Privacy Policy

Cafuné ("we", "us") is the data controller for the personal data described below. Cafuné is currently operated by its founder as an unincorporated venture based in the United Kingdom; a registered company and its address will be named here once incorporation completes. For any privacy question or request, including access, correction, or erasure, contact privacy@cafuneapp.com.

This policy covers the Cafuné iOS app (including builds distributed through Apple's TestFlight public beta), the Cafuné web app, and this website.

What we collect

Your account

When you sign in, Firebase Auth records your email address and a unique account identifier (uid). If you use Sign in with Apple and choose to hide your email, we only ever see the private relay address Apple generates for you. Your Cafuné profile holds the display name you choose, your email, an optional profile photo, and an optional country.

What you add while using the app

• Community content — ratings and reviews, brew recipes and their photos, recipe comments, likes, and coffees you add to the catalogue (including a bag photo).
• Your own library — favourites, scan history and scan count, your taste profile, and your recent searches (synced so they follow you between devices).

Community content is public to other Cafuné users by design. Photos you upload (profile, bag, and recipe photos) are stored at unguessable but public web addresses so the app can show them, so anyone given a photo's link can open it.

Technical data

• Request logs — our hosting platform records each request to the API, including your IP address and the time.
• Service traces — our API emits diagnostic traces tied to your Firebase uid so we can find and fix errors.
• Scan outcome counters — after each bag scan the app reports whether it found a match and which reader was used. These counters carry no photo and no recognised text.

We don't collect your precise location, contacts, or advertising identifier. If you opt in to analytics, Google derives an approximate (city or country level) location from your IP address; it is not linked to your account.

Why we use it, and on what legal basis

• To run the service you signed up for (contract): your account, content, library, and bag-scan matching.
• To keep the service secure, reliable, and improving (legitimate interests): request logs, diagnostic traces, scan outcome counters, rate limiting, and preventing abuse.
• To understand which features are used (consent): Firebase Analytics, only if you turn it on. You can withdraw consent at any time with the Profile toggle.
• To moderate content (legitimate interests, keeping the community safe): when you report a review, recipe or comment we store your account ID, what you reported, the reason and your optional note.
• To tell you when the beta opens to you (consent): the waitlist address you leave on this website. You can withdraw consent at any time by emailing us.

Who processes your data

We rely on the following processors to run the service. Each only receives the data it needs to do its job:

Some of these providers store or process data outside the UK and EEA, notably in the United States. Where they do, the transfer relies on the provider's standard contractual clauses and, where applicable, the UK Extension to the EU–US Data Privacy Framework.

TestFlight

The iOS public beta is distributed through Apple's TestFlight. When you join, Apple shares with us the information TestFlight collects — such as your name and email if you were invited by email, your device model and iOS version, install and session counts, crash reports, and any feedback or screenshots you choose to send. Apple handles this data under Apple's Privacy Policy. We use it only to test and fix the app. You can leave the beta at any time by deleting the app or choosing Stop Testing in the TestFlight app.

The bag scan, and when Gemini sees the photo

Scanning a bag runs on-device first: text recognition happens entirely on your phone, and in the common case the photo never leaves it. If on-device recognition can't read the bag, the app sends that single camera frame to Google Vertex AI (Gemini) for a second read ("scan-rescue"). The photo is used only to read the words on the bag. We don't keep it, and Google doesn't use it to train its models. There is currently no in-app switch to turn this fallback off; adding one is on our roadmap, and this page will be updated when it ships.

How we protect the beta waitlist

The email address you leave on this website is sealed inside your browser (public-key sealed-box encryption) before it is ever sent — Firestore only ever stores ciphertext, never a plain-text address. The private key needed to decrypt it is kept outside any Google Cloud project, in the operator's own key storage. This means a compromise of Firestore or the surrounding Google Cloud project alone cannot expose waitlist addresses — a technical and organisational security measure under GDPR Article 32.

Deleting your account

You can delete your account inside the app: Profile → Delete account. This permanently deletes:

• your sign-in identity and email (Firebase Auth);
• your profile — display name, email, country, preferences, taste profile, recent searches, favourites, and scan history;
• your uploaded profile photo.

What you've posted to the community — reviews and ratings, brew recipes and their photos, comments, and likes — stays, so other people's discussions don't lose their context. It is detached from your profile and shown as "Anonymous"; internally it keeps only the random account identifier, which after deletion is linked to no name or email.

If you'd rather that content go too, delete it before deleting your account — each rating, recipe, and comment you've posted has a Delete option. If your account is already gone, email privacy@cafuneapp.com describing the items and we'll remove them by hand.

How long we keep data

• Account and library data — until you delete your account.
• Community content — until you delete it, or we remove it for breaking the Terms.
• Content reports — for as long as they are relevant to moderation, or until you delete your account.
• Analytics events (only if you opt in) — 2 months.
• Request logs and diagnostic traces — for the retention period of the logging platform, at most 30 days.
• Waitlist address — until the beta opens to you, or until you ask us to remove it.
• Backups — deleted data is purged from backups within 30 days.

Your rights

Under UK and EU data protection law you have the right to access your data, correct it, delete it, restrict or object to how we process it, and receive a copy in a portable format. You can exercise any of these by emailing privacy@cafuneapp.com; we'll reply within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority, though we'd appreciate the chance to sort it out first.

Security

All traffic between the app and our services is encrypted in transit (HTTPS/TLS), and our storage providers encrypt data at rest. Access to production systems is limited to the operator. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authority as the law requires.

Children's privacy

Cafuné is not directed at, and is not intended for use by, children under the age of 13 (or under 16 where a higher threshold applies locally). We do not knowingly collect data from children below that age; if you believe a child has created an account, email us and we'll delete it.

Changes to this policy

We may update this policy as the app or our processors change. Material changes will be reflected by a new effective date at the top of this page and, where appropriate, announced in the app or in the TestFlight release notes.

Contact

Questions about this policy: privacy@cafuneapp.com.

Terms of Service · Back to Cafuné