Privacy Policy

1. Scope

This Privacy Policy describes how Beiler Ventures LLC ("we", "us" or "our") collects, uses, discloses and retains personal information through the Mudl mobile application, the Mudl web application and the website at trymudl.com (together, the "Service"). Mudl is a registered assumed business name of Beiler Ventures LLC, a North Carolina limited liability company. The assumed business name was recorded with the Buncombe County, North Carolina Register of Deeds on July 20, 2026 (Book 6613, Page 290).

2. Information We Collect

(a) Account information. Your email address and password (stored as a hash); any name, handle, biography and profile image you provide; two-factor credentials if you enable them; and your preferences. A guest account created when the application is first opened holds a generated placeholder identifier and no name or email address.

(b) Sign-in provider data. If you sign in with Google, Facebook or Apple, your name, email address and profile image from that provider. We access nothing else in your provider account.

(c) Content you provide. Recipes, bar inventory, custom ingredients and bottle photographs; venue reviews, cocktail ratings, notes and photographs; menus you scan or upload; check-ins, with any note and the selected visibility; night-card images; drink logs, event responses and poll answers; follows, friend requests and invitation messages; venue and menu reports; feedback, with your account's email address, screen, platform and application version; your taste-profile answers and the profile derived from them (persona and weights per style); and venue-claim details, including a supporting document where requested.

(d) Location. With your permission, your device location: approximate to show nearby venues, precise for the position watch and for check-in. A check-in sends one fix; we store whether it matched the venue and the distance and accuracy in metres, not the coordinates. Your device sends its coordinates to a reverse-geocoding service to determine your city, which we store.

(e) Device identifiers and push tokens. A push token if you enable notifications; a first-party anonymous identifier and client session identifier; your time-zone offset; and the IP address and user-agent string of each sign-in session. We collect no advertising identifiers and include no third-party advertising or tracking software.

(f) Usage and diagnostics. The screens you view and features you use, associated with your account or the anonymous identifier; and, on an error, the message, stack trace, route, status code, platform, application version, user-agent string and, if signed in, your user identifier. Our hosting provider keeps server request logs.

(g) Website analytics. See Section 5.

3. How We Use Information

We use this information to operate and secure the Service, including authentication and synchronising your content across devices; send transactional email; personalise the Service using your inventory and taste profile; generate the cocktails and ingredient records you request; verify presence at check-in and compute venue counts; display your content according to your visibility settings; screen venue photographs; measure use; diagnose errors; prevent abuse and enforce our Terms of Service; respond to reports and requests; and comply with law.

4. How We Share Information

(a) Service providers. We share information with providers that process it on our behalf, in these categories:

• hosting, database, object storage and content delivery;
• email delivery (your email address and the contents of transactional messages);
• artificial-intelligence model providers, which receive the text and photographs you submit to create a cocktail or ingredient record; your inventory and taste profile when you request a generated cocktail; custom ingredient and recipe text, for matching; venue photographs, for screening; and menu images, for extraction;
• web search (the name of an ingredient or label, not the photograph);
• reverse geocoding and place search (your device coordinates and the text you type to search for a city);
• operational logging (your user identifier, the first 200 characters of text you submit for AI creation, label text read from your photograph and the result);
• push-notification relays operated by Apple and by browser vendors;
• map tiles and web fonts (your IP address and user-agent string when the application loads them); and
• website analytics (Section 5).

Each provider must protect your personal information to a standard at least equal to this Policy and use it only to provide services to us.

(b) Other users and the public. Your profile is visible to signed-in users. Check-ins are visible to the audience you select (Public, Mutuals or Only you). Reviews default to Public and may appear on the public website. A night-card image may include a friend's first name or profile image, subject to that friend's visibility. Venue operators see counts of activity at their venue. They also see your name on anything you share publicly about their venue, and when you mark yourself Going to one of their events. Other activity you share with Mutuals or keep to yourself reaches them only as a count.

(c) Aggregated or de-identified information that no longer reasonably identifies you.

(d) Legal and business transfers. To comply with law or legal process, to protect rights, property or safety, to enforce our Terms of Service, and in a merger, acquisition, financing or sale of assets.

(e) We do not sell your personal information.

5. Cookies, Analytics and Do Not Track

The website at trymudl.com uses Google Analytics, a service of Google LLC, which sets cookies and collects your truncated IP address, pages viewed, referring site, device and browser information and the interactions we define. Advertising features, Google Signals and advertising personalisation are disabled. Google's practices: https://policies.google.com/technologies/partner-sites; browser opt-out add-on: https://tools.google.com/dlpage/gaoptout.

The website also uses Umami, a cookieless analytics service, and records on our own servers views of venue and event pages and share actions, without any account or anonymous identifier. The application runs no third-party analytics.

You may disable website analytics on this device with the control below; the setting is stored in your browser.

We do not respond to Do Not Track or Global Privacy Control signals.

Other than Google Analytics, we do not permit third parties to collect personal information about your online activities over time and across different websites through the Service.

6. Retention

(a) Registered accounts. We retain your account information and content while your account is active. Sessions expire seven days after they were last refreshed; expired sessions and tokens are deleted 30 days after expiry.

(b) Guest accounts. A guest account more than 30 days old with no active session and no recorded activity is deleted nightly. A guest account with activity is retained until you delete it from the device (see /account-delete) or sign in, when its records transfer to your account and it is deleted.

(c) Backups. Deleted data may remain in backups for up to seven days.

(d) Retained after account deletion. These records are kept, and are not de-identified in every case. Our records of your usage, check-ins, city choices and past event attendance have the account link removed. Menus you scanned stay with the venue. Venue photographs you uploaded stay shown, without your name. Night-card images stay at their unlisted web addresses and may show other people. Feedback keeps the message and the email address sent with it. Error logs and AI spend logs no longer name you. Venue-claim documents stay in private storage, and operator captions on venue photographs stay. Usage and error records are kept indefinitely; the rest are kept until they are no longer needed for the purpose for which they were collected. /account-delete lists each category.

(e) Other records are retained as long as necessary for the purposes in Section 3.

7. Security

We maintain reasonable administrative, technical and physical safeguards to protect personal information. Information is encrypted in transit. No method of transmission or storage is completely secure. Report a suspected compromise to [email protected].

8. Your Choices

(a) Settings. Under Profile and Settings you may update your profile, preferences, visibility defaults and notifications, and change the visibility of a check-in or review. Location permission is managed in your device or browser settings. Website analytics: Section 5.

(b) Sign-in providers. You may revoke Mudl's access from the security settings of the provider you used. Revoking access ends sign-in through that provider and does not delete data held by Mudl.

(c) Requests. Depending on where you live, you may have the right to access, correct or delete your personal information. Email [email protected] with the subject "Privacy request"; we verify identity before acting.

9. Account Deletion

You may delete your account, registered or guest, within the application, or by email to [email protected] from the account's address. The steps, timing, and what is removed and retained are set out at /account-delete. Deletion removes your account and content except the records described in Section 6(d).

10. Children

The Service is intended for persons 21 years of age or older and is not directed to children under 13. If you believe a child under 13 has provided personal information to us, contact [email protected] and we will delete it.

11. Changes to This Policy

We may amend this Policy and will change the "Last updated" date shown above when we do. If a change materially affects the information we collect or how we use it, we will provide notice in the application before it takes effect.

12. Contact

Questions about this Policy may be directed to [email protected] or by mail to: