Baristuno

by Barista in Pajamas

Sign in

---

Privacy Policy

Last updated 10 August 2026

This policy explains what Baristuno collects, why, and what control you have. Baristuno is operated by EMajd Marketing Inc. in Canada, and follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

Data	Why
Email address	To create and secure your account, and to send password resets.
Password	Handled entirely by Google Firebase Authentication. We never see or store it.
Profile details you enter: name, photo, bio, location, favourite drink, machine, gear	To personalise the app and pre-fill your analyses. All optional.
Taste profile choices: preferred drink styles, flavor directions, available equipment, experience level, and current coffee goals	To rank official recipes for you and explain why each recommendation appears. These choices are optional, editable, and are not used for advertising.
Saved analyses: measurements, curves, 240 px thumbnail, and the grinder/coffee labels you attach	So your library persists across devices and you can compare over time.
Brew journal entries: recipe, dose/yield, taste scores, rating, and notes you enter	So your brewing history and analytics persist across devices.
Optional notification choices, time zone, and a Firebase browser push token	To deliver only the streak reminders and Weekly Drops you explicitly enable. The token identifies a browser installation for delivery; it is not used for advertising, and journal notes are never placed in notifications.
Grinder and coffee submissions	To review and, if approved, add the product name to the public catalogue.
Recipes you explicitly publish to Baristuno Commons	To show that recipe publicly until you remove it. Public recipe records use a random publishing key rather than your account ID or email. Your display name is included only if you choose that credit option.
Community recipe reports	To let administrators review a public recipe. The moderation queue uses the same random publishing key and does not expose your private journal.
Subscription records: payment-provider customer identifier, product, status, renewal state, paid-through date, and Founding Member number	To verify Baristuno Pro access, manage subscriptions, restore mobile purchases, prevent duplicate grants, and answer billing questions. Stripe, Apple, Google, or RevenueCat handles the payment instrument; Baristuno does not receive or store your full card or store-payment details.
Coffee Advisor questions and the recent messages in your current Advisor session	To generate the answer you request through Google Cloud Vertex AI. Baristuno does not save the question, answer, or chat transcript. We retain only non-content operational data: a one-way question hash, text length, number of conversation turns, approved source identifiers, confidence level, model, response time, and timestamp.
Coffee-bag photo you explicitly choose, extracted label fields, and optional public-web verification	To identify a coffee without retyping the bag. The browser compresses the selected photo before sending it to Google Cloud Vertex AI. Baristuno does not store the photo or unreviewed model response. If web verification is enabled, recognized product terms are used with Google Search grounding and the supporting public links are shown. Only the fields you review and save enter your private coffee lot. We retain aggregate operational metrics such as tier, whether verification or a curated barcode match was used, image size, field count, and timestamp—never the image or coffee identity.
Data-minimized grind measurements, written when you save an analysis: grinder model, dial setting, D50, fines, span, particle count, and the time recorded	Pooled across users to build a public setting-to-microns reference per grinder. The measurement row has no account identifier, email, photo, or coffee name. Submission requires a signed-in account, however, and security, rate-limit, and operational records may associate the request with your account. The published reference is aggregated and does not identify individual contributors. Don't save the analysis if you'd rather not contribute; the report still works.
First-party shop engagement: product impressions; product, affiliate-video, and discount interactions; product identifier; device category; signed-in member status; and a random browser session identifier	To understand which shop content is useful, report product-level performance, prevent duplicate counting, and limit abuse. We do not send journal content, profile details, search terms, or advertising identifiers with these events.
First-party product journey events: Mission opens and starts, completed Mission brews, adjustment and paywall views, checkout and verified subscription milestones, coffee-passport or reviewed bag-scan saves, Advisor recommendation actions, shop detail and retailer interactions, broad device category, membership tier, campaign source, and a random browser session identifier	To measure whether Baristuno helps people reach a useful first action, make a better second cup, understand Pro value, and find relevant shop products. The event contract rejects journal notes, Advisor questions or answers, coffee identity, names, email addresses, images, recipes, and search terms. Signed-in participant state uses a one-way account hash rather than an account ID.
First-party app-health signals: broad route category, browser family, device category, Web Vital threshold bucket, release identifier, and whether a client error occurred	To find slow or unstable releases without recording page URLs, full user-agent strings, error messages, stack traces, form values, journal content, coffee identity, or account identifiers. These daily aggregates are marked for deletion after 180 days.
Technical logs (IP address, timestamps) held by Google Firebase	Security, abuse prevention, and service reliability.
App integrity and browser security signals	Firebase App Check uses reCAPTCHA Enterprise to distinguish Baristuno’s real web client from automated abuse. Content Security Policy reports contain a page URL with its query and fragment removed, a closed journey category, a broad browser family, the blocked resource with its query and fragment removed, directive, source file, line and column, and an aggregate count. Full user-agent strings, blob identifiers, data payloads, journal content, coffee photos, Advisor questions, and form values are not retained in these reports.

We do not store your original grind or coffee-bag photos, full payment-card details, contacts, precise location, or advertising identifiers. A compressed bag photo is transmitted only when you explicitly start a bag scan, as explained above. Stripe and the mobile app stores process payment information under their own privacy policies. There are no third-party advertising or cross-site behavioural tracking scripts in Baristuno.

Imports, connected devices, and private links

Backup and journal-import files are read in your browser. The files themselves are not uploaded; only the coffee records you approve are written into your private account. Optional Bluetooth or serial device readings stay in the current page until you choose to place a value in a brew and save it. Baristuno does not store Bluetooth device identifiers or connection credentials.

Private recipe links contain the recipe inside the URL. Anonymous grind-report links contain only selected measurement numbers and remove coffee, grinder, setting, photo, date, and account details. Anyone who receives a link can read and forward its contents, and URLs may remain in browser history or ordinary hosting logs. Do not put sensitive information in a recipe name or field you plan to share.

Analytics

Baristuno does not run Google Analytics, third-party advertising analytics, or cross-site tracking. For signed-in members, our shop records limited first-party events: product impressions, product clicks, affiliate-video clicks, and discount views or copies. Each event includes the product, broad device category (mobile, tablet, or desktop), signed-in member status, and a random browser session identifier. We use this information to operate and improve the shop, measure product-level usefulness, prevent duplicate counting, and limit abuse.

Shop event totals are aggregated by product, day, event, device category, and member status. Duplicate-prevention records are marked to expire after 35 days and removed by scheduled cleanup; aggregate product statistics are retained for business reporting because they do not contain an account or session identifier. Firebase also keeps standard security and operational logs necessary to run the service.

Baristuno also uses a limited first-party product funnel to understand Mission discovery, useful first actions, completed first and second brews, Pro conversion, reviewed bag-scan saves, and shop intent. Browser events pass through an App Check-protected server function and a closed field allowlist. Sensitive or unrecognized fields are rejected. Raw account IDs and browser session identifiers are not stored in the measurement collections; one-way hashes support duplicate prevention and anonymous-to-signed-in source continuity. Administrators see aggregate counts and rates, not participant histories.

App-health monitoring records only a broad route category and threshold bucket for loading speed, layout stability, or interaction latency, plus a release identifier and an error-occurrence count. It never sends the page URL, error message, stack trace, form value, private coffee data, or account identifier. Signals are aggregated by day and marked for scheduled deletion after 180 days.

AI Coffee Advisor

The Baristuno Pro Coffee Advisor sends your current question and up to six recent messages from that open Advisor session to Google Cloud Vertex AI to create a response. The conversation is kept only in the page while you use it and is cleared when the account changes or the page closes. Baristuno does not save the transcript, and the Advisor does not read your private journal, profile notes, or saved analyses.

Answers are grounded in approved Baristuno recipe cards when relevant and show links to the cards used. AI responses can still be incomplete or wrong. The Advisor is for general coffee guidance and is not medical, dietary, or professional advice.

AI coffee-bag scan

Bag scanning is a separate, user-started workflow. The selected image is compressed in the browser and sent to Google Cloud Vertex AI to extract visible product facts. Optional web verification uses recognized product terms with Google Search grounding. Model output and search results can be incomplete or wrong, so the app requires an editable review before saving and labels the result as unverified until you confirm it. Curated barcode records, when available, take priority over model or web results.

Legal basis and consent

We collect and use your information with your consent, given when you create an account and when you choose to save an analysis, start a coffee-bag scan, import records, enable notifications, submit a catalogue entry, use the signed-in shop, or publish to the Commons. Bag photos are never sent merely because you selected one; transmission starts only after you press “Read this bag.” Notification permission is requested only after you turn on a reminder and press Save; both notification types are off by default and can be disabled independently. Saving an analysis is also what contributes the data-minimized grind measurement described above, so choosing not to save is how you decline it. Commons publishing has a separate confirmation and is never enabled automatically. Running a grind analysis and reading its full report works without an account and without any account data collection. You can withdraw consent by disabling notifications, removing a public recipe, signing out, or deleting your account.

Where your data lives

Application data is stored using Google Cloud Firestore in the United States (us-central1) and processed by Google as our service provider. Coffee Advisor requests and explicit coffee-bag scans are processed by Google Cloud Vertex AI; optional bag verification also uses Google Search grounding. Web billing records are processed by Stripe. Mobile subscription records may be processed by Apple, Google, and RevenueCat. This means information may be stored or processed outside Canada and may be subject to the laws of that jurisdiction. See Firebase's privacy documentation, Google Cloud's privacy notice, Stripe's privacy policy, and RevenueCat's privacy policy.

Who can see your data

• You: full access to everything in your account.
• Administrators: can see account and profile fields, catalogue submissions, contact messages, public Commons recipes, and the Commons moderation queue. Database security rules prevent administrators from reading your private brew, recipe, experiment, water-profile, coffee-lot, equipment, and grind-analysis subcollections.
• Other users: see approved catalogue product names and recipes deliberately published to the Commons. Your account ID and email are not put in the public recipe; your display name appears only if you select that option.
• Everyone, eventually: the data-minimized grind measurements described above are pooled into a public per-grinder reference. What is published is an aggregate (median particle size at each dial setting, and how many readings it is based on), never an individual row or account identifier.

We do not sell, rent, or trade personal information. We may disclose information if required by law or to protect against fraud or abuse.

Cookies and local storage

Baristuno uses browser storage for Firebase Authentication session data; your cached display name; pending offline brews, including notes, until they sync; one unfinished Brew Assist draft containing the selected coffee, recipe, timer, and any result notes so an interrupted brew can be resumed; locally selected recipe favourites; a random shop session identifier; a separate random product-measurement session identifier; the first campaign source; a bounded list used to avoid resending the same daily or one-time product event; a temporary first-party route and Mission identifier used to return you to the same work after checkout; and interface preferences such as brew mode, onboarding progress, and the last open journal section. The unfinished Brew Assist draft expires after seven days and is removed when you save or discard it, intentionally sign out, delete the account, or clear browser storage. The checkout continuation expires after four hours and does not contain coffee notes, Advisor questions, names, or payment information. This information stays on that browser unless it is synchronized to your account as part of a feature such as the brew journal. Baristuno does not use advertising, marketing, or cross-site tracking cookies.

Firebase App Check uses Google reCAPTCHA Enterprise for invisible abuse prevention. This use is subject to Google’s Privacy Policy and Terms of Service. It is not used by Baristuno for advertising or cross-site behavioural profiles.

Intentional sign-out and account deletion remove Baristuno's locally stored pending brews, notes, favourites, shop session identifier, cached identity, and interface preferences from that browser. Public application files may remain in the browser's ordinary cache for offline use; they do not contain your private journal. Clearing browser storage does not delete data already saved to your cloud account.

Retention

We keep account data while your account exists unless a shorter period is stated here. Coffee-bag images and unreviewed scan responses are not retained by Baristuno; monthly scan counters remain until replaced by a later month or the account is deleted, while aggregate non-content scan metrics may be retained for reliability and product planning. A pending offline brew remains on your browser until it syncs successfully, you intentionally sign out, you delete the account, or you clear browser storage. Shop and product-event duplicate-prevention records are marked to expire after 35 days. Hashed product-funnel participant and rate-limit state expires after 120 days and the signed-in participant state is removed during account deletion. Aggregate daily product and shop statistics may be retained for business reporting because they contain no account or session identifier.

When you request account deletion, the account is disabled and active sessions are revoked immediately. Private records, public Commons recipes, moderation reports, and the profile are removed automatically after active access tokens expire, normally within 90 minutes. Stripe subscriptions are cancelled as part of the request; Apple or Google Play subscriptions must be cancelled in the applicable store. Approved catalogue product names may remain in the public list without a link to you. Provider logs and backups may persist for a limited period as part of normal operation.

Your rights

• Access and portability: export a versioned backup in one click, restore it later, or import compatible coffee-journal records.
• Correction: edit your profile at any time.
• Deletion: delete individual analyses, all analyses, or your entire account from your profile page.
• Withdraw consent: delete your account; the analyzer still works signed out.
• Complain: you may contact us, and you have the right to complain to the Office of the Privacy Commissioner of Canada.

Security

Traffic is encrypted with HTTPS. Access is enforced server-side by database security rules, so one user cannot read another's data even by modifying the app in their browser. Passwords are managed by Firebase Authentication and are never visible to us. No system is perfectly secure; please use a strong, unique password.

Children

Baristuno is not directed at children under 13, and we don't knowingly collect their information. If you believe a child has created an account, contact us and we'll remove it.

Changes

If this policy changes materially, we'll update the date above and note it in the app. Continued use after a change means you accept the updated policy.

Contact

Privacy questions, access requests, or complaints:
baristainpajamas@gmail.com
EMajd Marketing Inc., Canada