Privacy Policy
This policy explains what personal data Rickey collects, why, and what you can do about it. It covers both this website and the Rickey mobile app. It is written to be read, not to be survived — if anything here is unclear, write to us and we will explain it.
Last updated: 2026-08-25
Who we are
Rickey is built and operated by Alejandro Garza ("we", "us"), based in Mexico. For the purposes of the GDPR we are the data controller. Under Mexican law we are the responsable of your personal data.
- Company
- Alejandro Garza
- Privacy contact
- hola@buildpassing.com
- Website
- rickey.app · buildpassing.com
We do not sell your personal data. We do not share it with advertisers. We do not build a profile of your shopping habits for anyone else. Those are commitments, and the rest of this document explains how they are kept.
What this website collects
The rickey.app website collects almost nothing. There is no analytics script, no advertising pixel, no third-party tracker, and no cookie that identifies you. The typefaces are served from our own servers rather than from Google Fonts, so loading a page does not reveal your IP address to anyone but us and our hosting provider.
If you join the waitlist
| What | Why | Legal basis (GDPR) | Kept for |
|---|
| Your email address | To send you one message when the app is released, plus an immediate confirmation that you signed up | Consent (Art. 6(1)(a)) | Until you ask us to delete it, or 24 months after launch, whichever comes first |
| Which page and button you used, and your language | To understand which parts of the site actually work | Legitimate interests (Art. 6(1)(f)) | Stored with the signup notification, same period |
| The date and time you signed up | To evidence that consent was given, which the GDPR requires us to be able to show | Legal obligation (Art. 6(1)(c)) | Same period |
Waitlist signups arrive as an email to hola@buildpassing.com and are stored in that mailbox. There is no separate marketing database and no mailing-list provider holding your address.
Server logs
Our hosting provider records standard request logs — IP address, time, page requested, browser type — which are used to keep the site running and to block abuse. These are retained for a short period and are not linked to any identity. Our rate limiting uses your IP address in memory only, to stop one visitor submitting the form hundreds of times; it is not stored.
What the app collects
The Rickey app has not been released yet. This section describes how it is designed to work, and is published in advance so you know what you are signing up for. We will update this policy and tell everyone on the waitlist before the app ships if anything here changes.
Most of what Rickey knows is a list of bottles. Every feature is free, and you can use all of them without an account at all — an account exists so a new phone does not lose your shelf, not because we need one.
| What | Why | Legal basis (GDPR) |
|---|
| Your email address and a password (stored only as a cryptographic hash, never in readable form) — only if you create an account | So a new phone does not lose your shelf and your saved drinks | Performance of a contract (Art. 6(1)(b)) |
| Your shelf: which bottles you have ticked as owned | This is the product. Without it there is nothing to read back | Performance of a contract |
| Your saved drinks, and any list you build | So they are there the next time you open the app | Performance of a contract |
| The bar book: what you poured, when, your rating and your notes | So the second time is better than the first | Performance of a contract |
Three rows used to sit in that table and no longer do, because none of them was true. Rickey has no paid tier, so there is nothing to record about a purchase. It has no way to attach your own photograph to a drink. And it ships with no crash-reporting or analytics library of any kind, so there are no diagnostics to collect — the app's privacy manifest declares exactly that, and a policy claiming more than the manifest is a policy nobody should trust.
The one thing the app fetches
A recipe carries a small see photos link. Tapping it loads a photograph of that drink from TheCocktailDB, which is the only request Rickey makes that is not to us. Like any request to any website, it tells them your IP address and which picture you asked for. Nothing about you is sent, and nothing is loaded until you tap.
What the app never collects
- Health data of any kind. Your bar book records what you poured, because you asked it to — it is a recipe history, not a consumption diary, and nothing in it is sent anywhere or scored.
- Your location. The app never asks for it and never records it.
- Your contacts. There is no sharing feature, so there is no reason to read your address book.
- Advertising identifiers (IDFA, GAID). We do not run ads and do not track you across other apps or websites.
- Payment card details. There is nothing to buy — every feature is free — so no payment of any kind passes through us.
- Anything from your camera roll. The app has no way to reach it and never asks.
Nobody else sees it
Rickey is a single-person app. There is no shared bar, no social feature and no way to invite anyone. Host mode hands your own phone to a guest for a moment; it does not send your shelf anywhere or create an account for them.
A note on what this app is
Rickey is a measured reference for people who already drink. It does not sell alcohol, does not deliver it, and is not connected to any retailer. You must be 18 or over to hold an account, which is covered under Children below, and nothing in the app is medical or health advice.
Who else sees your data
We use a small number of service providers to run Rickey. Each one processes data only on our instructions, under a written data processing agreement, and none of them is permitted to use your data for their own purposes.
| Provider | What it does | Where | What it sees |
|---|
| Render Services, Inc. | Hosts and serves this website and the waitlist endpoint | United States | IP addresses and request metadata; the waitlist form contents in transit |
| Resend (Plus Five Five, Inc.) | Delivers the waitlist emails | United States | Your email address and the message contents |
| Our email provider | Holds the mailbox the waitlist notifications arrive in | See docs/legal.html — to be confirmed before launch | Your email address |
| Apple and Google | Distribute the app and process payments | Global | Their own account and payment data, under their own privacy policies |
We will also disclose personal data where we are legally required to — for example in response to a valid court order — and where it is necessary to protect our rights or someone's safety. If Alejandro Garza is ever sold or merged, your data may transfer to the buyer, who would be bound by this policy until they gave you notice of any change.
International transfers
We are based in Mexico and our providers operate globally, so your data will be processed outside your own country — including in the United States and the European Union.
Where data leaves the European Economic Area or the United Kingdom, the transfer is made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with the technical measures described in the security section below. You can ask us for a copy of the relevant safeguards at hola@buildpassing.com.
How long we keep things
- Waitlist email addresses
- Until you ask us to remove yours, or 24 months after the app launches — whichever comes first. After launch the list has served its purpose.
- Account data
- For as long as your account exists. When you delete your account, it is removed from our live systems within 30 days and from encrypted backups within 90 days.
- Your expenses, accounts and commitments
- For as long as your account exists. Nothing you enter is shared with another user, so when your account goes, it all goes with it.
- Records we must keep by law
- Mexican law requires certain records to be kept for a set period regardless of account deletion. Nothing is sold, so there are no tax or accounting records of a purchase to keep.
Your rights
Wherever you live, you can exercise every right below by writing to hola@buildpassing.com. We answer within 30 days, and we do not charge for it. We may need to confirm your identity first, which usually means replying from the address on the account.
If you are in the EU or the UK (GDPR)
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted ("the right to be forgotten").
- Restriction — have us pause processing while a dispute is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on our legitimate interests.
- Withdraw consent — at any time, without affecting anything done before you withdrew it.
- Complain — to your national supervisory authority. You do not need to come to us first, though we would rather you did.
If you are in Mexico (derechos ARCO)
You have the rights of Acceso, Rectificación, Cancelación y Oposición over your personal data, and you may revoke your consent to our processing it. To exercise them, write to hola@buildpassing.com with your name, a means of contacting you, proof of identity, a clear description of the data concerned and what you are asking for. You may also limit the use or disclosure of your data by the same route. If you believe your rights have not been respected, you may bring the matter before the competent Mexican data protection authority.
If you are in California (CCPA/CPRA)
- The right to know what personal information we collect, use and disclose — set out in the tables above.
- The right to delete personal information we hold about you.
- The right to correct inaccurate personal information.
- The right to opt out of the sale or sharing of personal information — though there is nothing to opt out of, because we do not sell or share personal information as those terms are defined by the CCPA, and have not in the preceding 12 months.
- The right to limit the use of sensitive personal information — we do not collect any.
- The right not to be discriminated against for exercising any of these rights.
Everywhere else
We apply the rights above to everyone, regardless of where you live. It is simpler than maintaining different standards, and it is the right way round.
Deleting your data
You can delete your account and everything attached to it from inside the app, under You → Account → Delete account. You do not need to contact us and you do not need to explain why.
If you cannot reach the app — because you removed it, lost the device, or never installed it — use the request form at /delete-account or write to hola@buildpassing.com. To be removed from the waitlist, reply to any email we have sent you with the word "remove", and your address is deleted.
How we protect it
- Everything travels over TLS. The site sends HSTS, so browsers refuse to connect over plain HTTP.
- Passwords are stored only as salted cryptographic hashes. We cannot read your password, and neither can anyone who obtains the database.
- Data is encrypted at rest by our infrastructure providers.
- Access to production systems is limited to the people who need it, protected by multi-factor authentication.
- This website loads no third-party scripts at all, which removes the most common route by which a visitor is tracked or a page is compromised.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, and we will tell you directly where the breach is likely to present a high risk to you.
Children
Rickey is not directed at children, and the age floor here is higher than it would be for an ordinary app: it is about alcoholic drinks, so you must be at least 18 to create an account, or older where the local legal drinking age is higher. The app is rated accordingly on both stores.
We do not knowingly collect personal data from children below those ages. If you believe a child has given us their data, write to hola@buildpassing.com and we will delete it promptly.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we handle your data, we will tell you — by email if we have your address, and in the app before the change takes effect. Continuing to use Rickey after that point means you accept the updated policy; if you do not, you can delete your account at any time.