Privacy

1. Controller

2. Beanify servers, logs and IP addresses

The Beanify backend runs on Cloudflare Workers. We store account and coffee data in a Cloudflare D1 database and profile photos in the Cloudflare R2 storage service. Both the database and the media storage are set to Cloudflare's EU jurisdiction, so this data is stored in the European Union. Cloudflare, Inc., USA, processes the data on our behalf as a processor under its data processing addendum.

For troubleshooting and abuse prevention we use Cloudflare Workers Logs. A sample of about 10% of requests to the Beanify servers is logged, including the requested URL. Your account ID only appears in the URLs the app uses to load profile photos. Our own error messages contain only event names and status codes, no content. Cloudflare also records request headers in the logs, such as your IP address and user agent, and details derived from them: country, region, city, postal code, approximate coordinates, time zone and network provider. Cloudflare does not necessarily store the logs in the EU and deletes them automatically after no more than 7 days.

To prevent abuse, we limit the number of sign-in requests per IP address; for this we store the IP address with a counter and a timestamp. We store neither the IP address nor the user agent with sign-in sessions. Section 14 explains how long we keep this data. The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

3. Sign-in and account

You use Beanify either with Sign in with Apple or with a guest account.

• Sign in with Apple: Apple provides us with your Apple user ID, your name if you share it, and your email address or, if you choose Hide My Email, a relay address created by Apple. We verify Apple's identity token when you sign in and do not store it. So that we can revoke Sign in with Apple at Apple when you delete your account, we store a refresh token from Apple. When you delete your account, we revoke it at Apple and delete it.
• Guest account: With a guest account, too, your data is stored on the Beanify servers and not only on your device. You can only use it on the device where you created it. If you later sign in with Apple, we move the guest account's data, profile photo and App Store purchases to your account and delete the guest account.

In your profile you can add or change a display name, a username and an email address. Your sign-in session is kept in the operating system's protected storage. The legal basis for the account and sign-in is providing the app to you (Art. 6(1)(b) GDPR). Apple (for users in the EU: Apple Distribution International Ltd., Ireland) also processes the sign-in as an independent controller under Apple's privacy policy.

4. Your coffee data

Beanify stores the content you create: beans, brews, notes, taste ratings, recipes, gear and water profiles, plus the recommendations calculated from them. This data is linked to your account, stored on the Beanify servers and synced with the app (Art. 6(1)(b) GDPR).

If you switch on “Personal brew model” in Settings (off by default), Beanify learns from your own brews how your grinder responds and uses this to improve your recommendations. The model only uses your data and is only available to you.

On your device, Beanify also keeps a local database for offline use, drafts that have not been synced yet, beans saved on the device, and app settings. This storage is required for the features you request (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

5. Profile photo (optional)

If you upload a profile photo, we store it in Cloudflare R2. Before it is stored, the image is re-encoded, which removes embedded metadata such as EXIF data that may contain, for example, the location or camera model (Art. 6(1)(b) GDPR).

The photo is visible to you and to people who open a recipe you have shared (Section 8). The app loads it through signed links that expire after one hour. You can replace the photo at any time, or remove it under “Edit profile” with “Remove photo”; it is then deleted from our storage right away.

6. Scanning coffee bags

When you scan a coffee bag, the scan is analysed entirely on your device. The images are not uploaded to us or to anyone else. You grant camera access through your device's permission prompt and can revoke it there at any time.

7. Community grind statistics

To suggest better starting grind settings, we calculate averages per bean, grinder model and brew method from all users' brews, and for similar beans by roast level and process. Only brews rated 4 or higher and logged with a grinder from the Beanify catalog are included. We store only sums and averages of grind setting, dose, shot time and rating plus the number of brews, without names, account IDs or other identifiers.

An average is only used once highly rated brews from at least three different users have gone into it. Other users do not see these values themselves, only a grind suggestion calculated from them and the number of brews included. So that we can take a brew's contribution back out, we keep an internal record of which values each brew contributed. If you delete a brew, its contribution is removed.

The legal basis is our legitimate interest in giving all users better recommendations (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR) by switching off “Add to community grind averages” under Settings → Privacy (on by default). We then immediately remove what your past brews contributed and add nothing from new brews. If you switch it back on, only brews rated afterwards are included. You can also email us at info@polleydigital.de.

8. Sharing recipes

When you share a recipe, Beanify sets it to “Shared via Link”. Using your device's share sheet, you send a recipe card as an image or a link that opens in Beanify. The card shows the recipe values, bean and roaster, grinder, flavour notes and your display name or username.

Anyone who has the link and uses Beanify can open the recipe in the app. They also see your profile photo, bean details such as origin and process, and the taste rating of the brew the recipe is based on. The link does not expire on its own. With “Stop sharing” on the recipe screen you can make the recipe private again at any time; the link then stops working. Recipe cards you have already sent and copies other users have saved are not affected. The service you share through, such as a messenger, processes the content under its own responsibility (Art. 6(1)(b) GDPR).

9. Purchases and RevenueCat

Paid features are bought through Apple's App Store. Apple handles the payment; we do not receive payment details. To verify and restore your entitlements we use RevenueCat, Inc., USA, as a processor. RevenueCat processes your purchase history, your Beanify account ID as its App User ID, and your device's identifier for vendor (IDFV). We do not use your email address as the RevenueCat user ID, and we do not use this data for advertising or cross-app tracking.

The legal basis is performance of our contract with you (Art. 6(1)(b) GDPR). See the RevenueCat privacy policy for details. Apple also processes the purchase as an independent controller.

10. App updates and optional performance monitoring (Expo)

Beanify downloads app updates through EAS Update by Expo (650 Industries, Inc., USA). For this the app sends your IP address, the operating system's user agent, the platform, app version and update channel, the identifiers of the installed and the bundled update, and a random installation identifier (EAS client ID). If the app crashed after an update, the error message of that crash is sent as well. The legal bases are our legitimate interest in a secure app with bugs fixed (Art. 6(1)(f) GDPR) and Section 25(2) No. 2 TDDDG.

Performance monitoring with EAS Observe (“Share technical performance”) is switched off on a new install. Only if you switch it on in Settings does Beanify send Expo the app version, operating system and platform, timing and duration of technical operations, visited app routes, error data and a random installation identifier. We do not send your name, email address or coffee entries for this. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time in Settings with effect for the future. According to Expo, measurement data is kept for at least 60 days. More information: Expo privacy policy.

11. Notifications and emails

Beanify schedules notifications locally on your device only. We do not use a push service and do not receive a push token. We do not send marketing emails.

12. Support and contact form

If you write to us by email or through the contact form (in German), we process your details and your message to handle your request (Art. 6(1)(b) GDPR for contract-related questions, otherwise Art. 6(1)(f) GDPR). Our mailbox is provided by IONOS SE, Germany, as a processor. We delete requests once they are resolved unless we are legally required to keep them.

13. Recipients and transfers outside the EU

Recipients are the service providers named above: Cloudflare (servers, database, storage, encrypted backups and logs), RevenueCat (purchases), Expo (updates and optional performance monitoring) and IONOS (email). Apple (for users in the EU: Apple Distribution International Ltd., Ireland) processes sign-in and purchases as an independent controller.

Cloudflare, Inc. and Expo (650 Industries, Inc.) are certified under the EU-U.S. Data Privacy Framework. Where they transfer data to the USA (for Cloudflare mainly logs, as the database, backups and media storage are in the EU), this relies on the European Commission's adequacy decision (Art. 45 GDPR). RevenueCat stores data with Amazon Web Services in the USA; this transfer relies on the EU standard contractual clauses in RevenueCat's data processing addendum (Art. 46(2)(c) GDPR). Apple states that it also transfers data on the basis of standard contractual clauses.

14. Retention and deletion

We keep account and coffee data for as long as your account exists. Workers logs are deleted after no more than 7 days. IP addresses in rate-limit records are deleted automatically, at the latest about one hour after your last request. We delete session data when you sign out or delete your account, and otherwise no later than about one hour after the session expires. A session expires one year after Beanify was last used on the device; this long lifetime is needed because for a guest account the session is the only key to your data.

You can delete your account in Beanify under Settings. This deletes your account and all associated data on our servers, including your profile photo and your brews. Values your brews already added to community averages stay in those averages; because the link to your brews is deleted with them, they can no longer be attributed to any account. At the same time we revoke Sign in with Apple and request deletion of your customer record at RevenueCat. Account-related data is removed from the app.

Deleted database content can still be restored through Cloudflare's recovery feature (D1 Time Travel) for up to 30 days. In addition, we back up the database every night, encrypted, to Cloudflare storage with EU jurisdiction in a separate Cloudflare account; the decryption key is kept offline. Each backup is locked against changes and deletion for 35 days and is then deleted automatically, so data of a deleted account can remain in a backup for up to 37 days. Profile photos are not backed up and are deleted permanently right away.

So that a restore cannot bring deleted accounts back, after you delete your account we keep only your account ID, for up to 40 days, in an erasure log. If a backup is ever restored, we automatically delete the deleted accounts it contains again within minutes. The legal basis is our obligation to make sure the erasure holds (Art. 6(1)(c) in conjunction with Art. 17 GDPR).

Deleting your account does not cancel an active App Store subscription. Records we are legally required to keep may be retained, restricted from other use, for the applicable period. For other options, see Delete account (in German).

15. Your rights

Where the legal requirements are met, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21), in particular to the community statistics, to logging and to the storage of IP addresses. You can withdraw any consent at any time. Contact info@polleydigital.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

Recommendations have no legal or similarly significant effect and are not automated decisions within the meaning of Art. 22 GDPR. There is no advertising, no sale of personal data and no cross-app tracking.

16. Changes

We update this policy when Beanify, our service providers or legal requirements change. The version published here applies.