Privacy Policy
Last updated 2026-09-23
Who operates Sip
Sip is operated by Ottoco LLC, a limited liability company based in Redondo Beach, California, USA. Contact: contact@ottocoapp.com
The short version
Sip stores the account you create and the café visits you choose to log. We do not sell your data, we do not show ads, and we do not upload your contacts. You can delete your account from inside the app; the section on how long we keep things says exactly what that erases and what it leaves behind.
What we collect
Account: your email address, your display name, your @username, the short bio you write if you write one, and your avatar photo if you add one.
Sips: the café, your star rating, the drink you name, any words you write, and the photo or video you attach. Each sip carries the visibility you chose — private, friends, or public. A photo or video you pick from your camera roll for a sip has the location saved inside it removed before it is uploaded; if Sip cannot remove it from a video, it will not post that video.
A rating you keep private or friends-only still counts toward the café’s overall score, and so do the category scores that come with it — Taste, Aesthetic, Study Spot, Service, Cost, and any other category a sip can carry. Sip only records the categories you rated yourself — it never fills one in for you, and it never turns your star into a Taste or Aesthetic score you did not give. Those scores count toward that café’s public breakdown of each category, the same way the star does. That is how Sip shows what people actually thought, not just what they posted publicly. Only those numbers move into the public score; your name, your words and your photos do not. Someone watching a café’s score closely could work out roughly what you gave it, and if they already know you went there, that the rating was yours.
Café writing: a review you write about a café, a shorter café note, and the note you can attach to a café inside one of your collections. Café reviews are public — everyone on Sip can read your review with your name on it, and that is the point of writing one. A café note carries its own private, friends, or public setting instead.
Reactions and collections: the sips you like, the sips you save, the comments you leave on other people’s sips, and the collections of cafés you build. If the author of a sip you liked or commented on deletes their account, your like or comment on it is removed with it. Your Top Spots and Favorited lists start public, because they are how other people find good cafés through you — but you can make any collection private from your profile. Every other collection, such as Want to Try, starts private, and you can make it public when you want to. Someone you have blocked cannot see your collections at all.
Reports: if you report something, we store that you were the person who filed it, what you reported, the reason you picked, and any note you wrote.
Location: when you allow it, your device location is used to find cafés near you and to work out whether you are actually at the café you are logging. We store the result of that check, not a trail of your coordinates. That check is now a rule rather than a note. When you press save, Sip takes one fresh reading of where you are and will not post the sip unless you are within about 75 metres of the café you picked. If location is switched off, or your phone cannot give a reading accurate enough to trust, Sip cannot tell whether you are there and will not post the sip either. That is why a sip is sometimes refused. A place you type in yourself is judged more loosely, because Sip has no coordinate of its own to measure it against: there it only needs to be able to see where you are.
Places you add: if you log a sip somewhere Sip does not have in its café list, you can type the name and send it to us so the place can be added. We store the name you typed and, when your phone can give a reading worth trusting, the coordinates you were standing at — putting a new café on the map means knowing where it is. Those are the only raw coordinates Sip keeps against your account; a second, far rounder one is described next. A submission is readable only by you and by the person who runs Sip; nobody else using the app can see it. If your phone cannot give a reading worth trusting, we file the name on its own rather than store a guess.
Out-of-area interest: if Sip’s map has nothing near you yet, you can ask to be told when it does. That stores the map location you asked from, rounded to about eleven kilometres — too coarse to pinpoint your address — against your account until you delete your account.
Activity: the last time you were active in the app, and the café you are at right now when you have location turned on. Only people you are friends with can see this. Turning on Incognito in Settings hides it from them too, and someone you have blocked never sees it.
Social: who you send and accept friend requests from, who you tag as being with you, who you block, and the messages you send.
Badges: each sip you log is also classified into one of twelve drink families — coffee, matcha, chai, and so on — stored alongside the drink you typed, whether you picked the family yourself or Sip classified it from what you wrote. From those families and your public sips and tags, we compute four small badges for your profile: the drink family you have most, how many different cafés you have publicly sipped at, your most-visited café, and the friend you are tagged with most often. All four are computed only from sips you made public and only from tags on those public sips, and the result is stored so every viewer sees the same answer rather than each person working it out differently. You can pin the drink-family badge or the café badge to one you have actually earned, overriding the automatic pick; that pin is stored on your profile too, and it quietly falls back to the automatic pick if the sips backing it are later deleted or made private.
Notifications: a push notification token for your device, so we can tell you when a friend sends you something.
Consent: the fact that you accepted these documents, and which version you accepted.
Crash reports: when the app crashes, diagnostic information about the failure.
Checking what you post
Before you post any of these — the drink you name, a sip caption, words you place on top of a sip photo, a café review, a café note, a comment on someone else’s sip, your display name, your @username, or the name of a place you add — Sip checks what you typed against two lists held inside the app, on your own device: one of slurs and abusive phrases, and one of swear words. Swearing is refused even when it is friendly: a curse word in a compliment is still a curse word, and Sip will not post it. The check happens on your phone, before anything is sent. When a post does reach us, Sip’s own database runs the same check again, with the same two lists, so a modified copy of the app cannot skip it. Your words are never sent to any other company to be checked, and the check on your phone keeps no record of them. If it refuses your text, Sip tells you and posts nothing; the words stay in the box so you can reword them and try again. Direct messages are not checked in this way: they are private between the two of you, and blocking is what stops someone you do not want to hear from.
Those lists are short and literal, so they miss things: anything spelled to dodge them, anything in a language they do not cover, anything that needs context to read as abusive. Reporting is the other half. You can report a sip, a profile or a café. One report for nudity, violence, self-harm or hate takes that sip out of everyone else’s view straight away while we look at it; for any other reason that takes three separate people. A report about a profile or a café is read by us rather than hiding anything by itself. Hiding is not deleting and it is not permanent: if we look and find nothing wrong, the content comes back.
Nothing looks inside your photos or videos. Instead, a photo or video on a public sip has to have been taken with the camera inside Sip rather than picked from your camera roll — a rule about where the media came from, not a scan of what is in it.
Who else sees it
Supabase hosts the database, sign-in, and photo storage. Your data lives there.
Sentry receives crash reports. It is configured not to attach personal information, and access tokens — the short-lived sign-in keys that prove to Sip who you are — are stripped before a report is sent. The longer-lived refresh token the app also keeps has no recognisable pattern, so that stripping cannot pick one out.
Expo runs the push service we send notifications through. It receives your device’s push token and the notification itself. Most notifications carry the display name of the person they are about, with a short line such as “Liked your sip at Blue Bottle” — a re-engagement nudge is the one kind that does not: its title is a café’s name instead, with a line such as “Trending near you this week” (one of a few fixed sentences). Ordinary notifications also carry the id of the screen to open when you tap them; the one exception is a moderation alert, sent only to the app’s own review account, which carries neither a person’s name nor a screen id.
Apple carries those notifications the last step of the way, on to your device. Apple is also part of sign-in itself, and is the only way into Sip: Sign in with Apple is the sole option on the sign-in screen. Apple’s own screen asks your permission for your name and email address and sends back proof of who you are with those two included, and we use that to create or open your Sip account. We never see an Apple password.
Expo Updates, another Expo service, delivers fixes to the app’s own code without a new App Store download. Each time Sip opens, it asks Expo Updates whether a newer version is ready; that request carries your IP address, which operating system your phone runs, the app’s version and a random identifier made for this installation of the app — and, if the app crashed while starting up the time before, a short description of that crash. Sip adds nothing about your account to it.
OpenFreeMap serves the map itself. Whenever the map loads or moves, your phone fetches map pieces from OpenFreeMap, so it sees your IP address and which part of the map is on your screen — which, when the map is centred on you, is roughly where you are. Sip sends it nothing about your account.
Much of the café information Sip shows — names, locations and contact details — comes from OpenStreetMap contributors and the Overture Maps Foundation, though they are not its only sources. That flows the other way — we take data from them, we do not send them yours.
Your profile is visible to everyone signed in to Sip: your display name, your @username, your avatar, your bio, and counts like your sips and your streak. There is no setting that hides a profile from other members, though someone you have blocked cannot see it.
Your four badges are shown on that same profile, unless you turn off “Show badges on my profile” in Settings — then only you can see them. A badge is a summary of a pattern in your public activity, not a diary entry, but it is still a disclosure: your most-visited café or your most-tagged friend is something no single public sip says on its own. The companion badge names a real person, which is why it is the one badge that can change on its own — if that friend removes the tag, or the two of you block each other, the badge stops naming them the next time it updates.
For your sips, other Sip users see only what the visibility you picked allows. A private sip is readable by you and by nobody else, enforced by the database itself and not just by the app screen — though its star rating and any category scores it carries still feed the café’s overall score, as described above.
What we do not do
We do not sell or rent your data.
We do not read your contacts or your address book.
We do not show advertising, and we do not share your data with advertisers.
How long we keep it
Your data stays until you delete it. Deleting a sip removes the sip — its rating, its drink, its words — and deletes the photo or video stored with it.
Deleting your account erases your profile, all of your photos, your messages, your friendships, your café reviews, your café notes, your comments, the places you asked us to add along with any coordinates filed with them, the rough location saved if you asked us to tell you when Sip reaches your area, every sip you had kept private or friends-only, and any public sip you logged at a place you typed in yourself.
One thing is deliberately kept back, and two small records are left behind besides. Sips you had already made public at a café on Sip’s map are handed to an anonymous “Deleted account” author. Only the café, the ratings (the star and any category scores), the drink and when it was logged survive; your name, your words, your photos, the friends you tagged and the record of you being there, a first-at-the-café mark included, are stripped off. Likes and comments other people left on those sips are removed too, so nothing kept on them points back to you. We do this so a café’s Community rating, which counts only public sips, does not move when someone leaves. A café’s Overall star and category scores can move, because they also count private and friends-only sips, and those sips are erased with your account. The first small record is this: notifications we already sent to other people still carry the name you were using when they were sent. Nothing in the app shows those old records to anyone.
Notifications, reports and the record of you accepting these documents are never cleared out on a timer — nothing deletes them after a set time, so they stay for as long as your account does. Deleting your account erases the notifications sent to you, the reports you filed and your consent record; a report someone else filed about something of yours is the second small record, and stays with us as a moderation record; the notifications already sent to other people are the first, described above.
Crash reports are kept separately by Sentry under their own retention schedule and are not linked to your profile.
Your choices
You can delete any sip you have logged. The app has no way to edit a sip once you save it, and the database itself refuses any change to a saved sip’s star rating, café or drink. A saved sip’s category scores are held the same way: none can be changed or removed, and no new one can be added once the sip is a day old. So deleting a sip is how you take it back. Café reviews and café notes work the other way: you can rewrite or remove those whenever you like.
You choose private, friends, or public for each sip as you log it.
You can turn off location and notification permissions in iOS Settings. Notifications are entirely optional. Location is not, if you want to log a sip: with it off, Sip cannot check that you are at the café and will refuse to post one. Everything else — browsing the map, reading your feed, your profile, your collections — works without either.
You can delete your account from Profile. That really removes your data rather than just hiding it, with the exceptions described above.
You can ask Sip for a copy of your data from Settings — Export my data builds it right there on your phone, from your account details, sips, café reviews and notes, comments, likes, saves, collections, friendships, the messages you sent, your reports, your café submissions, your consent record, the blocks you’ve made, the tags on your sips, your category scores, and your out-of-area waitlist signup, then hands it straight to your phone’s own share sheet so you can save it to Files, AirDrop it, or mail it to yourself; nothing is uploaded anywhere to build it. A database rule deliberately keeps a handful of your own account columns out of any bulk read like this one, so the export leaves out the last time you were active, whether Incognito is on, whether Nudges are switched on, the café you’re currently at (and when), and which drink and café badges you’ve pinned. A like or comment you left on a sip that’s no longer visible to you won’t show up in the export either. Messages you sent to someone who has since deleted their account are not included: that whole conversation is erased with their account, so those messages no longer exist anywhere.
Children
Sip is not intended for children under 13, and we do not knowingly collect their data.
Contact
Questions about your data, or a request to delete it: contact@ottocoapp.com