Cocktails GPT ← Back to the bar

Privacy Policy

Last updated: 14 September 2026

The short version. We keep your username, your e-mail address, and what you create on the site. Your chats with the AI bar are sent to a model running on our own server — not to OpenAI, Anthropic or Google. We do not sell anything, run ads, or use third-party analytics.

Who is responsible

Cocktails GPT is run privately by Buğra Tufan as a personal project. Contact: cocktails@bugratufan.com

What we collect

Account: username, e-mail address, a hashed password (bcrypt — we never see the password itself), the date you accepted these terms and confirmed your age.
What you create: recipes, inventory items, comments, ratings and the taste profile you give a drink (sweet, sour, bitter and so on), plus which house they belong to.
AI bar conversations: the messages you send and the replies, together with a short set of notes the assistant keeps about your preferences so it can make better suggestions.
Usage records: the number of AI requests you make, the model used and token counts — this is how the daily limit works.
Technical: a session cookie to keep you signed in, and your IP address in server logs and for rate limiting.

We do not use advertising or analytics trackers, and there is no third-party script watching what you do on the site.

Where your AI conversations go

This matters, so it gets its own section. When you talk to the AI bar, your message — along with your inventory, your saved recipes and the assistant's notes about your taste — is sent to a language model running on our own hardware, reached through a private gateway. It is not sent to a commercial AI provider, and it is not used to train anyone's model.

Photos you upload for the bar scan are processed the same way.

Why we keep it

To run your account and keep you signed in.
To give the assistant enough context to be useful.
To enforce the daily request limit and keep the service available.
To confirm your address and let you recover a lost password.
To be able to show, if asked, that we required confirmation of legal drinking age.

Under the GDPR this rests on performing the contract you entered by signing up, and on our legitimate interest in keeping the service running and not abused.

Who else sees it

Members of your house. Recipes, inventory, comments and ratings inside a house are visible to everyone in it.
The site administrator. Has access to the database, including account details, in order to run the service.
Nobody else. We do not sell, rent or share personal data with third parties. The only external services involved are our own mail server for the two account e-mails, and a weather API that receives a city name — never your identity.

How long we keep it

Account data stays until you ask for deletion. AI request logs are kept for operational reasons and pruned periodically. Deleting your account removes your account record, your assistant notes and your ratings; recipes you contributed to a shared house may remain, shown without your name, so the house is not broken for others.

Your rights

If you are in the EU/EEA you can ask for a copy of your data, correction of anything wrong, deletion of your account, or restriction of processing; you can also object to processing and complain to a data protection authority.

To exercise any of these, write to cocktails@bugratufan.com from the address on your account. We answer within 30 days.

Security

Traffic is encrypted over HTTPS, passwords are hashed with bcrypt, sign-in and sign-up are rate limited, and an account cannot be used until its e-mail is confirmed. No system is perfect: please use a password you do not use elsewhere.

Children

This service is not for anyone under the legal drinking age, and we do not knowingly keep data about them. If you believe a minor has an account here, write to us and we will remove it.

Changes

If this policy changes in a way that affects you, we will say so on the site. The date at the top always shows the current version.