Tasting Note ("the App") is an espresso shot tracking app developed by Chrome Ritual LLC ("we," "us"). This policy explains exactly what the App does with your data, what it sends elsewhere, and what it never touches.

The short version

• Your data stays on your device by default. When it leaves, it's only to improve features and give you better coffee insights — and you control when that happens.
• We do not sell, share, or disclose your data for advertising or marketing purposes.
• Analytics are on if you turn it on, and you can turn it off and delete the data any time.
• When you tap an AI button, the text you're working on is sent out to the AI model provider for processing.

Data controller

Chrome Ritual LLC is the data controller for personal data processed through the App. For privacy questions, contact contact@tasting-note.com.

1. What stays on your device

The App stores your data locally on your device by default. If you opt in to analytics, numerical shot values (such as dose, yield, time, and grind setting) are sent as isolated data points to help improve recipes and insights for all users. Your photos, the text of your notes, equipment and roaster names, and any identifying information never leave your device.

If your device uses iCloud or local backups, on-device data may be included in those backups. Device backups, transfers, and syncs are governed by Apple's privacy policy, not ours.

2. Analytics (off by default, opt-in only)

The App can send pseudonymous usage data to Google Firebase Analytics to help us understand which features people use and build better recipes. This is entirely optional.

Your choice

• Analytics is disabled by default.
• After onboarding, you'll see a screen with two equal buttons: "Participate in making better recipes for everyone" and "No, I don't want to participate." Either choice is fine — the App works exactly the same way.
• You can change your mind any time in Settings → Privacy.
• That same screen has a "Delete my analytics data" button that wipes the data tied to your install and turns collection off.

What's collected if you opt in

• Usage events: creating, editing, and deleting shots/bags/equipment; AI parse and recipe calls (success or failure); feature taps; view modes
• Numeric shot values: dose, yield, time, temperature, grind size, rating
• For your notes (tasting, bag, equipment): only whether a note exists, how long it is, and which flavor words match a fixed word list. The text itself is never sent.
• For names you type (custom equipment, bag, roaster names): only whether one exists and how long it is, plus an opaque per-install code so events can be linked together. The actual names are never sent.
• App version, iOS version bucket (e.g. "iOS 18"), device type ("iPhone" / "iPad")
• App settings, such as list view mode, background style, temperature unit, grid columns, insight panel state, orb color mode, and trend display preferences

What analytics never collects

• Your name, email, or phone number
• Your Apple ID, IDFA, or any advertising identifier
• Location, contacts, or calendar
• The raw text of any note
• Your photos
• The literal text of any name you type (only its presence, length, and an opaque code)

Identifier

Firebase assigns an auto-generated app instance ID. It is pseudonymous and is not linked to your Apple ID, email, name, or any advertising identifier. Because the App does no cross-app tracking, no App Tracking Transparency prompt is shown.

Where it goes and how long it's kept

Analytics data is processed on Google's US-based infrastructure under Google's data processing terms, and is retained for 2 months — the shortest period Firebase allows.

3. AI features

The App has two AI features: shot parsing (turning a typed description into structured shot data) and recipe suggestions (proposing brewing parameters from context you provide). Both run only when you tap the button for them.

How it works

• The text you submit goes from the App to a Cloudflare Worker that we operate.
• The Worker forwards it to a third-party AI provider for processing.
• The provider processes it and returns a result, which comes back to your device.

The Worker holds the API key so it never has to live inside the App. The Worker does not log the text content of your requests or responses. Infrastructure metadata is retained by Cloudflare under their standard retention periods and data processing terms.

What's sent

Only the specific text you invoke the AI on — the shot description you ask it to parse, or the brewing context you ask it for a recipe on.

What's never sent

• Anything you didn't explicitly run an AI feature on
• Any account info, device identifier, app instance ID, name, email, location, or photo

AI provider handling

Third-party AI providers process submitted text under their own data usage policies. We select providers whose terms do not use API submissions to train their models by default. Providers may retain submissions briefly for abuse monitoring per their own policies.

4. The website (tasting-note.com)

The website is a static site hosted on Cloudflare Pages with no analytics or tracking installed. It does not set cookies or trackers.

5. Sub-processors

The following third parties process data on our behalf when you use the corresponding features. Processing is governed by each provider's standard data processing terms.

• Google Firebase Analytics — pseudonymous usage data, if you opt in
• Third-party AI providers — text content of AI requests
• Cloudflare — hosts the Worker that routes AI requests and the website; retains standard infrastructure metadata

6. Your rights under GDPR (EU/EEA users)

Legal bases:

• Analytics — your explicit consent (GDPR Article 6(1)(a)). You give it on the consent screen and can withdraw it any time in Settings → Privacy.
• AI features — your explicit consent (GDPR Article 6(1)(a)). Each use is initiated by you; you consent to sending that specific text by tapping the button. You can choose not to use AI features at any time.

Your rights: access, rectification, deletion, portability, restriction of processing, and objection. You also have the right to lodge a complaint with your local data protection supervisory authority.

A practical note on deletion: for analytics data, the in-app "Delete my analytics data" button in Settings → Privacy is the only way to delete it. Emailing us cannot accomplish this, because no identifier is stored that maps analytics data back to you as a person — we have no way to find "your" data from an email address. This is a real limit of how the App is built, stated plainly rather than worked around. For on-device data, you delete it by deleting entries or the App itself.

7. California privacy rights (CCPA)

California users have the right to know what personal information is collected, to request its deletion, and to opt out of any sale of personal information.

We do not sell, share, or disclose personal data for advertising or marketing purposes.

The categories collected and how to delete them are described in the sections above. The same analytics deletion mechanism described in section 6 applies here.

8. Data retention

• On-device data — kept until you delete it (by removing entries or deleting the App).
• Analytics — 2 months in Firebase, then deleted automatically.
• AI submissions — the Worker does not retain request content. Infrastructure metadata is retained by Cloudflare under their standard retention periods. AI providers may retain submissions briefly per their own policies.

9. International data transfers

Analytics data is processed on Google's US-based servers. AI providers may also process data on US-based infrastructure. Where required, these transfers rely on Standard Contractual Clauses or equivalent safeguards offered by the respective providers.

10. Children

The App is not directed at children under 13 (or under 16 in jurisdictions where a higher age applies) and does not knowingly collect data from children.

11. Data breach notification

In the event of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.

12. Changes to this policy

We may update this policy as the App evolves. The "Last updated" date above reflects the current version. Material changes will be communicated within the App.

Contact

For privacy questions: contact@tasting-note.com