Privacy Policy

This policy explains how BurrBean collects and uses information when you use the BurrBean coffee-tracking app, read the BurrBean Journal, or contact us. BurrBean is operated by Soofani Inc. and is currently intended for people in the United States.

Information BurrBean collects

Account information

When you create an account, BurrBean collects your email address and authentication information. You may also provide a first name, last name, or profile image. Authentication is handled by Supabase. BurrBean does not receive or store your plain-text password.

Coffee data and other contributions

BurrBean stores information you submit, such as beans, roasters, origins, photos, equipment, recipes, dial-in settings, tasting notes, ratings, likes, and test-program entries.

Public text and photo safety checks

Public text you submit, such as bean descriptions, dial notes, and display names, may also be sent to OpenAI for safety screening. We send the submitted public-text fields, not your password, account email, or local unpublished drafts. Flagged submissions and checks that cannot finish stay private for review. You can contact support@burrbean.com about a decision.

When you submit a photo for public sharing, BurrBean may send a resized copy to OpenAI’s Moderation API to check for potentially harmful content. The moderated upload flow removes embedded location, camera, and other metadata before sending the image. This does not remove people, addresses, or other information visible in the picture. We do not include your account email, password, original filename, or unpublished shot drafts with the moderation request.

Photos that pass the check can become public. Photos awaiting a check or review are stored privately and may be reviewed by authorized BurrBean moderators. We keep the review status and limited decision information with the upload to support retries, safety reviews, and appeals. Automated checks can make mistakes; contact support@burrbean.com to request a review. You can use the app and add beans without uploading photos.

OpenAI states that API data is not used to train its models unless the customer opts in. Its handling of API data is described in OpenAI’s data controls documentation. This statement does not mean the photo is anonymous or that it is never retained by BurrBean.

Usage and technical information

Hosting and authentication providers retain technical logs that can include IP addresses, request paths, timestamps, response status and timing, and browser or device information. We use these records to operate, diagnose and protect the service. These server records can exist even when you use the native app without an analytics SDK.

BurrBean uses Vercel Web Analytics to understand aggregate traffic. It may process the page visited, referrer, approximate location, browser, operating system, device type, and event time. Vercel Web Analytics does not use cookies for visitor identification and does not provide BurrBean with personal profiles of visitors.

The website uses browser storage to keep you signed in and remember interface preferences. The native iOS app keeps sign-in sessions in Apple Keychain and local drafts, contributor blocks and preferences in device storage. Signing out does not erase local drafts; iOS device backups may include app data. The native app does not include an advertising or analytics SDK. Websites opened from it have their own measurement practices. BurrBean does not currently use advertising or cross-site tracking cookies.

Messages

If you email BurrBean, we receive your email address and the information in your message so we can respond and maintain a record of the conversation when reasonably necessary.

How information is used

We use information to operate the app, authenticate accounts, save and display coffee data, provide community features, respond to support requests, protect the service, diagnose problems, and understand how the app and journal are used.

What may be public

BurrBean includes community features. Bean-catalog entries, bean photos, dial-in settings, equipment details, tasting notes, ratings, likes, and similar contributions may be visible to other visitors. Do not include personal, confidential, or sensitive information in anything you submit to a community feature.

Service providers and disclosure

BurrBean uses service providers to run the service:

• Supabase for authentication, database services, and image storage.
• Vercel for hosting, delivery, and privacy-focused web analytics.
• Fastmail for support email.
• OpenAI for automated safety screening of submitted public text and photos when enabled.

These providers process information to supply their services. Information may also be disclosed when reasonably necessary to comply with law, protect users or the service, investigate misuse, or complete a future transfer of the service with appropriate notice and safeguards.

Sale, targeted advertising, and affiliate links

BurrBean does not currently sell personal information or use it for cross-context behavioral advertising. Journal posts may contain affiliate links. If you follow one, the destination site or affiliate network may collect information under its own privacy policy. Affiliate relationships will be disclosed near the relevant recommendation or link.

Retention and deletion

Account and coffee data are generally kept while your account is active or as needed to operate, secure, and maintain the service. Support messages and limited records may be retained when reasonably necessary for security, legal obligations, or resolving disputes.

In the native app, open Account → Delete account to request deletion after password verification and confirmation. You can choose whether to also remove local drafts. Once the service accepts the request, you are signed out and account writes are restricted while deletion completes. We aim to complete ordinary requests within 7 days and send an email confirmation. Shared-content or ownership questions may require additional review; contact support with your receipt for an update. You can also request access, correction, or deletion at support@burrbean.com from the address connected to your account; identity verification may be needed.

Account deletion removes your sign-in identity, profile, owned photos and user-authored content from the active service. Shared catalog facts and copies require provenance review to protect other contributors’ independent work; this is not a blanket exception to retain your personal text or photos. Historical externally hosted images and copies already downloaded or shared cannot be erased from third parties by BurrBean. Limited security/legal records and provider backups may outlast active-service deletion; we do not promise immediate backup erasure.

Your privacy choices

You can update available profile information in the app and can request access, correction, or deletion by email. Depending on where you live, you may have additional privacy rights. BurrBean will not discriminate against you for making a privacy request.

Do Not Track

BurrBean does not currently track people across unrelated websites, so it does not respond differently to browser “Do Not Track” signals. Third-party sites reached through links have their own practices.

Security

We use reasonable technical and organizational measures intended to protect information. No online service can guarantee absolute security, so please use a unique password and protect access to your email account.

Children

BurrBean is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so it can be addressed.

Changes to this policy

We may update this policy as BurrBean changes. The effective date above will be revised, and material changes may also be announced through the site or by email when appropriate.

Contact

Questions and privacy requests can be sent to support@burrbean.com.