CoffeeLab Journal — Privacy Policy
Last updated 9 November 2026
The short version. CoffeeLab Journal is a personal coffee journal. Everything you log — your coffees, ratings, tasting notes, photos and brews — stays on your device and in your own iCloud account. I cannot see any of it.
There are exactly two things the app can send me, and only if you switch them on: an anonymous summary of your taste, and which coffees you rated. Each has its own switch, both are off by default, and you can delete what you shared at any time from inside the app.
The app also fetches public information for you, such as roasters' shop pages and exchange rates. Those requests carry nothing about you; they are listed under What the app fetches for you.
Who is responsible
The data controller for this app is Ömer Tarik Özyilmaz, an individual developer. You can reach me about anything on this page, including any request about your data, at otozyilmaz@gmail.com.
What stays on your device
Almost all of it. The app is built around a local database that syncs through your own iCloud account using Apple's CloudKit private database. Data in a private database is accessible only to you — as the developer I have no technical means of reading it, and I never receive a copy.
This includes:
- Your coffees, roasters, origins, processes, roast dates and prices
- Your ratings, tasting notes, photos and videos
- Every brew you log, including recipes, timings and equipment
- Your caffeine log and any drinks you record while out
- Your achievements, streaks and settings
If you delete the app or turn off iCloud, that data goes with it. You can export a full backup file at any time from Settings.
A Bluetooth scale talks to the app directly, and your Apple Watch gets its brews and timers straight from your iPhone. Neither goes through a server.
Health data
With your permission, the app writes the caffeine from drinks you log into Apple Health. If you tap Use my weight from Health on Your caffeine profile, it also reads your most recent body weight, to estimate how fast your body clears caffeine. It reads nothing else from Health. This exchange happens entirely on your device between the app and Apple Health. Health data is never transmitted anywhere, is not included in the optional sharing described below, and you can revoke access at any time in the Health app. The app works without Health access.
Your caffeine profile
To estimate how long caffeine stays in your body, the Caffeine tab can ask about the things that change it: your weight, whether you smoke, hormonal contraception, pregnancy, a liver condition, medicines that affect caffeine, and, if you know it, a gene variant (CYP1A2). Every answer is optional. Like the rest of your data, the answers stay on your device and, if you use iCloud, in your own iCloud account. They are never sent to my server, are not part of the optional sharing, and are never included in what the optional AI features send. The estimate is general information, not medical advice.
The one thing you can choose to share
The app's distinctive feature is a taste vector: a standardised summary of what your ratings say you like. It is computed on your device from your own library.
If — and only if — you turn on Share my taste profile in Settings → Share ratings, the app sends that summary to a server I operate, so that palates can be grouped into archetypes and the app can eventually tell you what people with your taste also enjoy.
Exactly what is sent
| Field | What it is |
|---|---|
| The vector | A number per flavour family, process, origin region and roast level, saying how much more or less than your own average you rate that category |
| Support counts | How many coffees back each number, so thin evidence can be weighted down |
| Rated count | How many coffees you have rated in total |
| Your mean and spread | Your average rating and its variability, rounded, so the standardisation can be checked |
| Install identifier | A random identifier generated on your device (see below) |
| App version | Which build produced the vector |
You can see the literal data before deciding: Settings → Share ratings → Show me the payload displays the exact bytes that would be sent.
What is never sent
- Your name, email address, Apple ID or any account identifier
- Coffee names, roaster names, your tasting notes, photos or videos. (If you separately turn on the per-coffee sharing described below, a scrambled code standing for a roaster and coffee name is sent — never the names themselves.)
- Your individual ratings — only the standardised summary derived from them
- Your location, the cafés you visit, or any device identifier
- Any health data, including your caffeine profile
- Your brew logs, timings or caffeine history
The install identifier
The summary is submitted with a random identifier created on your device the first time it is needed. It is not derived from your hardware, your Apple ID, or Apple's advertising or vendor identifiers, and it is not shared with anyone. Its only purpose is to let the server replace your previous summary rather than counting your palate twice.
It is stored in your iCloud Keychain, so your own devices share one identifier. That is what makes "counted once" true: your coffees sync between your iPhone and iPad, and without a shared identifier the same palate would arrive twice and be counted as two people. It travels only between your devices, end-to-end encrypted by Apple, and it means the identifier can outlive reinstalling the app on a device signed into the same Apple Account. Deleting what you have shared replaces it everywhere.
When you turn sharing off, or use the delete button, the identifier is discarded and a new one generated. Anything you choose to share afterwards therefore cannot be linked to what you shared before.
Proving a submission came from a real device
Each submission is signed using Apple App Attest, and the server stores the resulting key identifier alongside your install identifier. This is what stops one person creating thousands of invented palates and distorting the result for everyone, and what stops anyone editing or deleting a summary that is not theirs.
The attestation key is created by your device for this app alone. It is not a device fingerprint: it cannot be linked to other apps, it does not survive reinstalling the app, and Apple does not tell the server anything about you. It is deleted together with your summary when you use the delete button, so no record of the pairing is kept afterwards.
How long it is kept
The server holds one summary per install, replaced whenever your taste meaningfully changes, not a history. It is kept until you delete it, until the version of the taste schema it was collected under is retired, or until the research it supports ends, whichever comes first. A retired schema means the numbers no longer describe the same thing, so the old rows are deleted rather than migrated: a summary nobody can interpret is not worth keeping. No automated decision-making or profiling with legal effects is performed on it.
Nothing here is archived, backed up to a third party, or exported. There is one database, on one machine, and deleting is deleting.
Legal basis, and taking it back
The lawful basis for this processing is your consent under Article 6(1)(a) GDPR. Consent is entirely optional: the app is fully functional without it, and nothing is withheld from you for declining.
You can withdraw at any time in Settings → Share ratings, either by switching the toggle off or by tapping Delete what I've shared. Either action deletes your summary from the server. Withdrawing is as easy as giving consent, and does not affect the lawfulness of processing before you withdrew.
The second thing you can choose to share
A taste vector describes you. It cannot say anything about one particular bag of coffee, because a phone has only ever seen one person drink it. The single most useful thing a prediction can have is how a specific coffee has gone for everybody else who drank it, and that is a different question with a different answer, so it is a separate decision with its own switch: Share which coffees I rated, in Settings → Share ratings. It is off unless you turn it on, and turning on the palate sharing above does not turn this on.
It is separate because it deserves to be. A list of the coffees somebody drinks is closer to a fingerprint of them than a summary of their palate is, and rolling the two together would be exactly the kind of quiet widening this policy exists to rule out.
Exactly what is sent
| Field | What it is |
|---|---|
| A coffee code | A SHA-256 hash of the roaster and coffee name, lowercased and stripped of punctuation, computed on your device. The names themselves never leave it. |
| A standardised score | How far above or below your own average you rated that coffee, clamped to a sensible range. Never the score out of ten you gave. |
| Install identifier | The same random identifier described above, so your own entry can be replaced rather than duplicated — and so it can be excluded from the average shown to you. |
Coffees with no roaster are never sent at all: "Ethiopia" from two different shops is not the same coffee, and pretending otherwise would pool strangers' opinions of unrelated lots.
An honest note about the hash. It is not a promise of unlinkability: the input is a roaster and a coffee name, which is low-entropy, and somebody determined with a list of roasters could rebuild a dictionary of it. What it does buy is that no free text you typed is ever stored, and that a bag with a personal name on it does not land in a database as that string.
What comes back, and what it protects
The app asks the server what other people made of the coffees on your shelf. Two rules govern the answer:
- Five other people, or nothing. An average is returned only once at least five other people have rated that same coffee. Below that, the server returns nothing at all.
- You are never shown yourself. Your own rating is excluded from any average you are shown, so a coffee you rated highly cannot come back as "everybody loves this".
Reading those averages requires no identifier and no attestation. If you have not turned on the sharing above, the app asks without identifying you at all.
Legal basis, taking it back, and how long it is kept
The lawful basis is again your consent under Article 6(1)(a) GDPR, given separately from the consent above. Turning the switch off deletes what was sent — not merely stops sending more — and deleting your taste summary deletes these rows with it. The server holds one entry per coffee per install, replaced when your rating changes, and keeps it until you delete it.
The camera
The app can read a coffee bag's label through the camera, either from a photo or continuously from the live preview. All of that happens on your device, using Apple's built-in text recognition, and optionally Apple's on-device language model to tidy up what was read. No image and no frame is uploaded anywhere, and the photo you keep is stored with the bag like any other photo in the app.
Optional AI features
The app can explain its predictions in plain language. By default this runs entirely on your device using Apple's built-in on-device model, and nothing is transmitted.
You may optionally supply your own API key for Anthropic or OpenAI to use a cloud model instead. If you do, the text of your question and a summary of your taste are sent directly from your device to that provider under your own account, governed by their privacy policy — not mine. Your caffeine profile and any health data are never part of what is sent. I do not receive that traffic, and I never see your key, which is stored in your device's Keychain. This is off unless you enter a key yourself.
What the app fetches for you
Some features read public information from the internet on your behalf. Your device makes each request directly, the site sees it as it would any visit, and nothing about you or your library is sent beyond what the request itself names. None of these requests carries the install identifier described above.
- Importing a coffee from a web address. If you paste a roaster's product page, your device fetches that page from the roaster's website to fill in the coffee's details.
- Finding a coffee by its roaster and name. The app looks the coffee up in that roaster's own online shop.
- Following roasters and watching saved coffees. If you follow a roaster or save a coffee, the app reads that roaster's shop about once a week (when you open the app, in a background refresh iOS allows, or when you tap Check now) to see new coffees, prices and whether they are in stock. It reads one shop at a time, a few requests each.
- The worldwide coffee list. About once a week the app downloads a list of coffees from roasters around the world from my server. The request carries no identifier and nothing from your library.
- Update check. The app asks my server which version is current, so a test build can tell you when it is out of date.
- Exchange rates. To show prices in your currency, the app downloads the European Central Bank's daily reference rates.
- Cafés. Café search uses Apple Maps, so what you search for goes to Apple under Apple's privacy policy. Only Near me uses your location, when you tap it, and only while the app is in use. With that permission, the app also checks roughly where you are (to about a kilometre) when you open it, so it can notice you are travelling; that position stays on your device. To tell specialty cafés apart, the app may read a café's own website.
- Cafés from Google Maps. If you paste a link to a saved Google Maps list, your device fetches that list from Google. Files you import (CSV, KML, GPX or GeoJSON) are read on your device.
The App Store and TestFlight
If you agreed to share analytics with app developers (Settings → Privacy & Security → Analytics & Improvements), Apple shares anonymous usage and crash statistics with me in App Store Connect. I can't link them to you.
While the app is distributed through TestFlight, Apple processes some data about your participation, and as the developer I can see it in App Store Connect:
- The email address you used to accept the TestFlight invitation
- Crash reports and basic engagement metrics such as session counts
- Any feedback or screenshots you choose to submit through TestFlight
This is separate from anything the app itself sends, and is governed by Apple's privacy policy. I use it only to fix problems and to contact testers about the beta. I do not combine it with taste summaries — and could not, since those carry no identifier that could be matched to a person.
What this app does not do
- No advertising and no ad networks.
- No analytics or tracking SDKs. There is no third-party analytics code in the app at all.
- No tracking across apps or websites, and no data is shared with data brokers.
- Nothing is sold. Not now, and a change of that kind would require asking you again.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to processing. Because virtually everything the app holds lives on your own device and in your own iCloud account, you already exercise most of these directly: you can view, edit, export and delete any of it in the app at any time.
For the taste summary, the delete button in Settings is an immediate erasure, and switching either sharing option off erases what that option had sent. If you would prefer to ask me instead, or want to exercise any other right, write to otozyilmaz@gmail.com and I will respond within one month.
If you believe I have handled your data improperly, you may complain to your national data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
Children
This app is not directed at children and does not knowingly collect any data from them.
Changes to this policy
If this policy changes in a way that affects what leaves your device, the date at the top will change and the app will ask for your consent again rather than relying on the consent you gave to an earlier version.