Privacy Policy

CoffeeCherry operates beanote. This policy explains how we handle account and coffee-record information, user-created coffee-record links, required service data, images you separately choose to share for model improvement, and historical Community data—and how you can control those choices.

Effective date and last updated: July 17, 2026

1. Operator and Contact Information

CoffeeCherry is the data controller for beanote. You may use the contact information below to request access to, correction of, or deletion of personal information, restriction of processing, withdrawal of consent, or help with any other privacy question.

beanote Supportdeveloper@coffeecherry.coInclude the details of your request and the email address where you would like a response. Do not send your password or email verification code.

2. Information We Process and Why

Category	Information processed	Purpose
Account and authentication	Email address, authenticated user ID, and technical information about login method, login time, and session	Registration, email OTP login, account security, and prevention of misuse
Consent and policies	Required and optional consent items, policy version, time of consent, refusal or withdrawal, language, platform, and app version; and, where previously collected, a Community Posting Terms acceptance (`community-terms-v1`)	Recording and enforcing current consent choices, preventing service use before required acceptance, and retaining prior-version policy evidence where needed
Profile and settings	Nickname, profile image, language, theme, coffee equipment, and preference settings	Providing personalized records, recommendations, and screens
Coffee records	Beans, roasteries, cafés, brewing recipes, optional purchase and roast dates, ratings, notes, and times; and, only after an express share action, a random share-link identifier and pinned source-update version	Saving personal records; providing history, comparisons, and recommendations; creating a revocable, exact-link text preview only when you expressly request one; and, after you accept the current required agreements, validating official roastery or café profile links and an approved logo
Historical Community data and safety records	Where created under earlier versions: public nickname; post and reply text; up to four optional client-resized, EXIF/GPS-free JPEGs per item; image dimensions and storage metadata; post and parent identifiers; timestamps; deletion and moderation status; report reason and reporter; and blocked-user relationship	Responding to access or deletion requests, preserving required reply structure, safety, abuse-prevention, moderation, dispute, and legal evidence, and complying with legal obligations. Version 1.1 does not publish this data in a feed, management screen, or Community permalink preview.
Core photo analysis	A high-quality, EXIF/GPS-free JPEG copy created by the app's on-device canvas with a longest edge of no more than 4096px; raw OCR text and extracted fields; analysis candidates and confidence scores; and user corrections	Recognizing coffee information, conditionally completing missing fields through the paid Gemini service when needed, suggesting analysis results, and creating records
Images for model improvement (optional)	High-quality, EXIF/GPS-free JPEG copies of photos newly uploaded after optional consent, and records of that consent and its withdrawal	Improving the quality of beanote's recognition model and managing retention and deletion of contributed copies
Usage and diagnostics	Feature-use events, screen and session identifiers, access times, error and server-request logs, and device and browser information	Service operation, incident analysis, security, and aggregated usage statistics
Customer support	Email address, request details and attachments, and handling history	Reviewing and responding to requests and handling disputes and incidents

beanote does not provide personalized third-party advertising or sell personal information. New coffee records, photos, notes, and recipes are not automatically shared with other users. In the signed-in same-coffee comparison, beanote uses only coffee records belonging to the current signed-in account. It may show selected details from those records, such as a rating, date, place, note, or brew information, to help compare repeat experiences. It does not display record photos, Community averages, or data from other users, and comparison does not make any record public.

When a signed-in user expressly chooses Create share link for one coffee record, beanote creates an unlisted, random https://beanote.me/records/<share-id> address. Anyone with that exact address may view the coffee name, roaster, rating, calendar date, home-or-café context, place, brew method, coffee details, user note, and recipe without signing in. The page excludes the record photo, nickname, profile, account and source-record identifiers, matching data, groups, and all other records. It is marked no-index and no-store. Editing the source record expires the current address so later additions are not silently exposed; sharing again creates a new random address. Stopping sharing, deleting the record, or deleting the account removes beanote access to the address. beanote cannot recall a link already forwarded, a screenshot, a link-preview cache, or another copy made by a recipient. The source coffee-record table remains private and is not made anonymously readable.

Community is not available in version 1.1. Its Community tab displays only the noticeA better community is on the way.; it has no public feed, post or reply controls, post-management screen, or Community permalink preview. We do not use version 1.1 to republish Community content created under earlier versions. This notice is a compatibility explanation only and does not reveal prior posts or enable Community functions. Historical Community data may still be processed only for the purposes described in this policy, including retention, deletion, safety, dispute, and legal obligations.

beanote no longer offers general coffee logging on the web or a Community interface. Those routes lead to the installation guide or service home; they do not reopen the web app. This does not itself delete account data, coffee records, or historical Community data. The iOS App Store link is active. Android is shown as coming soon until Google Play public availability is verified, and no Play Store link is exposed before then. The web host continues to process APIs and app links and to provide the protected admin console, legal and support pages, data-deletion and account-deletion flows, and exact-link coffee-record previews.

Earlier Community versions could process up to four attachments per item. Before a past submission was accepted, the app redrew each selected image, removed EXIF and GPS metadata, limited the longest edge to 1,800px, and targeted each JPEG at 950KB or less; selected originals did not leave the device. The server accepted at most 1MB per image, re-encoded each JPEG without metadata, and sent only that sanitized copy to Google Cloud Vision for SafeSearch and OCR safety screening. Historical approved copies remain private while retained. Version 1.1 does not accept new Community attachments, publish them, or create Community preview URLs.

3. Core Photo Analysis

Before starting the app, you must separately review and expressly consent to the required core photo-analysis notice. Photo upload and analysis begin only after the server confirms that the required photo-analysis agreement is active.

Before upload, the app draws the selected photo onto an on-device canvas and re-encodes it as a high-quality JPEG copy whose longest edge is no more than 4096px.
Canvas encoding removes device-file metadata such as EXIF, GPS, and the filename. The file selected on your device itself is not uploaded.
beanote does not transmit, store, or use EXIF/GPS location information or use it to confirm café candidates.
The metadata-free, high-quality JPEG copy is processed by beanote servers and Google Cloud Vision, and the returned OCR text is analyzed by beanote servers to recognize coffee information.
Version 1.0.2 and requests without a verified 1.0.3-or-later capability remain Vision-only and never send a photo or OCR text to Gemini.
For version 1.0.3 or later, only after the current required photo-analysis notice has been expressly accepted and the server-side rollout gate is enabled, the paid Google Gemini service may be used when Vision OCR and beanote analysis cannot identify needed coffee fields sufficiently. When usable OCR evidence exists, only the minimum OCR text needed to fill missing fields is sent; the same sanitized JPEG copy and necessary OCR context are sent only for visual fallback signals such as failed or weak OCR.
Google LLC processes paid Gemini requests as beanote's processor. Paid-service inputs and outputs are not used to improve Google products. Limited provider security and abuse-monitoring records may be processed under Google's paid-service settings. Equipment, preference profiles, and account identifiers are not included in these requests.
On version 1.0.4 or later, only after you accept the current Privacy Policy and the server rollout gate is enabled, beanote may send the saved roastery or café name by itself to the paid Gemini service with grounded web search to propose official Instagram, Naver Store, Naver Place, and logo-source candidates. The request excludes your user ID, record ID, photos, notes, recipe, rating, timestamps, and device or GPS location.
Provider output is never treated as authoritative. beanote separately validates the direct destination, business identity, and availability; search-result or guessed URLs are not stored as verified links. Logo candidates remain private until a human reviewer confirms the exact bytes and content-rights evidence.
For each sanitized analysis-original JPEG copy and intermediate or derivative JPEG copy retained in private storage for OCR and analysis, deletion begins once 365 days have passed from creation. If you permanently delete your account, deletion of linked analysis copies begins sooner.
A JPEG copy displayed with a record is retained for as long as that coffee record is maintained. If you delete the record or permanently delete your account, deletion of the linked display copy begins.

4. Optional Consent for Model-Improvement Images

Providing images for model improvement is optional, independent of core photo analysis, and OFF by default. You may use beanote features, including core photo analysis, without consenting.

Once enabled, this preference remains ON until you turn it OFF or permanently delete your account. Each contributed copy is retained for no more than 365 days from creation.

Only for photos newly uploaded after you switch the setting ON, the same high-quality, EXIF/GPS-free JPEG copy used for core analysis may be used to improve beanote's recognition model.
A copy covered by active optional consent is retained exclusively in dedicated private Google Cloud Storage.
Deletion of a model-improvement copy in Google Cloud Storage begins 365 days after its creation. If you withdraw optional consent or permanently delete your account sooner, we schedule the copy for deletion before the 365-day period ends.
While the setting is OFF, no new model-improvement copy is contributed. If you switch from ON to OFF or withdraw consent, we schedule existing contributed copies for deletion and retry failed deletion jobs.
Even when optional consent is ON, EXIF/GPS and location information are not included in a model-improvement copy or separately transmitted, stored, or used.

Due to the nature of networks and provider operations, deletion may not finish immediately in a single attempt. beanote retries deletion jobs and verifies completion.

5. Retention and Deletion

Account and profile: until you permanently delete your account
Coffee records, recipes, ratings, notes, and JPEG copies displayed with records: until you delete the applicable record or permanently delete your account
Coffee-record share links: until you stop sharing, edit or delete the source record, or permanently delete your account; re-sharing creates a new random address, while copies already made by a recipient cannot be recalled
Historical Community posts, replies, and optional sanitized JPEG attachments: until the applicable item or account is deleted, subject to a lawful retention requirement. Deletion removes the content and linked attachment from beanote access, while a minimal de-identified structural record may remain only as needed for a deletion request, safety, moderation, abuse prevention, dispute, or legal obligation. Version 1.1 does not provide a Community public permalink preview. beanote cannot recall copies made by third parties before the pause.
Historical Community safety records: a prior block is deleted when it is undone or either account is deleted; a report submitted by an account is deleted with that reporting account; a report and moderation evidence about an already de-identified item may remain with its structural placeholder only until the related review, safety, dispute, or legal purpose ends or applicable law requires deletion or longer retention
Scan and usage events: until account deletion or until the applicable service-operation or security purpose ends
Required and optional consent records: until account deletion or until any retention requirement under applicable law ends
Sanitized analysis-original JPEG copies in private storage: up to 365 days from creation
Intermediate and derivative JPEG copies for OCR and analysis: up to 365 days from creation
High-quality JPEG copies for model improvement in Google Cloud Storage: up to 365 days from creation; deleted earlier if optional consent is withdrawn or the account is permanently deleted first
Customer-support records: for as long as needed to resolve the request and respond to disputes
User ID used for the final account-deletion check: until the final storage check is complete, at least 25 hours after the deletion request
De-linked asset ID used to prevent reuse in model improvement: for as long as needed to prevent a withdrawn copy from being included in a future dataset

When a retention period ends, we delete the information using methods designed to make recovery impracticable. If the law requires separate retention, only the required information is isolated for the statutory period and then deleted. Provider backups may remain isolated until they expire under each provider's regular overwrite and deletion cycle.

We begin deleting linked storage immediately after account deletion, then conduct a final check after 25 hours, once previously issued upload URLs have expired.

6. Service Providers and International Transfers

The providers below process information only as needed to provide the service. When you use a feature to which you expressly consented, information is transmitted over encrypted networks. You cannot begin using beanote until you accept the required agreements, including the Privacy Policy and core photo-analysis notice. Refusing model-improvement image consent does not affect service use. EXIF/GPS location information is never transferred.

Processor or recipient	Location and transfer	Information and purpose	Retention
Supabase, Inc.	United States (us-west-1); encrypted transfer when account or storage features are used	Storage and authentication involving account identifiers, email addresses, consent status, profiles, private records, historical Community data and safety evidence where retained, and high-quality EXIF/GPS-free analysis and derivative JPEG copies	Each applicable beanote retention period in Section 5 and the provider's backup-expiration cycle
Vercel, Inc.	United States and global infrastructure; encrypted transfer during native API, app-link, and public legal/support requests	Request and device technical information, historical service-request data where retained, and deployment, security, and error logs	Until service processing is complete and for the period needed for operational and security logs
Google LLC (Cloud Vision, Cloud Storage, paid Gemini API)	Republic of Korea, United States, and countries where Google infrastructure is located; encrypted transfer during historical Community-image safety processing, core photo analysis, official-profile discovery after you accept the required agreements, or retention of an optionally contributed copy	Where previously submitted, SafeSearch and OCR safety screening of a sanitized, server-re-encoded Community JPEG; Vision analysis of high-quality EXIF/GPS-free JPEG copies; conditional paid-Gemini processing of the minimum OCR text needed to fill missing coffee fields and, only if needed, the same sanitized JPEG copy; on version 1.0.4 or later and after you accept the current required agreements, processing of a saved roastery or café name alone to propose public official-link and logo-source candidates; private retention of high-quality JPEG copies covered by optional model-improvement consent	Historical Community-moderation JPEGs were processed for the pre-publication screening request under Google Cloud service settings. Paid Gemini inputs and outputs are not used to improve Google products and are processed for service delivery and the limited period required by applicable security and abuse-monitoring settings. Analysis and model-improvement copies retained by beanote are each kept for up to 365 days from creation; if optional consent is withdrawn or the account is permanently deleted first, the applicable model-improvement copy is deleted earlier.

7. Your Rights and Consent Management

You may exercise the following rights through the profile and records screens in the app or through customer support.

Accessing and correcting your information and deleting individual records
Requesting access to, correction of, or deletion of historical Community data through customer support or account deletion, subject to applicable retention requirements
Switching optional model-improvement image consent OFF or withdrawing it
Withdrawing a required agreement and requesting termination of service use
Requesting deletion of your entire account in the app or on the web account deletion page
Requesting restriction or deletion of personal-information processing and receiving the outcome of your request

Refusing or withdrawing optional model-improvement image consent does not prevent you from continuing to use core photo analysis or other features. After withdrawal, optional processing does not apply to later uploads, and we schedule existing contributed copies for deletion. If you withdraw a required agreement, you must stop using the service, but customer support and the account deletion page remain available.

To protect your account and personal information, we may require identity verification such as an email OTP. After account deletion is complete, you cannot log in and related records cannot be recovered.

Version 1.1 has no public Community view, interaction controls, management screen, or Community permalink preview. A historic deletion request removes the applicable content and attachment from beanote access when deletion is required; a minimal de-identified structural record may remain only for the purposes in Section 5. beanote cannot recall copies made outside beanote before the pause. Historical report or moderation matters may be raised with customer support.

8. Security Measures

We apply reasonable technical and administrative safeguards, including canvas re-encoding and metadata removal before upload, encryption in transit, private image storage and short-lived signed URLs, least-privilege access, restricted administrator access, content filtering, protection and deletion of historical Community data and related safety evidence, retry and verification of deletion jobs, and server-only storage of secrets.

9. Users Under 18

beanote is not directed to anyone under 18, and anyone under 18 may not register or use the service. If you learn that information about a user under 18 has been processed, please notify customer support.

10. Changes to This Policy

We will provide notice in the app or on this page before material changes, such as changes to information processed or service providers, take effect. A material change requiring consent will apply only after you review the changed item and expressly agree again. You may request a previous version from customer support.