SipDNA← Back to home

Privacy Policy

Last updated: 18 July 2026

1. Who we are

SipDNA is a personal coffee tracking and recommendation app. We are operated as an independent product. If you have questions about this policy, contact us at privacy@sipdna.app.

2. What data we collect

  • •Waitlist sign-up (this site): If you join our waitlist before launch, we store the email address you enter and, if present, a source tag identifying which page sent you (e.g. "hero", "cta-banner") — nothing else. Re-submitting the same email is a no-op, not a second record.
  • •Account information: Your email address and password (hashed — we never store plain-text passwords).
  • •Coffee entries: The coffees you log — country, region, roaster, process, flavour notes, rating, and any optional comments.
  • •Taste profile: Aggregated data derived from your coffee entries (top notes, countries, processes). Calculated on our servers, stored against your account.
  • •AI bag-scan photos (all plans, metered): The free plan includes 3 AI bag-scans a month (unlimited on PLUS/PRO — this is a usage allowance, not a paywalled feature). When you scan a bag, the photo is sent directly to our AI provider (OpenAI) for one-time extraction of the coffee's details and is never written to our own database or file storage — we don't keep a copy on our servers at all.
  • •Profile photo (optional): If you choose to add a profile picture, that image is stored in our object storage provider (DigitalOcean Spaces) until you replace it or delete your account, at which point it is removed.
  • •Approximate location (IP address): We derive an approximate country from your IP address, over an encrypted HTTPS lookup, solely to decide which regional features are enabled for you (e.g. staged rollouts). This is a live, per-request lookup — the result is cached in server memory for up to 10 minutes for performance and is not written to our database or linked to your account.

3. How we use your data

  • •To provide the SipDNA service — tracking, taste profile, recommendations.
  • •To improve the app and fix bugs, including automated crash/error reporting (technical data only — never your coffee entries or notes).
  • •To send you a launch notice if you're on our waitlist, and any operational notices we need to reach you about (such as a material change to this policy — see section 9). We do not currently have an email-based account-confirmation or password-reset flow — password changes are made in-app while signed in. We do not send marketing emails without your explicit opt-in.
  • •To process subscription payments — via Stripe if you subscribe on the web, or via Apple/Google's in-app purchase systems if you subscribe in the mobile app. We do not store your card details in either case.

What we do not do: we do not run any third-party, keyed usage-analytics tracker (Google Analytics, Mixpanel, etc.) in the app or on this site. This website ships with an analytics beacon that is a hard no-op by default — no script loads, no request fires, no cookie is set — unless we point it at a self-hosted, cookie-free collector we control; if that is ever switched on, it will only ever record anonymous page views on this marketing site, never inside the app.

4. Who we share data with

We do not sell your personal data. We do not share it with advertisers. We share data with the following service providers only as necessary to run SipDNA:

  • •Neon (database hosting) — Your data is stored in Neon's Postgres service.
  • •DigitalOcean Spaces (file storage) — Stores your optional profile photo only.
  • •Stripe, Apple, and Google (payments) — Whichever you use to subscribe processes that payment directly; we receive only the resulting subscription status, not your payment details.
  • •OpenAI (AI bag scan) — Receives the bag photo for one-time extraction under OpenAI's API data-usage policy, which excludes API traffic from model training by default; we never store the photo ourselves.
  • •ipapi.co (approximate location) — Receives your IP address over HTTPS to answer "what country is this?" for feature-rollout purposes; we don't send it anything else, and we don't store its response beyond the short in-memory cache described in section 2.
  • •Sentry (error monitoring) — Receives technical crash/error reports so we can fix bugs; never your coffee entries, notes, or password.

5. Your rights

You have the right to:

  • •Access and export the complete data we hold about you — account details, coffee entries, taste profile, cupping sessions, subscription history, and more — as a single machine-readable file. Email privacy@sipdna.app to request it and we'll send it to you.
  • •Permanently delete your account and all associated data. Email privacy@sipdna.app from the address on your account to request deletion; once we've verified it's you, deletion is immediate, not scheduled — your rows are removed at that point, not after a retention window.
  • •Correct inaccurate data by editing it directly in the app (e.g. your display name or a coffee entry) or by asking us to correct anything you can't edit yourself.
  • •Withdraw marketing consent at any time by emailing us.

Today these rights are exercised by emailing privacy@sipdna.app — including for the waitlist on this site, which isn't tied to an in-app account. A self-serve export/delete/consent flow in the app's own Settings screen is planned for an upcoming release; this policy will be updated to reflect it once it ships.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, your personal data is deleted immediately — coffee entries, taste profile, cupping history, AI-usage records, and your profile photo are all removed at the same time as the rest of your account, not on a separate schedule. A small number of records survive deletion by design, stripped of identifying detail: financial/audit rows required for accounting (e.g. commission payout history, with the account link removed) and a hashed record that a deletion request was made and processed (for our own compliance evidence — it cannot be used to re-identify you or recover any of your account data). Since we do not run in-app or in-product usage analytics (see section 3), there is no separate analytics dataset to retain.

7. Security

All data is transmitted over HTTPS. Passwords are hashed using bcrypt. We follow industry-standard security practices. No method of transmission or storage is 100% secure; we cannot guarantee absolute security but we take it seriously.

8. Children

SipDNA is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

We may update this policy. We will notify you by email and/or in-app notice for material changes. Continued use of SipDNA after changes constitutes acceptance.

10. Contact

Questions? Email privacy@sipdna.app.