Privacy Policy

1Who we are (Controller)

The controller responsible for data processing under the GDPR (and other applicable data protection laws) is:

2Scope of this Privacy Policy

This Privacy Policy applies to:

• the Coffeelist mobile application ("App"), and
• the Coffeelist website ("Website").

It explains what personal data we process, why we process it, and what rights you have.

App stores / distribution: When you download or use the App via the Apple App Store or Google Play Store, the respective store provider may process personal data independently (e.g., for distribution, security, and store-related analytics). This processing is governed by the store provider's privacy policy:

3What Coffeelist does

Coffeelist helps groups manage shared consumption lists (e.g., coffee/consumables) without paper lists or manual spreadsheets. Users can create or join groups, admins can create products, and the group can track consumption and balances.

4Data we process (App)

Depending on how you use the App, we may process the following categories of data:

5Why we process data (Purposes) and legal bases (GDPR)

We process personal data for the following purposes:

• Providing the App and core features (account, groups, syncing, consumption tracking)
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Operating and securing the service (e.g., preventing misuse, maintaining stability)
  Legal basis: legitimate interests (Art. 6(1)(f) GDPR)
• Sending service-related emails (e.g., password reset emails via Firebase Authentication)
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Push notifications (if enabled by you)
  If you enable push notifications, we process a device token/instance identifier to deliver notifications to your device. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by disabling notifications in your device settings. Disabling notifications does not affect the core functionality of the App.

6Firebase / Google as a service provider

We use Google Firebase (Google Ireland Limited for users in the EEA/UK; Google LLC may process data as a sub-processor) to provide core App functions.

More information about Google's data processing and privacy can be found here:

Firebase services used include:

7No analytics / no tracking

We currently do not use Firebase Analytics or other tracking/analytics tools in the App.

8Sharing of data

We do not sell your personal data.

We may share data only when necessary:

• With service providers (e.g., Firebase/Google) to operate the App
• Within your groups: other group members may see group-related information and records depending on your group's setup (e.g., consumption entries, product lists, balances). This is the core purpose of the App.

We may disclose data if required by law or to protect our rights and security.

9International data transfers

Firebase is a service by Google. Depending on your location and Google's processing structure, personal data may be processed in countries outside your country (including outside the EEA). Where required, transfers are safeguarded by appropriate legal mechanisms (e.g., standard contractual clauses).

10Data retention

We keep personal data only for as long as necessary to provide the service and for the purposes described in this Privacy Policy. In general:

• Account and app data is stored for as long as your account is active and until you delete it or request account deletion (unless we are legally required to retain certain data).
• Technical data (e.g., push notification delivery tokens) is retained as needed for the notification feature and may be refreshed or removed automatically.

If you request account deletion, we delete or anonymize personal data associated with your account within a reasonable period, unless retention is required by law or necessary to establish, exercise, or defend legal claims.

11Account deletion

You can request deletion of your account at any time. After deletion, we will delete or anonymize personal data associated with your account, unless we are legally required to keep certain data. For group integrity, certain group records (e.g., consumption entries and group data) may remain after account deletion, but will no longer be linked to your account. If a group is deleted, the related group data is deleted as well.

12Website processing (coffeelist.jutio.org)

• Hosting: The Website is hosted on Cloudflare (Cloudflare Workers). In this context, Cloudflare may process technical data (including server log data) to deliver and secure the Website.
• Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
• Cookies / tracking: Our Website does not use marketing cookies or analytics tracking tools at this time.
• Server logs: Like most websites, Cloudflare may process basic server log data (e.g., IP address, date and time of the request, requested page, referrer URL, and user agent) to deliver the Website and ensure security.
• Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Website: https://coffeelist.jutio.org

13Security

We use reasonable technical and organizational measures to protect your data. However, no system can guarantee 100% security.

14Your rights (GDPR)

If you are in the EEA/UK (and in many other jurisdictions), you may have the right to:

• Access your personal data
• Rectify incorrect data
• Delete your data
• Restrict processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent (where processing is based on consent)

To exercise your rights, contact us using the details in Section 1.

15Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence or the place of the alleged infringement.

16Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when changes were made.