Privacy policy
Last updated 21 October 2026
This policy explains how personal data is handled when you use the hosted BrewGraph service, join the waitlist, or visit this website. It does not cover the self-hosted, open-source BrewGraph: when you run it on your own server, your data never reaches us and you are responsible for it.
1. Who is responsible
The data controller is Peritex AB, a Swedish limited company (aktiebolag), which operates BrewGraph. Contact for anything in this policy, including requests to exercise your rights: privacy (at) peritex.se.
2. What we collect, and why
This website
Browsing this website stores nothing about you. It sets no cookies and uses no analytics or tracking. Its "Join the waitlist" links take you to the waitlist page run by Clerk, described below.
The waitlist
The waitlist is run by Clerk, our sign-in provider. When you join it, Clerk stores your email address and when you joined. We use it only to invite you to the hosted service: if one of the limited beta places opens up for you, you get an email invitation to create your account; otherwise you get one when the service launches.
Legal basis: steps taken at your request before an agreement with you (GDPR Art. 6(1)(b)).
We keep your waitlist entry until the service launches. At launch everyone still on the waitlist is sent an invitation, and then the waitlist and every entry in it are deleted. You can ask to be removed earlier at any time (see "Your rights" below). Once you have created an account, the account rules in this policy apply instead.
Your account
Sign-in is handled by Clerk, our identity provider, which processes your login details on our behalf; we remain responsible for that data as the controller. We never see or store your password. We store your display name and role in your account. We do not store email addresses: they are held by Clerk, which also sends invitations. When we need an address to send you a notification (for example an inactivity warning), we look it up from Clerk at that moment, pass it to our email provider, Resend, to send the message, and do not store it. The monthly digest is shown in the app and sent as a push notification, not by email.
Legal basis: performance of our agreement with you (Art. 6(1)(b)).
Support requests
When you contact support from the app, we receive your message, the email address you signed in with (so we can reply), your account name and plan, and which page of the app you were on. The request is sent to our support mailbox by email. We use it only to answer you and fix the problem you report.
Legal basis: performance of our agreement with you (Art. 6(1)(b)).
Your brewing data
Your batches, recipes, notes, equipment, and the readings your devices send. This is not usually personal data in itself, but it is linked to your account, so we treat it with the same care. We never store device settings such as WiFi passwords.
Legal basis: performance of our agreement with you (Art. 6(1)(b)).
Improving predictions
On the hosted service, brewing process data (readings and batch outcomes) may be used to improve BrewGraph's prediction models and recommendations, for example fermentation completion estimates. This is a condition of using the hosted service, and there is no setting to opt out. We use brewing data for this, not your name or email address. Self-hosted installations are never included.
When you delete a batch or close your account, we keep an anonymised copy of its brewing measurements (readings, style, gravity, yeast and fermentation steps, without names, notes or anything that identifies you or your account) and may use it to improve the service after your own data is deleted. Anonymised data cannot be linked back to you, so it is no longer personal data.
Legal basis: our legitimate interest in improving the service (Art. 6(1)(f)) and the terms of our agreement with you.
Product news by email
We only send product news and offers if you choose to, when you sign up or later in your settings (Settings → Data & privacy). It is off by default and is never part of accepting the terms. You can turn it off at any time in the same place.
Legal basis: your consent (Art. 6(1)(a)).
Security and operations
Our servers log technical information about requests, including IP addresses, to keep the service running and secure and to investigate faults and abuse. IP addresses in these logs are truncated (the last part removed) before they are written. The one exception is the web server's error log, which can record the full address when a request fails; it is deleted after 7 days. To prevent abuse, we also keep a pseudonymised (hashed) form of the IP address your account and devices most recently connected from; the IP address itself is not stored.
Legal basis: our legitimate interest in running a secure service and preventing abuse (Art. 6(1)(f)).
3. How long we keep it
| Data | Kept for |
|---|---|
| Waitlist entry | Until the service launches and everyone on it is invited, then deleted |
| Account and brewing data | While your account is open |
| Anything you delete, or a closed account | Recoverable for 30 days. After that it is deleted from BrewGraph and from our backups, which takes up to 60 days in total; only an anonymised copy of the brewing measurements is kept (see "Improving predictions") |
| An inactive free account | Closed after 12 months without use, then as above |
| Support requests | 12 months after the request is resolved, then deleted |
| Hashed IP address | Only the most recent one; removed with the account |
| Web server error log (may contain full IP addresses) | 7 days |
| Service event logs (with truncated IP addresses) | 180 days |
The data stored in BrewGraph (your display name and role, devices, batches, storage and measurements; not your sign-in details, which are held by Clerk) is backed up to locations in Germany and Sweden. Backups follow the retention above: deleted data can remain in a backup for up to 60 days in total.
4. Who processes your data
We use these service providers: Clerk (sign-in and the waitlist, United States); Oracle Cloud Infrastructure (servers and database, Frankfurt, EU); Resend (sending email, United States); Google (Gmail, the support mailbox that receives support requests, United States); Microsoft Azure (hosting of this website, Amsterdam, EU); and jsDelivr (page styles and icons, global). They process personal data only on our instructions; we remain the controller. Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or the EU Commission's standard contractual clauses, as applicable to each provider. We do not sell personal data or share it with anyone for advertising.
5. Your rights
Under the GDPR you can:
- get a copy of the personal data we hold about you;
- take your data with you in a portable format;
- have incorrect data corrected;
- have your data deleted by closing your account, or on request;
- object to processing based on legitimate interest, or ask us to restrict it;
- withdraw consent to product news at any time, and ask to be removed from the waitlist.
To use any of these, contact privacy (at) peritex.se. We answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, IMY (Integritetsskyddsmyndigheten).
6. Cookies
This website sets no cookies. The hosted app and Clerk's waitlist and sign-in pages use cookies that are strictly necessary for signing in, set by Clerk. We use no advertising or analytics cookies.
7. Children
You must be at least 18 years old to use the hosted service or join the waitlist. We do not knowingly collect data about anyone younger; if we learn that we have, we delete it.
8. Changes
When this policy changes, the new version is published here with a new "last updated" date. If a change matters for how your data is used, account holders are told before it takes effect.
See also the terms of service.