Privacy Policy

1. Who We Are

Shotbook is a craft coffee journaling app developed and operated by Michael Timofeev.

Website: theshotbook.app
Contact: [email protected]

2. Data We Collect

In the app - brew data. All brew data you enter (recipes, ratings, notes, photos) is stored exclusively on your device using local storage. We do not transmit, sync, or have access to your brew journal in any way.

In the app - anonymous coffee data (opt-in, from app version 1.2.1). If you enable "Share coffee data anonymously" in the settings (disabled by default), the app transmits the following to our community database whenever you save a coffee:

• Coffee metadata - roaster, coffee name, origin, process, roast level, variety, roast date, bag size.
• Aggregated ratings - your average rating and number of brews for that coffee, plus flavour tags.
• Random install ID - a randomly generated identifier with no connection to your person, used to merge repeat submissions from the same install.

Never transmitted: notes, photos, name, email address, location, or any other personal data. The transmitted data cannot be traced back to you. You can disable sharing at any time in the settings; no further data is sent from then on.

In the app and on the website - email address. If you voluntarily submit your email address - either via the waitlist form on our website or via the Pro signup screen in the app - we collect:

• Email address - to notify you when Shotbook Pro launches and to send relevant product updates.
• Submission timestamp - for internal record-keeping.
• Source field - which page or screen you submitted from (e.g. "website", "in-app").

We do not collect your name, payment information, device identifiers, or browsing behaviour.

3. How We Use Your Data

We use email addresses collected via the waitlist and in-app Pro signup solely to:

• Notify you when Shotbook Pro becomes available.
• Send occasional product announcements directly related to Shotbook (e.g. major new features, iOS launch).
• Respond to support requests you initiate by emailing us.

We will never sell, rent, or share your email address with third parties for marketing purposes.

Anonymous coffee data (see Section 2) is used solely to build a community database of coffees and roasters - for example for autofill suggestions and aggregated community ratings in future app versions.

4. Data Storage & Security

Waitlist email addresses and anonymous coffee data (opt-in) are stored in Supabase - a GDPR-compliant database platform hosted in the EU (AWS eu-central-1 region). Supabase applies industry-standard encryption at rest and in transit (TLS/HTTPS).

Access to the database is restricted by Supabase Row Level Security policies. Only the app developer has administrative access.

5. Data Retention

We retain waitlist email addresses until:

• You request deletion (see Section 7), or
• 12 months after Shotbook Pro has launched and the waitlist is no longer active.

Brew data in the app is retained on your device until you delete the app or clear its data. We have no access to it and cannot delete it remotely.

Anonymous coffee data is retained indefinitely as part of the community database. Since it cannot be attributed to any person, it does not constitute personal data under the GDPR. On request we will nevertheless delete your install's submissions: send us your install ID (visible in the app settings by tapping the version line) at [email protected]. Full deletion instructions: theshotbook.app/delete-data.

6. Third-Party Services

We use the following services:

• Supabase (privacy policy) - database for waitlist emails, feedback messages, and the anonymous community coffee database.
• Cloudflare (privacy policy) - website hosting and CDN. Cloudflare may log IP addresses for security purposes as per their standard terms.
• Google Play (privacy policy) - app distribution. Google collects crash reports and aggregate install statistics as described in their developer policy.

We do not use analytics trackers, advertising networks, or social media pixels on our website.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation:

• Right to access - request a copy of the personal data we hold about you.
• Right to rectification - request correction of inaccurate data.
• Right to erasure - request deletion of your data ("right to be forgotten").
• Right to restriction - request that we restrict processing of your data.
• Right to object - object to processing of your data for direct marketing.
• Right to data portability - receive your data in a structured, machine-readable format.

To exercise any of these rights, email [email protected] with the subject "Privacy Request". We will respond within 30 days.

8. Children's Privacy

Shotbook is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted their email via our waitlist, please contact us immediately and we will delete it.

9. Google Play - Data Safety Declaration

In line with Google Play's data safety requirements, here is a summary of data practices for the Shotbook Android app:

• Data collected: Email address (optional - collected via the website waitlist form or the in-app Pro signup screen); anonymous coffee data with a random install ID (optional - only when the "Share coffee data anonymously" opt-in is enabled).
• Data shared: None. We do not share personal data with third parties.
• Security practices: Data is encrypted in transit.
• Data deletion: Users can request deletion by emailing [email protected] (for anonymous coffee data, include your install ID).
• In-app data: All brew data is stored locally on-device and only transmitted as anonymous coffee data when the opt-in is enabled.

10. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify waitlist subscribers by email. Continued use of the app or website after changes constitutes acceptance of the updated policy.

11. Legal Basis for Processing (GDPR)

We process your email address on the legal basis of consent (Art. 6(1)(a) GDPR) - you voluntarily submit your email to join the waitlist. You may withdraw consent at any time by emailing us to be removed.

Anonymous coffee data is only transmitted after your active consent via the opt-in toggle in the settings. Since this data is anonymous, it falls outside the scope of the GDPR; you can disable the toggle at any time.