Privacy Policy

Effective date: 1 November 2026.

This Privacy Policy explains how personal data is processed when you use the Brübla mobile application, the brubla.app website, the newsletter, and support. Brübla is a personal coffee journal where you can save cups and bags of coffee, recipes, equipment, ratings, impressions, and photographs.

This Policy is provided for your information. Accepting the Terms of Use or reading this Policy does not by itself mean that you consent to the newsletter, optional analytics, or AI photo recognition. Where consent is required, we ask for it separately for each specific purpose.

1. Who is responsible for your data

Brübla is operated by Daler Alierov PR Beograd, a sole proprietor registered in the Republic of Serbia (“we”). Tax identification number (PIB): 114979611. Registration number (MB): 67999398. Registered address: Republic of Serbia, Belgrade, Čika Ljubina 12/3. We are the controller of your personal data: we determine the purposes and means of processing and handle all user requests, including requests about personal data. We also publish the iOS application on the App Store through our Apple Developer account.

For questions about personal data and to exercise your rights, contact privacy@brubla.app. For questions about the application and purchases, contact support@brubla.app.

Apple independently processes information about your Apple Account, payments, and App Store use under its own privacy terms. This Policy describes the data processed by us and by the providers acting on our behalf.

2. Data we process

2.1. Account and access

Your email address and its verification status, account identifier, the information required for authentication and session management, and the status of your account. We record the version of the Terms of Use and this Policy, the time and action by which you confirmed your acceptance, your age confirmation, and your choices about optional processing.

2.2. Coffee journal

Information about cups and bags of coffee, recipes, brewing steps, and equipment; dates and measurements; ratings, tasting impressions, and other notes; photographs you upload and their reduced copies used for display and recognition.

Before uploading, the application re-saves each photograph on your device. Photo metadata, including EXIF location tags, is not transmitted.

If you add a place to a cup entry yourself, we save its coordinates and name. The application requests location access only at the moment of this action and does not track your location in the background. Journal entries are not published and are not visible to other users.

2.3. Purchases and paid access

To verify and restore purchases, we process information about the product, transaction, and subscription: its start, renewal, expiration, refund, and revocation of access, as well as the link between the purchase and your Brübla account. If you have preserved paid time or compensatory access under the Terms of Use, we track those balances separately.

Payments are processed by Apple. We do not receive your bank card or account details, or the payer’s name or address. In Apple’s financial reports, we see aggregated sales data by country and product, which does not identify individual buyers.

2.4. Website and newsletter

The brubla.app website does not use visitor analytics, advertising trackers, or cookies. If you subscribe to the newsletter, we store your email address and the information that proves your consent: when and how it was given and which version of the consent text applied at that moment. To run the website and protect it from abuse, the hosting infrastructure processes technical request data, such as IP address and browser type.

2.5. Diagnostics and optional analytics in the application

Diagnostic data helps us find crashes and keep the application reliable. It includes the application and operating system versions, device model, error details and time, and a technical account identifier. We use Sentry for diagnostics. Journal content, email addresses, and secret values are removed from reports before they are sent.

Product analytics helps us understand which features are used and where people run into difficulties. We use PostHog for it. Events include opening screens, creating entries, and using features, but not their content. A technical identifier may link events to an account, so we do not consider this data anonymous.

Product analytics is turned on only after your separate consent. You can decline or turn it off at any time in your account settings and keep every feature of the application.

2.6. Support requests

When you write to us, we process your email address, the content of your message, attachments, and the account or purchase details required to reply. Do not send passwords, verification codes, or payment details.

3. Purposes and legal bases for processing

Your account, storing and syncing your journal, processing photographs, verifying purchases, and restoring access are necessary to perform our contract with you. Without this data the related features do not work: an account cannot be created without an email address, and a bag cannot be recognised without a photograph.

The newsletter, product analytics, and AI photo recognition are based on your separate consent. Declining them does not prevent you from using the core features of the application. Withdrawing consent stops the related processing from that point on and does not make processing carried out before the withdrawal unlawful.

On the basis of our legitimate interest, we process the minimum data needed to diagnose crashes, protect accounts from unauthorised access, prevent abuse (for example, mass sign-ups or exhausting recognition limits), and defend our rights in a dispute. We have assessed that this processing is expected, limited to technical information, and does not override your interests. You can object to it by writing to privacy@brubla.app.

To comply with the law, we process purchase and payout data to the extent required for accounting and tax records, as well as correspondence about personal data requests that shows we have handled them.

Service emails about email verification, security, purchases, or material changes to the Service are sent to perform the contract or comply with the law and do not require a newsletter subscription.

4. Photo recognition

Coffee bag recognition works only after your separate permission. Before the first run, the application shows which photographs will be sent and to whom. You can withdraw permission in your account settings, after which photographs are no longer sent for recognition.

When you start recognition, a reduced copy of the bag photograph is sent through the OpenRouter service (OpenRouter, Inc., USA) to the Google Gemini model (Google LLC, USA). The model extracts details from the packaging, and you can review and correct them before saving. Apart from the image, only your device language and time zone are sent, so that dates and units are read correctly.

We ask OpenRouter to route requests only to providers that do not store them (Zero Data Retention mode). Google may temporarily retain requests to detect abuse under its own terms. Neither OpenRouter nor Google may use your photographs to train models.

We store the recognition result and your corrections together with the bag entry. They are deleted together with the entry or with your account.

We do not sell your content or use it for advertising, for developing third-party products, or for training models. Brübla does not make automated decisions that produce legal effects for you or similarly significantly affect you.

5. Newsletter

The newsletter is voluntary: you enter your email address in the form on the website and confirm your consent to receive news about Brübla. We use this address only for news about Brübla and its features. We do not track email opens or link clicks.

You can unsubscribe through the link in any email or by writing to privacy@brubla.app. We stop sending the newsletter no later than 10 working days after your request. The newsletter is not linked to your application account: unsubscribing does not delete your account, and deleting your account does not cancel the subscription.

6. Processors and other recipients

Providers receive only the data required for their function and process it on our behalf under contractual terms.

Only we have access to production data. We disclose information to public authorities and professional advisers only where there is a legal basis to do so.

7. Processing outside your country

Our providers process data in the countries listed in Section 6, primarily the USA and the EU. The transfer is necessary for the features you use and, for recognition and analytics, is also based on your consent. We choose providers that contractually commit to protecting data. You can request information about the applicable safeguards at privacy@brubla.app.

8. Retention

If a backup is ever restored, we reapply the deletions made after it was created.

Purchase records kept after account deletion do not contain your journal and are not used to restore it or for marketing.

9. Your rights and requests

You can request information about the processing and access to your data, correction of inaccurate data, deletion, restriction of processing, and a copy of your data. You can also object to processing based on legitimate interest and withdraw your consent. To make a request, write to privacy@brubla.app from the email address linked to your account.

To make sure the request comes from you, we may ask for confirmation and do not ask for more than is needed for that. We respond without undue delay and no later than 30 days after receiving the request. Where necessary, given the complexity and number of requests, we may extend this period by up to 60 days, and we will tell you about the extension and the reasons for it within the first 30 days. If we cannot fulfil a request, we will tell you why within the same period. If the law of your country sets a shorter period, we follow it.

You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia: https://www.poverenik.rs/, or to apply to a court. If the law of another country gives you the right to contact your local data protection authority, you can do so.

10. Account deletion and export

To delete your account, write to privacy@brubla.app from the email address linked to your account. Access ends as soon as the request is confirmed. Data is deleted within the periods listed in Section 8. When deletion becomes available in the application, we will update this Policy.

You can request a free export at support@brubla.app. After verifying the request, within 30 calendar days, or sooner if the law requires, we provide a ZIP archive with your journal data in JSON and CSV formats and the photographs still stored in your account. The download link is valid for seven days. Deleted content cannot be restored.

If you need an export before deletion, say so in your request, and we will complete the export first.

Deleting the application or your Brübla account does not cancel your Apple subscription. To stop it from renewing, cancel it in your Apple subscription settings. Restoring a subscription in a new account does not bring back a deleted journal.

11. Cookies, local storage, and device permissions

The website does not set cookies and does not use browser local storage. The application stores on your device the data required to sign in and work, such as a session token and settings.

You can manage the application’s access to the camera, photos, and location in iOS settings. Declining access limits only the related feature and does not affect other purposes of processing.

12. Age of users

Brübla is intended for users aged 16 or older, subject to the additional requirements of local law set out in the Terms of Use. If you believe that a child under this age has given us their data, write to privacy@brubla.app: we will look into it and delete the data if this is confirmed.

13. Security

We protect data in line with the nature of the processing and the risks to users:

• data is transmitted only over encrypted connections;
• access to production systems is restricted and protected by two-factor authentication;
• any administrative access to data is logged;
• secret keys are stored separately from the code;
• user and secret values are removed from diagnostics;
• each provider holds only the data its function requires.

If an incident creates a risk to your rights, we will notify you and the competent authority within the periods set by applicable law.

14. Changes to this Policy

We update this Policy when our processing methods, providers, or applicable requirements change. We announce material changes in advance in the application or by email. A new version does not give consent to a new optional purpose of processing.

If the controller changes, for example if Brübla is transferred to another entity, we will tell you the new controller’s details and explain what this means for your data before the transfer.