Privacy policy
Last updated: November 2026. The German version is authoritative.
Controller
Matthias Krisa, Klosterneuburg, Austria · beandapp@pm.me
In short
- No cookies, no tracking, no analytics, no ads.
- Fonts and all files are served from our own server. No third-party services (such as Google Fonts) are loaded.
- The server keeps technically necessary access logs for a short time.
- The connection to the website is encrypted with HTTPS.
Hosting
This website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in an EU data centre, under a data processing agreement (Art. 28 GDPR).
Server logs
Each request processes: IP address, date and time, requested URL, status code, bytes transferred, referrer and user agent. This is necessary to deliver the site and protect it from abuse (Art. 6(1)(f) GDPR). Logs are deleted automatically after 14 days. Without this data the website cannot be delivered.
If you email us, we only use your details to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when no longer needed. The mailbox is hosted by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. The European Commission has found that Switzerland ensures an adequate level of data protection (adequacy decision).
Links to GitHub
The “Download on GitHub” and “Source code” links lead to GitHub (GitHub, Inc., USA). Your browser only connects to GitHub when you click one of them. GitHub’s privacy policy then applies.
The app
- No analytics, no ads, no automatic crash reports. The app contains no tracking or advertising libraries. The connection log in the settings stays on your phone. It only leaves it if you share it yourself, with the app you choose.
- Your data stays on your phone. Beans, brews, profiles, gear and photos are stored locally. We have no server that receives them.
- No account with us. The app works without signing up. If you turn on sync, the app creates a sync key on your phone (a Nostr key pair). It is your identity for syncing your own devices and is not linked to your name or email address.
- Sync is optional and end-to-end encrypted. Your data is encrypted on your phone before it is sent to Nostr relays (by default relay.damus.io, nos.lol and relay.primal.net, changeable in the settings). Photos are encrypted the same way and stored on photo servers (by default nostr.download and blossom.yakihonne.com). These servers cannot read the content, but they do see your IP address, the time and your public sync key. They are run by third parties under their own privacy policies.
- AI features are optional. They only work with your own API key. The data needed for an analysis is then sent directly from your phone to the provider you chose (for example Anthropic, OpenAI, Google Gemini or OpenRouter), under that provider's terms. It does not pass through us.
- Pour-over recipes. When you update the pour-over recipe collection, the app downloads it from GitHub. GitHub sees your IP address.
- Servers outside the EU. GitHub, the AI providers and some Nostr servers may be located outside the EU, for example in the USA. If you use these features, the data concerned goes directly from your phone to them.
- Machines and scales. The app connects to your espresso machine over your local network and to scales over Bluetooth. On iPhone it only asks for Bluetooth and local network access. On Android 11 and older, Android also requires the location permission for Bluetooth scanning. The app does not use your location.
No automated decisions
There is no automated decision-making and no profiling (Art. 22 GDPR).
Your rights
You have the right to access, rectification, erasure, restriction and data portability. Contact us at the address above. You may also lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).
Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR, for example the server logs), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).