Privacy Policy

1. Who We Are

Espresso of Interest is operated by LogoLess Labs. This policy explains how we collect, use, and protect your personal data in compliance with the Australian Privacy Act 1988, the EU General Data Protection Regulation (GDPR), and the UK GDPR.

2. What We Collect

We do not collect your location, contacts or browsing history. Beyond what you enter into the app, we keep only the campaign tags above and the analytics described under Cookies.

The app asks for your camera and photos only when you choose to photograph a bag or a cafe visit. Photos are resized and saved again on your phone before they are uploaded, which leaves out the location and camera details stored inside the original picture.

3. How We Use Your Data

For your account (Contract basis)

Your individual data powers your personal dashboard — shot history, bean shelf, AI recommendations, cafe visit log. This data is only visible to you when you are logged in, unless you choose to share a shot.

Shots you share: sharing a shot makes a public link. Anyone with the link can see that shot: the bean and roaster, the recipe, your rating, the grinder, flavours, AI score and your notes on it. Your name and email are not shown.

Photos: the photos you add in the app are stored with our storage provider at a long, random web address. We only show them to you, but anyone who has that exact address can open the image.

For aggregated community insights (Legitimate interest)

We combine data from all users into anonymised aggregates that appear on our public content website. For example:

• Average rating for a bean across all users who logged it
• Most common drink type for a bean (e.g. "65% flat white")
• Average extraction parameters (dose, yield, time) for a bean
• Popular beans at a cafe based on user visit reports
• Flavour profiles aggregated across multiple users' tasting notes

Privacy safeguards for aggregated data:

• Aggregates are only published when at least 5 data points exist
• No individual usernames, shots, or timestamps are ever shown
• No individual ratings or reviews are published — only averages
• Data is combined in a way that prevents identification of any individual

For marketing (Consent basis — opt-in only)

If you opt in, we may send you emails about new features, newly added roasters and beans, brewing tips, and early access to beta features. You can withdraw your consent at any time from your account settings or by clicking unsubscribe in any email. We will never sell your email to third parties.

4. AI Processing

Three features send data to a third-party AI provider (currently via OpenRouter, which passes it to the model's maker):

• Shot analysis: your shot parameters (dose, yield, time, grind setting, rating, flavour notes), your grinder, and the bean's recommended recipe.
• AI barista chat: the messages you type, and the details the assistant looks up from your account to answer them (such as your shots, shelf, dial-ins and equipment).
• Bag label scan: the label photo you take, so the AI can read it. We do not keep that photo unless you also add it to the bag.

We do not send your name or email to AI providers, and the assistant is told not to ask for them; anything you type into the chat is sent as you wrote it. AI responses and your chat history are stored in our database for your reference.

In the iPhone and Android app, nothing is sent to an AI provider until you allow it: the app asks the first time you use one of these features, and saves your answer on your account. You can withdraw it at any time in the app under More, Settings, AI features; the three features then stop sending anything and ask again before the next use.

5. Data Sharing

We share your data with:

• AI providers (via OpenRouter): the data listed in section 4, for shot analysis, the AI barista chat and the bag label scan. Never your name or email
• Our hosting provider (Railway) — Infrastructure only, they process data on our behalf under a data processing agreement
• Our photo storage provider (Cloudflare): stores the photos you add in the app
• Push notification services (Expo, which passes notifications to Apple or Google for delivery): your phone's push token and the reminder text, only if you turn on reminders in the app
• Our email provider (Resend): your email address, to send account emails
• The public — Only anonymised aggregates as described in Section 3, never individual data

We do not sell personal data to any third party. We do not share individual user data with roasters, cafes, or any commercial partner.

6. Data Retention

We retain your account data for as long as your account is active. You can delete your account yourself at any time:

• In the app: More, then Settings, then Delete account
• On the web: Settings, then Danger Zone, then Delete account

Either way you confirm with your password. We then delete your account and its data immediately, and in every case within 30 days: shots, bags, cafe visits, chat history, dial-ins, devices, notification tokens and the photos you added. Beans and equipment you added to the shared catalogue stay, without your name on them. Cafe or roaster claim forms you sent us are kept as business records; email us if you want them removed too.

Anonymised aggregate data that has already been computed may persist as it cannot be linked back to you.

7. Your Rights

Under GDPR and the Australian Privacy Act, you have the right to:

• Access — Request a copy of all data we hold about you
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your account and data
• Portability — Receive your data in a structured, machine-readable format
• Object — Object to processing based on legitimate interest (aggregation)
• Withdraw consent: withdraw marketing consent, or consent to AI processing in the app, at any time

You can delete your account and data yourself, in the app or on the web (see Data Retention). To exercise any of these rights, email [email protected]

8. Security

Passwords are hashed with bcrypt (12 rounds). All data is transmitted over HTTPS. Database access is restricted to our application services. We do not store payment information (the Service is currently free).

9. Cookies

• Session: keeps you signed in.
• First visit (eoi_ft): if you arrive through a link with campaign tags (utm_source and similar), we keep those tags and the page you landed on for 30 days, and save them to your account if you sign up in that time. It holds no name, email or other personal details, and it is not set when a link has no tags.
• Google Analytics: counts visits and shows which pages are used. It sets its own cookies (named _ga).

We do not use third-party advertising cookies.

The mobile app does not use cookies. It keeps your sign-in in your phone's secure storage (the iOS Keychain or Android Keystore). Notifications are off until you turn them on, and you can turn them off again in Settings or in your phone's settings.

10. Children

The Service is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes

We may update this policy from time to time. Material changes will be communicated via email or in-app notice. The "Last updated" date at the top indicates the most recent revision.

12. Contact

For privacy questions or data requests: [email protected]