Privacy policy

Know Your Oat is run by a small independent team based in London, United Kingdom. We are the data controller for the personal data described here. You can reach us at hello@knowyouroat.com.

If you create an account. Your email address, so we can send you a sign-in link (we do not use passwords). Optionally a display name and a profile picture, if you add them. If you have a display name, it appears next to your contributions.

What you contribute. Cafes you add, edits you suggest, the milks you report, votes confirming or disputing a milk, your favourites, and your check-ins. A check-in records the cafe, the drink and the milk. Your star rating and any note you write on a check-in are visible only to you. Your favourites list has its own link, which anyone you give it to can open.

If you run a cafe. When you claim a listing we keep your role, what you told us so we could verify you, and the photos, menu, description and milk prices you publish. Those are public by design. Moderators and admins can see your claim and your account email so they can check it.

Keeping the guide honest. To stop spam and fake entries, when you submit something we look at some technical characteristics of your browser and keep a scrambled version of your IP address. We never store the IP address itself. This is used only to spot abuse, such as one device pretending to be many people.

Visits to cafe pages. We count how many people view a cafe and click through to its map, website or Instagram, so owners can see that the listing is useful. This uses no cookies. It relies on a scrambled code that changes every day, so it cannot follow you from one day to the next or identify you.

Your location. If you use “cafes near me”, your position is used inside your browser to sort the list. It is not sent to us or stored.

Emails you send us. If you write to us, we keep the message so we can answer it.

We use a small number of cookies, all of them necessary:

• A sign-in cookie that keeps you logged in.
• An anti-abuse cookie that recognises a device that has already passed our spam check. It lasts about 60 days.
• A cookie that remembers your vote on a milk if you vote without an account, so you cannot vote twice by accident.

We do not use advertising or cross-site tracking cookies. General traffic statistics are collected without cookies and without building profiles of visitors.

We want every listing to be right, and nobody knows what a cafe pours better than the people who run it. So we sometimes write to a cafe at a business address it has published itself, on its own website or in OpenStreetMap. We use general addresses such as info@ or hello@, not named individuals. We do not buy contact lists and we do not collect addresses from social media.

We do this on the basis of legitimate interest: a directory and the businesses in it both benefit from accurate details, and a published business contact address is where a business expects to hear about such things. We send one email and at most one reminder. Every email has a one-click unsubscribe, and unsubscribing is permanent. Addresses that bounce or that report our email as unwanted are removed automatically. If you would rather never hear from us, write to hello@knowyouroat.com and we will add you to our do-not-contact list.

We use a few trusted providers. They process data on our instructions and only to provide their service:

• Hosting and database. The website, our database, sign-in and the images cafes upload. Your account data is stored in the European Union.
• Email. A delivery service sends our emails and receives replies to them, in the European Union.
• Traffic statistics. Cookieless visit counts that do not build profiles of visitors.
• Maps. Map images are loaded from OpenStreetMap-based providers. As with any website, the map provider sees the IP address that requests them.

If you would like the names of the companies involved, write to hello@knowyouroat.com and we will tell you.

Links to Google Maps, Instagram or a cafe's own website take you to services we do not control, under their own privacy policies. If any provider handles data outside the UK or EU, it does so under approved safeguards such as standard contractual clauses.

We never sell personal data, and we never share it for advertising.

• Your account and contributions: until you delete your account or ask us to.
• Anti-abuse records and cafe visit counts: they hold no names or IP addresses, and we keep them only as long as they are useful for spotting abuse or showing trends.
• Our do-not-contact list: indefinitely, because that is the only way to honour a request never to be emailed again.
• Emails you send us: for as long as the conversation is relevant.

When you delete your account, facts you contributed about cafes (for example that a cafe pours a certain milk) may stay in the guide, no longer linked to you.

Under UK and EU data protection law you can ask us to show you the data we hold about you, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. Where we rely on legitimate interest, including emails to cafes, you can object at any time and we will stop.

You can delete your account yourself at the bottom of your profile. For anything else, write to hello@knowyouroat.com and we will reply within one month. If you are unhappy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.

Know Your Oat is not aimed at children, and you need to be at least 16 to create an account. If you believe a child has given us personal data, tell us and we will delete it.

If we change how we handle personal data we will update this page and the date at the top. If a change is significant we will tell account holders by email first. The rules for using the site are in our terms of use.