Coffeetip
Polski Home

Privacy policy

Last updated: 8 October 2026

1. Who is the data controller?

The controller of personal data of users of the Coffeetip app and related sites is Mood Products (the “Controller”).

For questions about personal data protection, contact us at:

2. Which services does this policy cover?

This policy covers:

The app recognizes coffee from label photos and lets you manage favorites and a wishlist.

3. What data do we collect?

Depending on how you use the service, we may process:

3.1. Account data

  • email address,
  • first and last name (optional),
  • password (stored only as a cryptographic hash),
  • the dates the account was created, the email address was confirmed, and the profile was last updated.

3.2. Data from using the app

  • coffee label photos sent for recognition,
  • identifiers of coffees added to favorites or the wishlist,
  • session tokens (for example an access token and a refresh token),
  • basic technical data needed to run the service (for example IP address, HTTP request headers, server error information).

3.3. Data we do not collect on purpose

  • we do not show ads and we do not use advertising tools,
  • we do not collect GPS location,
  • we do not collect contacts from the device address book,
  • we do not run public social profiles inside the app.

4. Why we process data, and the legal basis

Purpose Data Legal basis (GDPR)
Registration and running the account email, password, first name, last name Art. 6(1)(b) — contract
Sign-in and account security login data, session tokens Art. 6(1)(b) and (f) — legitimate interest
Email confirmation and password reset email, one-time tokens Art. 6(1)(b)
Recognizing coffee from a label photo label photo Art. 6(1)(b)
Favorites and wishlist links between the account and products Art. 6(1)(b)
Contact and support requests data you include in correspondence Art. 6(1)(f) — legitimate interest
Security and stability of the service technical logs Art. 6(1)(f) — legitimate interest

5. Label photos — how we process them

When you photograph a label in the app, the image is sent to our server so we can recognize the coffee. The photo is processed in real time: we read the text on the label and match a product in the Coffeetip database.

We do not store users' label photos permanently after recognition finishes. Text fragments read from the label may be processed temporarily by the AI services described in section 6.

6. Who we share data with

Data may be entrusted to providers that help us run the service, only to the extent needed for the purposes above:

  • OpenAI — processing label photos and text to recognize a product (AI models). Data may be transferred outside the European Economic Area, including to the United States, under an appropriate transfer mechanism (for example standard contractual clauses).
  • Brevo (formerly Sendinblue) — sending transactional email (registration confirmation, password reset).
  • Gravatar — the mobile app may fetch a profile avatar from a hash of your email address. The request goes directly from the device to Gravatar (Automattic).
  • Hosting providers — servers, the database, and backups (including cloud services in the EU).

We do not sell personal data to third parties. We do not share it for marketing.

7. Transfers outside the EEA

We use providers established outside the European Economic Area, in particular OpenAI (USA). Where that happens, we use the safeguards required by law, such as standard contractual clauses approved by the European Commission or another permitted transfer mechanism.

8. How long we keep data

  • Account data — until you delete the account, or until a valid objection where the legal basis is legitimate interest.
  • Session tokens — for the session, or until the token expires (access token: a short period; refresh token: up to 7 days).
  • Email confirmation and password-reset tokens — until they are used or expire (usually up to 24 hours for email confirmation, less for a password reset).
  • Label photos — only for the time it takes to process the recognition request; they are not stored permanently.
  • Technical logs — for as long as needed for security and diagnostics, usually up to 90 days, unless the law requires longer.

9. Your rights

You have the following rights regarding your personal data:

  • the right of access,
  • the right to rectification,
  • the right to erasure (“right to be forgotten”),
  • the right to restriction of processing,
  • the right to data portability,
  • the right to object to processing,
  • the right to withdraw consent where processing is based on consent (it is not, in the other cases),
  • the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

To use these rights, email coffeetip.su@gmail.com or follow the instructions on the data and account deletion page.

10. Data security

We use technical and organizational measures appropriate to the risk, including encrypted transport (HTTPS/TLS), password hashing, and limited access to production systems. No system can guarantee absolute security — please use a strong, unique password.

11. Device permissions

The mobile app asks for camera access only so you can photograph a coffee label. You can refuse. Recognition from the camera will then be unavailable.

12. Children

The service is not directed at children under 16. We do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it promptly.

13. Cookies and similar technologies

app.coffeetip.cafe may use cookies that are required to keep you signed in and to keep the session secure. https://coffeetip.cafe/en/ does not use analytics or advertising tools that track visitors. It may store a lang cookie (pl or en) so it can remember the language you chose and skip the redirect on the next visit. That cookie is not used for tracking.

14. Changes to this policy

We may update this policy when the app, the law, or the way we process data changes. We will tell you about material changes in the app or on the website. The date at the top of this document is the date of the latest update.

15. Contact

For privacy and personal-data questions: