Privacy Policy

1. Information We Collect

We collect information you provide directly to us and information needed to run Cofy Cat, such as:

• Account Information: When you sign in using Google or Apple Sign In, we receive account details from your authentication provider, such as your name, email address, provider identifier, and profile picture.
• Profile and Media Data: Profile photos, recipe cover photos, storage item photos, shared receipt images you create in the app, and image metadata needed to upload, display, moderate, or delete those files.
• Recipe and Community Content: Recipes you create, import, edit, save, or make public, including titles, descriptions, ingredients, brewing methods, steps, visibility settings, reports, favorites, collections, and associated metadata.
• Library Data: Your reviews of coffee and tea varieties, including taste notes, intensity ratings, tasting thoughts, library favorites, and library browsing activity.
• Storage and OCR Data: Storage items you create or edit, including product names, brands, origins, varieties, processing methods, roast dates, flavor notes, photos, and text recognized from package labels when you use OCR. OCR for storage labels runs on supported devices using Google ML Kit.
• Brew Session and Scale Data: Brew history, timer usage, session logs, ratings, notes, recipe snapshots, optional Bluetooth scale connection state, and summarized weight or flow data used for supported brew workflows.
• Scanner and ML Data: Roast Scanner and Grind Analyzer photos you capture, analysis results, confidence scores, quality flags, calibration-sheet observations, and limited EXIF summary fields used to improve analysis accuracy. Scan photos are uploaded only after explicit consent and are not publicly readable.
• Purchase and Subscription Data: Cofy Cat Pro status, entitlement, plan, product identifier, renewal or expiration state, store, environment, and purchase-event metadata received from RevenueCat and the App Store or Google Play. We do not receive or store full payment card numbers or billing account credentials.
• User Preferences and Consent Choices: App settings, favorite recipes, preferred language, notification preferences, marketing opt-in, GDPR consent, ML training consent, and related timestamps.
• Usage and Diagnostics Data: Information about how you interact with the app, including features used, screens viewed, session duration, high-level error information, and performance signals. We use Amplitude for privacy-limited analytics with pseudonymous identifiers and without advertising identifiers.
• Device and Permission Information: Device type, platform, app version, operating system version, network state, and permission state needed for compatibility, Live Activities, notifications, camera/photo picker, Bluetooth scale support, and security. On older Android versions, Bluetooth scanning may require location permission or location services at the operating-system level; Cofy Cat does not use that permission to determine or store your precise location.
• Feedback and Support Data: Feedback text, support requests, contact details you choose to provide, and related status information.

We do not intentionally collect sensitive information such as full payment details, health information, or precise location data.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, secure, and improve Cofy Cat
• Authenticate accounts and sync user data across devices
• Enable you to create, import, save, edit, share, and discover coffee and tea recipes
• Provide AI-assisted recipe import and parsing by sending the recipe input you submit to NVIDIA Build
• Display public recipes, public profiles, library reviews, and other content you choose to make visible
• Run storage OCR, scanner analysis, grinder calibration, brew timers, Bluetooth scale workflows, Live Activities, and Dynamic Island features
• Manage Cofy Cat Pro purchases, subscriptions, restores, entitlements, and Customer Center flows
• Generate brewing insights, statistics, and personalized recommendations
• Translate and localize recipes, library cards, and app content
• Track brew history, favorites, storage inventory, and library activity
• Send technical notices, support messages, and optional marketing updates
• Respond to feedback, questions, reports, and support requests
• Monitor usage patterns, reliability, and high-level errors to improve the app
• Detect, prevent, and address abuse, fraud, security issues, and technical problems
• Train and improve coffee analysis machine-learning models using scan photos only when you have given explicit consent
• Comply with legal obligations and enforce our Terms of Service

3. Information Sharing and Disclosure

We do not sell your personal information. We require service providers to process information for the disclosed purposes and use appropriate privacy and security safeguards. We may share information in the following situations:

• Public Content: Recipes, profile fields, photos, collections, or other content you mark public may be visible to other users and visitors.
• Library Reviews: Your variety reviews, taste notes, and tasting thoughts may be associated with your profile.
• AI Service Providers: When you use AI-assisted recipe import or parsing, the recipe input you submit is sent to NVIDIA Build to produce structured recipe content. If you use image style-conversion workflows, selected images may be processed through NVIDIA Build / NVIDIA-hosted AI models for that requested conversion.
• ML Model Improvement: With your explicit consent, scan photos and related analysis metadata from the Roast Scanner and Grind Analyzer may be used to train and improve our on-device coffee analysis models. These photos are stored securely and are not shared with third parties for their own purposes. You can opt out at any time in Settings.
• Analytics Providers: We use Amplitude to process privacy-limited, pseudonymous usage analytics so we can understand app reliability and feature usage. We do not use Amplitude for advertising tracking.
• Purchase and Subscription Providers: We use RevenueCat, the App Store, and Google Play to process purchases, validate entitlements, restore purchases, manage subscription status, and support Customer Center flows. Store billing details are handled by the applicable store or payment provider.
• Infrastructure Providers: We use Firebase / Google Cloud for authentication, Firestore database, Cloud Storage, Cloud Functions, App Check, Remote Config, hosting, and related infrastructure.
• Authentication Providers: Google Sign In and Apple Sign In process authentication according to their own terms and privacy policies.
• Native Sharing and Export: When you export data, share a receipt, share a calibration sheet, or use your device's share sheet, you choose the destination app or service. That destination may process the shared file or text under its own terms.
• Legal Requirements: We may disclose information if required by law, legal process, or valid government request, or to protect rights, safety, and security.
• Business Transfers: If Cofy Cat is involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction.

4. Data Storage and Security

We use technical and organizational safeguards designed to protect your information:

• Data is transmitted over HTTPS
• Authentication is handled by trusted providers and Firebase Auth
• Firebase App Check, Firestore rules, Storage rules, and server-side checks help limit unauthorized access
• Firebase / Google Cloud stores data with encryption at rest and in transit
• User media uploads are compressed and metadata is limited where practical before storage
• Scan photos are not exposed through public download URLs and are restricted to admin/server access
• Access to personal data is limited to operational, support, security, and legal needs

No system is perfectly secure. We cannot guarantee absolute security, but we work to reduce risk and respond to issues promptly.

5. Your Rights and Choices

Depending on where you live, you may have rights to:

• Access Your Data: Request or export a copy of your personal data
• Update Your Information: Correct inaccurate or incomplete information
• Delete Your Account: Request deletion of your account and associated user data
• Data Portability: Export your personal app data in a portable format
• Revoke Consent: Disable optional ML training, marketing, and certain consent-based processing in Settings
• Manage Subscriptions: Manage Cofy Cat Pro purchases, renewals, cancellations, and refunds through the App Store, Google Play, or RevenueCat Customer Center where available
• Object or Restrict Processing: Ask us to limit certain processing where required by law

To exercise these rights, use the options in Settings or contact us at yordlejason@gmail.com. To request account deletion outside the app, email yordlejason@gmail.com from the email address associated with your account and include "Account deletion request" in the subject. Deleting your Cofy Cat account does not automatically cancel subscriptions managed by the App Store or Google Play; you must manage those subscriptions through the applicable store.

6. Data Retention

We retain information for as long as your account is active or as needed to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce agreements.

• Active accounts: User data is retained while you use Cofy Cat
• Deleted accounts: User-owned Firestore data, scan photos, user media, and entitlement mirrors are scheduled for permanent deletion after 24 hours, subject to legal, security, abuse-prevention, or operational exceptions
• Cached and local data: Temporary app data and caches are cleared over time or when you use relevant app controls
• Backups: Backup copies may be retained for up to 90 days for recovery and continuity
• Public or shared content: Content you made public or shared may remain visible until removed, and may persist in backups, caches, or copies already accessed by others
• Purchase records: Subscription and purchase-status records may be retained as needed for accounting, support, fraud prevention, and legal compliance
• AI provider processing: AI providers process submitted inputs and outputs under their own terms and retention settings. We store accepted or imported outputs as part of your Cofy Cat data, not as a separate AI-provider archive

7. Children's Privacy

Cofy Cat is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we collected information from a child under 13, we will delete it.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where we and our service providers such as Firebase / Google Cloud, NVIDIA Build, Amplitude, RevenueCat, Google, and Apple operate. These countries may have data protection laws that differ from those in your location.

9. GDPR and CCPA Compliance

For users in the European Union, California, and similar jurisdictions:

• GDPR Rights: You may have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data.
• CCPA / CPRA Rights: You may have the right to know what personal information we collect, request deletion or correction, opt out of sale or sharing for cross-context behavioral advertising, and not be discriminated against for exercising privacy rights. We do not sell personal information or share it for cross-context behavioral advertising.
• Legal Basis: We process personal data based on contract performance, consent, legitimate interests, legal obligations, and protection of rights and security, depending on the context.
• Data Protection Contact: Contact us at yordlejason@gmail.com for data protection inquiries.

10. Third-Party Services

Cofy Cat integrates with or relies on the following third-party services, each governed by its own terms and privacy policy:

• Firebase / Google Cloud: Authentication, database, storage, cloud functions, App Check, Remote Config, and hosting
• Google Sign In / Apple Sign In: Account authentication
• NVIDIA Build / NVIDIA-hosted AI models: AI-assisted recipe import/parsing and requested image processing workflows
• Amplitude: Privacy-limited usage analytics and event tracking
• RevenueCat: Purchase, subscription, entitlement, restore, and Customer Center management
• App Store / Google Play: In-app purchases, subscriptions, billing, renewals, cancellations, and refunds
• Google ML Kit: On-device storage label OCR on supported devices

We encourage you to review the policies for these services.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated Privacy Policy in the app and on our public legal pages. Changes are effective when posted unless a later effective date is stated.

12. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: yordlejason@gmail.com
• In-app: Settings > About > Contact Support