your contact details, and no AI provider is permitted to use data received from the Application to train its models.

Cookies and similar technologies

The website uses cookies that are necessary for the Application to work — keeping you signed in, and remembering the city you last chose. It does not use advertising or cross-site tracking cookies. Where required by applicable law, the Service Provider will obtain consent before using non-essential technologies.

Third Party Access

The Service Provider uses the following third parties to operate the Application. Each receives only what it needs to perform its function, and each is bound to protect that data to the standard set out in this policy:

The Service Provider does not sell your personal information, and does not share it with third parties for their own independent purposes or for cross-context behavioural advertising.

The Service Provider may disclose information:

• as required by law, such as to comply with a subpoena or similar legal process;
• when it believes in good faith that disclosure is necessary to protect its rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• to the trusted service providers listed above, who work on its behalf, have no independent use of the information, and have agreed to adhere to the rules set out in this privacy statement.

How the Service Provider uses what it collects

• To publish the reviews, photographs and recommendations you chose to submit
• To operate your account and keep you signed in
• To keep a record of where each fact on a shop's page came from, so readers can see who recorded it and when
• To respond to reports of content that breaks the rules, and to investigate abuse
• To hide, from you alone, the contributions of accounts you have blocked
• To send you service messages that are necessary to your use of the Application

The Service Provider will only send you marketing communications where you have opted in and where permitted by law, and every such message includes a way to stop receiving them.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions or other legally recognized transfer mechanisms
• Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Your Rights

You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at brinkdevelopmentllc@gmail.com.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. The Service Provider does not sell or share personal information as those terms are defined by the CCPA/CPRA. To exercise your rights, contact the Service Provider at brinkdevelopmentllc@gmail.com.

Deleting your account and your data

You can delete your account from inside the mobile app, without contacting anyone: open Profile and choose "Delete account". Deletion is immediate and cannot be undone. If you use only the website, email the Service Provider at brinkdevelopmentllc@gmail.com and your account will be deleted in the same way.

Deleting your account removes your account record, your email address and name, your saved lists, your recommendations, the photographs you uploaded, and every block you had made or that had been made against you.

Reviews you have written are kept, with your name removed from them. A review records what a shop's prices and facilities were on a particular day, and other readers rely on those facts and on the record of when they were last checked; deleting them would remove information about businesses rather than about you. Once your account is deleted, a review you wrote is no longer attributed to you or linked to your account, and cannot be traced back to you through the Application. If you want a specific review's text removed as well, ask at brinkdevelopmentllc@gmail.com and it will be removed.

You may also request deletion by email at brinkdevelopmentllc@gmail.com. The Service Provider will process such requests within the timeframes required by applicable law.

Opt-Out Rights

You can stop further collection of information by deleting your account, uninstalling the Application, or ceasing to use the website. Uninstalling or ceasing use stops further collection from your device, but does not by itself delete information already transmitted — use the account deletion described above for that.

Data Retention Policy

The Service Provider retains personal data based on its necessity for the stated purposes:

• Account data: retained until you delete your account, and removed immediately when you do
• Contributed content: published for as long as your account exists; on deletion, handled as described under "Deleting your account and your data"
• Automatically collected data, including server logs: retained for up to 24 months from collection, unless longer retention is required for legal compliance
• Receipt images: not retained at all
• Photographs sent to Google Gemini: kept by Google for up to 55 days to detect abuse, and never used to train its models
• Aggregated and anonymized data: retained indefinitely as it no longer identifies you
• Data required for legal compliance: retained as long as required by applicable law

Children

The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will delete this from its servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (brinkdevelopmentllc@gmail.com) so that the necessary actions can be taken.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information, and provides physical, electronic, and procedural safeguards to protect the information it processes and maintains. All traffic between the Application and its servers is encrypted in transit. Passwords are never stored by the Service Provider.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at brinkdevelopmentllc@gmail.com.

This privacy policy is effective as of 2026-10-16

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action — for example, by submitting a review, uploading a photograph, or scanning a receipt. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at brinkdevelopmentllc@gmail.com.