Last updated: July 21, 2026
Effective from the version 1.2.0
This Privacy Policy explains how Creative Adventures Lab ("we", "us", "our") collects, uses, discloses, and protects information in connection with the Matcha mobile application (available on the App Store and Google Play, also referred to as "Matcha" or "the App"). It also describes your rights under applicable data protection law, including the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
Please read this policy carefully. By installing or using the App, you acknowledge that you have read and understood it.
Minimum age. Matcha is intended for users 16 and over and is rated 16+ on the App Store and Google Play. This is an app-widerequirement: no one reaches the app's features until a 16+ access gate resolves at launch (Section 2.9) — self-declared, and OS-verified where a regulated region provides an age signal. We chose 16 so the App meets or exceeds the GDPR Article 8 digital-consent age across the EEA and sits above the U.S. COPPA threshold.
This is a plain-language summary of the privacy-relevant changes in version 1.2.0. It does not replace the detailed Sections below; where they differ, the Section governs. Matcha remains account-free and stores your journal on your device only.
Browse tab and affiliate links (Section 2.5). A new Browse tab links to Amazon as an Amazon Associate. Tapping a link opens Amazon in your browser; we do not receive your identity or your purchases, and set no tracking on our side.
16+ for the whole App (Section 2.9). The App now confirms a 16+ minimum at launch and applies it to the entire app — not to any single feature. It is self-declared everywhere and, in regulated regions where your device provides an age signal (Apple Declared Age Range / Google Play Age Signals), OS-verified — so an under-16 user is kept out of the whole app. Only a coarse age band is read, on-device — we never receive your date of birth or exact age.
Parental consent for significant changes (Section 2.7). In regulated regions, a significant change to the App may require a parent or guardian's approval. Apple runs that prompt; when a guardian later grants or withdraws approval, Apple notifies a small stateless service we run on Railway (Amsterdam, the Netherlands, EU) that stores no consent records — it verifies the notification and keeps only short-lived operational logs. See Section 2.7 and Railway's Privacy Policy (railway.com/legal/privacy).
Children's Privacy (Section 2.8). Expanded to cover the applicable age-assurance laws.
L-theanine tracking removed (Section 3.4). An earlier draft of this version also computed an on-device L-theanine estimate alongside caffeine. That has been deleted — the App now computes a caffeine estimate only, still entirely on-device and never transmitted anywhere.
Matcha is designed to be private by default and local-only. Your matcha cellar, brew sessions, taste profiles, ritual check-ins, custom prep profiles, freshness clocks, app preferences, and every other piece of content the App generates on your behalf are stored exclusively on your device — none of this content is ever stored, transmitted to, or visible to us or anyone else. Matcha operates no server that your journal or personal data is ever sent to. (The one small service we run — the stateless consent-webhook receiver in Section 2.7 — receives Apple's age-assurance notification, never your data, and stores nothing about you.)
The App uses no account system of any kind. There is no sign-in screen, no email/password registration, no Sign in with Apple, no Sign in with Google, no anonymous backend session, and no identity-based login. Each device runs its own independent copy of the App with its own local database. We do not maintain a server-side record of you.
The only data flow that leaves your device at all is the in-app purchase receipt that Apple StoreKit (iOS) or Google Play Billing (Android) generates and verifies on its own infrastructure to confirm your Matcha Pro entitlement. This receipt is handled entirely between your device and Apple or Google — we do not operate a verification server, we do not sit between your device and the platform store, and we do not receive your name, email, payment method, billing address, or any other identifier from the transaction.
Separately, the Browse tab contains Amazon affiliate links. Tapping one opens Amazon in your device's browser or Amazon app — you leave Matcha and continue on Amazon's own site under Amazon's Privacy Notice. Matcha transmits nothing about you when you tap a link, does not know whether you buy anything, and receives from Amazon only aggregate, non-identifying commission reports. See Section 2.5.