mead.now
Privacy Policy
The short version. We collect the account details you give us and the production records you enter. We use them to run the service and nothing else. We do not sell your data, we do not advertise, and we run no third-party analytics or trackers of any kind. The site sets one strictly necessary session cookie, which is why you are not being asked to dismiss a cookie banner.
Who we are
mead.now is operated by Lorena Machado LLC, a Washington limited liability company doing business as White Shed Meadery (“we”, “us”). The LLC is the data controller. For any privacy question, or to exercise the rights described below, contact owen@borseth.us.
What we collect
We hold three kinds of information, and no more than we need for the service to work.
Account information
- Your email address and username.
- A cryptographic hash of your password. We never store or have access to the password itself.
- Sign-in timestamps and, for security purposes, the IP address a sign-in attempt came from.
The records you enter
This is the substance of the service: your producer details (including legal name, TTB basic permit number, and bond information), premises and registry numbers, products, batches, timeline events, formula and label approval records, and reporting periods. It is business record-keeping data. Some of it — a sole proprietor's legal name, for instance — can also be personal data, and we treat it accordingly.
Technical logs
Our web server records the usual request log: IP address, timestamp, the URL requested, response status, and browser user-agent string. These are used for security and to diagnose faults.
What we do not do
- We do not sell or rent your data, to anyone, for any purpose.
- We run no advertising and no advertising or retargeting pixels.
- We run no third-party analytics. No Google Analytics, no tag manager, no session recording, no heatmaps.
- We load nothing from third-party servers. Fonts, stylesheets, and images all come from this domain. No external service receives a request — or therefore your IP address — as a consequence of you visiting a page here.
- We do not use your production records to train machine learning models.
- We do not transmit anything to the TTB or to any government agency on your behalf.
Cookies
The site uses cookies only to make signing in work. There is no consent banner because there is nothing to consent to: we set no analytics, advertising, or tracking cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
ci_session |
Keeps you signed in and carries the cross-site request forgery token that protects forms.
Strictly necessary — the application cannot function without it. Flagged
Secure, HttpOnly, and SameSite=Lax.
|
2 hours |
remember |
Set only if you tick “Remember me” when signing in, so you are not asked to sign in on every visit. You choose whether this exists; leave the box unticked and it is never set. | 30 days |
Where your data lives
On Amazon Web Services infrastructure in the United States (Oregon, us-west-2). Traffic
between your browser and our load balancer is encrypted with TLS. Passwords are hashed, and session
cookies are marked Secure so they are never transmitted unencrypted.
No security measure is absolute, and we do not claim otherwise. If a breach affects your data we will tell you promptly and describe what happened.
How long we keep it
Account and production records are kept while your account is open. If you close your account we will delete or anonymise your data within 90 days, except where we are required to retain something by law. Server logs are kept for a short period for security and diagnostics.
Important, and easy to overlook. As a bonded producer you have your own federal record-retention obligations, and TTB requires you to keep production records available for inspection for a period set by regulation. Deleting your account here does not satisfy or transfer that duty. Export or otherwise preserve your records before asking us to delete anything, and keep your own copies regardless. We are a tool you use to keep records; we are not your system of record for regulatory purposes.
Your rights
Whatever jurisdiction you are in, you can ask us to show you the data we hold about you, correct it, delete it, or provide a copy. Email owen@borseth.us and we will respond within 30 days.
If you are in the EEA, the UK, or Switzerland
This service is built for United States federal alcohol compliance and is aimed at US producers, so we do not expect to process the data of people in Europe. If you are there and using it anyway, the General Data Protection Regulation gives you rights of access, rectification, erasure, restriction, portability, and objection, and a right to complain to your national supervisory authority.
Our lawful basis for handling your account and production data is performance of a contract — we cannot provide the service without it. For security logging, our basis is our legitimate interest in keeping the service safe. We do not rely on consent for anything, and we do not carry out automated decision-making with legal effects.
If you are in California
You may request the categories and specific pieces of personal information we hold, request deletion, and request correction. We do not sell personal information or share it for cross-context behavioural advertising, so there is no opt-out to offer. We will not discriminate against you for exercising these rights.
Children
This is a tool for licensed commercial alcohol producers and adult hobbyists. It is not directed at children and we do not knowingly collect data from anyone under 16.
Service providers
We use Amazon Web Services for hosting. AWS processes data on our instructions in order to run the infrastructure. We will update this section before introducing any other processor — for example a payment provider or a transactional email service.
Changes
If we change this policy we will update the date at the top, and for any change that materially affects your rights we will notify account holders by email rather than relying on you noticing.
See also our Terms of Service.