Legal
Privacy Policy
Effective: September 28, 2026 (beta)
Arosti is a personal coffee discovery app. This policy explains what data Arosti handles, where it lives, and what control you have. It is written to be read, not skimmed past.
The short version
- Your coffee journal (ratings, favorites, notes, scans) belongs to you.
- Scan photos are used to identify coffees and to make Arosti’s shared coffee catalog better — including as curated product imagery other users may see. Photos are never attributed to you, and nothing personal is ever shown to other users.
- If you sign in, your journal — scan photos included — syncs to your private account space so it survives your phone. Nobody else can read it — including other users.
- You can delete everything, instantly, from inside the app.
- We don’t sell your personal data, show ads, or share your journal with anyone. We may share or sell aggregated, de‑identified insights with partners — never anything that identifies you (see “Aggregated insights and partners” below).
What Arosti collects
Account. An email address and password, only if you choose to sign in. You can use Arosti without an account; everything then stays on your device only. We use your email address to run your account — verifying it and resetting your password — and to send you one welcome email after you create an account, with tips for getting started; reply to it to reach us. We don’t add you to a mailing list or send you marketing email.
Your coffee journal. Ratings, reaction tags, notes, favorites, want‑to‑try saves, brewing preferences, coffees you add, and scan records (what was identified, when, and any place or price you attach).
Scan photos. Photos you take in the scan flow are stored with your scans and transmitted for identification. We may keep and use scan photos as described in “Scan photos and the shared catalog” below.
Location. Only if you grant permission. Arosti uses your position in the moment — when you save a scan, to suggest where you found the coffee, and to show you and nearby cafés on the map and on Discover (the distances are worked out on your phone and never sent anywhere) — and stores only a coarse region at each scan: your county‑level area, like the San Francisco metro. When you save a scan, and again once the coffee is identified, your coordinates at that moment are sent through our server to Apple Maps to find businesses near you — the second time together with the roaster’s name, to find the roaster’s own café; Apple Maps answers those lookups, receives no account information, and the coordinates are then discarded. Arosti also checks its own list of roaster-owned cafés on your device. When you search for a place on the map, your search text and the map area you are looking at are sent through our server to Apple Maps for that lookup, and only the store you choose is saved, by name and street address. The suggested store names (never coordinates) stay on your device until you set a place or delete the scan, and are never uploaded. If one store is unmistakably where you are, Arosti fills it in and says so on the scan; you can change it any time, and whether you accept, tap, or type a store, only its name and street address are saved to your scan — never coordinates. When you choose a photo from your library instead of using the camera, Arosti reads the location saved in the photo’s own metadata, if it has any, and uses it the same way — where the photo was taken, not where you are now. Asking for stores near you now sends your current position for that one lookup in the same way. Precise coordinates are never stored: they are used for the lookup or the map view and immediately discarded. Your region keeps recommendations relevant to where you shop (Discover skips coffees known to be unavailable near you) and can contribute to the aggregated, de‑identified regional insights described below. Denying location never blocks anything — you simply get unfiltered recommendations.
Taste model. Arosti computes what you tend to like from your ratings, on your device. It is part of your journal and is deleted with it.
Feedback you send. If you use Send Feedback, we receive your message, the category you pick, and basic device context — app version, device model, and OS version — so we can reproduce issues. Feedback never includes your journal contents, goes only to us, is never shown to other users, and is deleted with your account.
Where your data lives
On your device first. If you sign in, your journal is mirrored to your private space in our database, protected by row‑level security: every request is checked against your identity, and no user can read another user’s rows. Scan photos are mirrored the same way, to private storage only you can access, so they follow you to a new device.
Scan photos and the shared catalog
Arosti’s coffee catalog gets better because people scan coffees. By using the scan feature, you grant Arosti a perpetual, royalty‑free license to use photos you take in the scan flow to operate and improve the product, including:
- identifying your coffee (that’s what a scan is);
- improving recognition, including reviewing photos from failed or incorrect identifications;
- building the shared catalog: product imagery derived from scan photos — a cropped shot of a coffee bag, for example — may be shown to other users as a coffee’s picture.
Two promises bound that license. Anything shown to other users is curated product imagery only — packaging, never people, places, or anything personal that a photo happens to catch. And photos are never attributed to you: nothing shown to anyone links back to your account or identity. Because catalog imagery is unattributed, product images derived from your scans may remain in the catalog after you delete your account; everything linked to you is still deleted as described below.
Photos aren’t the only way scans improve the catalog. A scan can also observe simple facts about the coffee world — that a coffee exists, where it’s sold, and at what price — and those facts may inform the shared catalog, including its availability and price knowledge. Like catalog imagery, these facts are never attributed to you.
Aggregated insights and partners
Arosti may compile statistics and trends from users’ taste data — for example, regional flavor preferences, or how a coffee’s ratings trend over time — and share or sell these insights to partners such as roasters and retailers, whether bundled into a partnership fee or sold as a standalone data product.
These insights are always aggregated across many users and de‑identified: no individual rating, journal entry, taste profile, or preference set is ever included, sold, or reconstructable, and no partner receives anything that identifies you or any other user. This is separate from, and does not change, the promise below that we never sell or share your personal data.
Because aggregated insights don’t identify you, deleting your account does not retroactively remove your past contribution to insights already compiled — the same principle that already covers catalog imagery above.
Services we rely on
- Supabase hosts our database, sign‑in, and server functions.
- Resend delivers the email we send you — verification, password resets, and the welcome email. It receives your address and the message, never anything from your journal.
- Apple Maps answers nearby‑place lookups when you save a scan (and when you ask for stores near you now). It receives coordinates for the one lookup — never your identity or anything from your journal.
- AI providers. Arosti uses third‑party AI services to read coffee labels and evaluate taste evidence. Reduced scan photos and label text pass through these services for processing. We require that any AI provider we use not use your data to train their models.
- Crash and usage reporting (beta): during the beta we may collect crash reports (via Sentry) and usage events such as “first scan completed” (via PostHog) to find bugs and understand where the app loses people. These never include your journal contents or photos — no coffee names, no ratings, no notes, no images. If you are signed in, these events are linked to your account so we can tell whether a problem hit one person or everyone. We send an internal account identifier, never your email address. If you have not signed in, they stay unlinked — recorded against this installation only, with nothing tying them to you. Signing out returns you to that unlinked state.
What we never do
- Sell or share your personal data.
- Show your ratings, notes, or identity to other users.
- Attribute any photo or catalog image to you.
- Let commercial incentives alter your personal match scores. If Arosti ever shows sponsored content, it will be clearly labeled.
Your controls
- Delete My Coffee Data (Profile → Privacy & Data) deletes your ratings, favorites, scans, custom coffees, and brewing preferences from your account and every signed-in device. Your account itself stays. Signed out, the same control clears only this device.
- Delete Account & Data permanently deletes your account and everything synced to it from our servers, immediately. There is no retention window and no undo.
- Location permission can be revoked any time in iOS Settings.
Children
Arosti is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially, the app will tell you before the change applies to you. The effective date above always reflects the current version.
Contact
Questions or requests: [email protected].