Legal
Privacy Policy
Effective: August 15, 2026 (beta)
Arosti is a personal coffee discovery app. This policy explains what data Arosti handles, where it lives, and what control you have. It is written to be read, not skimmed past.
The short version
- Your coffee journal (ratings, favorites, notes, scans) belongs to you.
- Scan photos are used to identify coffees and to make Arosti’s shared coffee catalog better — including as curated product imagery other users may see. Photos are never attributed to you, and nothing personal is ever shown to other users.
- If you sign in, your journal — scan photos included — syncs to your private account space so it survives your phone. Nobody else can read it — including other users.
- You can delete everything, instantly, from inside the app.
- We don’t sell your personal data, show ads, or share your journal with anyone. We may share or sell aggregated, de‑identified insights with partners — never anything that identifies you (see “Aggregated insights and partners” below).
What Arosti collects
Account. An email address and password, only if you choose to sign in. You can use Arosti without an account; everything then stays on your device only.
Your coffee journal. Ratings, reaction tags, notes, favorites, want‑to‑try saves, brewing preferences, coffees you add, and scan records (what was identified, when, and any place or price you attach).
Scan photos. Photos you take in the scan flow are stored with your scans and transmitted for identification. We may keep and use scan photos as described in “Scan photos and the shared catalog” below.
Location. Only if you grant permission, and always coarse. Arosti uses your position two ways: in the moment, to suggest a place name when you ask; and at each scan, to record a coarse region — your county‑level area, like the San Francisco metro — as part of the scan. Precise coordinates are never stored: they are used for the lookup and immediately discarded. Your region keeps recommendations relevant to where you shop (Discover skips coffees known to be unavailable near you) and can contribute to the aggregated, de‑identified regional insights described below. Denying location never blocks anything — you simply get unfiltered recommendations.
Taste model. Arosti computes what you tend to like from your ratings, on your device. It is part of your journal and is deleted with it.
Feedback you send. If you use Send Feedback, we receive your message, the category you pick, and basic device context — app version, device model, and OS version — so we can reproduce issues. Feedback never includes your journal contents, goes only to us, is never shown to other users, and is deleted with your account.
Where your data lives
On your device first. If you sign in, your journal is mirrored to your private space in our database, protected by row‑level security: every request is checked against your identity, and no user can read another user’s rows. Scan photos are mirrored the same way, to private storage only you can access, so they follow you to a new device.
Scan photos and the shared catalog
Arosti’s coffee catalog gets better because people scan coffees. By using the scan feature, you grant Arosti a perpetual, royalty‑free license to use photos you take in the scan flow to operate and improve the product, including:
- identifying your coffee (that’s what a scan is);
- improving recognition, including reviewing photos from failed or incorrect identifications;
- building the shared catalog: product imagery derived from scan photos — a cropped shot of a coffee bag, for example — may be shown to other users as a coffee’s picture.
Two promises bound that license. Anything shown to other users is curated product imagery only — packaging, never people, places, or anything personal that a photo happens to catch. And photos are never attributed to you: nothing shown to anyone links back to your account or identity. Because catalog imagery is unattributed, product images derived from your scans may remain in the catalog after you delete your account; everything linked to you is still deleted as described below.
Photos aren’t the only way scans improve the catalog. A scan can also observe simple facts about the coffee world — that a coffee exists, where it’s sold, and at what price — and those facts may inform the shared catalog, including its availability and price knowledge. Like catalog imagery, these facts are never attributed to you.
Aggregated insights and partners
Arosti may compile statistics and trends from users’ taste data — for example, regional flavor preferences, or how a coffee’s ratings trend over time — and share or sell these insights to partners such as roasters and retailers, whether bundled into a partnership fee or sold as a standalone data product.
These insights are always aggregated across many users and de‑identified: no individual rating, journal entry, taste profile, or preference set is ever included, sold, or reconstructable, and no partner receives anything that identifies you or any other user. This is separate from, and does not change, the promise below that we never sell or share your personal data.
Because aggregated insights don’t identify you, deleting your account does not retroactively remove your past contribution to insights already compiled — the same principle that already covers catalog imagery above.
Services we rely on
- Supabase hosts our database, sign‑in, and server functions.
- AI providers. Arosti uses third‑party AI services to read coffee labels and evaluate taste evidence. Reduced scan photos and label text pass through these services for processing. We require that any AI provider we use not use your data to train their models.
- Crash and usage reporting (beta): during the beta we may collect crash reports (via Sentry) and usage events such as “first scan completed” (via PostHog) to find bugs and understand where the app loses people. These never include your journal contents or photos — no coffee names, no ratings, no notes, no images. If you are signed in, these events are linked to your account so we can tell whether a problem hit one person or everyone. We send an internal account identifier, never your email address. If you have not signed in, they stay unlinked — recorded against this installation only, with nothing tying them to you. Signing out returns you to that unlinked state.
What we never do
- Sell or share your personal data.
- Show your ratings, notes, or identity to other users.
- Attribute any photo or catalog image to you.
- Let commercial incentives alter your personal match scores. If Arosti ever shows sponsored content, it will be clearly labeled.
Your controls
- Reset local data (Profile → Privacy & Data) wipes this device.
- Delete Account & Data permanently deletes your account and everything synced to it from our servers, immediately. There is no retention window and no undo.
- Location permission can be revoked any time in iOS Settings.
Children
Arosti is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially, the app will tell you before the change applies to you. The effective date above always reflects the current version.
Contact
Questions or requests: mwilson1@gmail.com.