Last updated: September 11, 2026
This Privacy Policy explains how Creative Adventures Lab SASU ("we", "us", "our") collects, uses, discloses, and protects information in connection with the Matcha mobile application (available on the App Store and Google Play, also referred to as "Matcha" or "the App"). It also describes your rights under applicable data protection law, including the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
Please read this policy carefully. By installing or using the App, you acknowledge that you have read and understood it.
Minimum age. Matcha is intended for users 16 and over and is rated 16+ on the App Store and Google Play. This is an app-wide requirement: no one reaches the app's features until a 16+ access gate resolves at launch (Section 2.9) — self-declared, and OS-verified where a regulated region provides an age signal. We chose 16 so the App meets or exceeds the GDPR Article 8 digital-consent age across the EEA and sits above the U.S. COPPA threshold.
Terms of Use: https://app.notion.com/p/creativeadventureslab/Terms-of-Use-Matcha-Android-3d49f4ad1ce980b7a8b2d1049674620f
This is a plain-language summary of the privacy-relevant changes in version 1.2.2. It does not replace the detailed Sections below; where they differ, the Section governs. Matcha remains account-free and stores your journal on your device only.
A new data controller (Section 12). Matcha is now published and operated by Creative Adventures Lab SASU, That company is the data controller for the purposes of this policy, and its particulars, registered address and contact email are in Section 12. Nothing about how the App handles your information changes: there is still no account, no server of ours holding your journal. The contact address also changes in Section 2.8.
Browse tab and affiliate links removed (Sections 1, 2.3, 2.5 and 5).
More detail on the age check (Sections 2.6, 2.7 and 2.9). These sections now say more, and say it more plainly: what the age signal is, where it comes from, and what the App uses it for.
Smaller wording changes (Sections 2.1 and 8).
Matcha is designed to be private by default and local-only. Your matcha cellar, brew sessions, taste profiles, ritual check-ins, custom prep profiles, freshness clocks, app preferences, and every other piece of content the App generates on your behalf are stored exclusively on your device — none of this content is ever stored, transmitted to, or visible to us or anyone else. Matcha operates no server that your journal or personal data is ever sent to. (The one small service we run — the stateless consent-webhook receiver in Section 2.7 — receives Apple's age-assurance notification, never your data, and stores nothing about you.)
The App uses no account system of any kind. There is no sign-in screen, no email/password registration, no Sign in with Apple, no Sign in with Google, no anonymous backend session, and no identity-based login. Each device runs its own independent copy of the App with its own local database. We do not maintain a server-side record of you.
The only data flow that leaves your device at all is the in-app purchase receipt that Apple StoreKit (iOS) or Google Play Billing (Android) generates and verifies on its own infrastructure to confirm your Matcha Pro entitlement. This receipt is handled entirely between your device and Apple or Google — we do not operate a verification server, we do not sit between your device and the platform store, and we do not receive your name, email, payment method, billing address, or any other identifier from the transaction.
We do not collect your email address, phone number, postal address, location, IP address, contacts list, browsing history, or any behavioural analytics from your use of the App. We do not run any third-party analytics, telemetry, advertising, crash-reporting, or tracking SDK in the App. We do not call any AI or LLM provider.