Privacy Policy

1. Privacy at a Glance

General Information

The following notices provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information on the subject of data protection, please refer to our privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice of this website.

How do we collect your data?

Your data is collected in part by you providing it to us, for example by sending us an e-mail.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right to receive free information about the origin, recipient, and purpose of your stored personal data at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and other questions on the subject of data protection.

2. Hosting

We host the contents of our website with the following provider:

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 (1) lit. f GDPR).

Our host(s) will only process your data to the extent necessary to fulfill their performance obligations and follow our instructions regarding this data.

Vercel may process data in the United States. Vercel Inc. takes part in the EU-U.S. Data Privacy Framework, and a data processing agreement pursuant to Art. 28 GDPR applies. Where required, the transfer is additionally secured by the EU Standard Contractual Clauses.

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the Internet (e.g., when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Notice Regarding the Responsible Party

The responsible party for data processing on this website is:

Luca Gerlich
Heuchelheimer Str. 92F
61350 Bad Homburg vor der Höhe
E-Mail: luca.dialedinapp@gmail.com

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).

Storage Duration

Unless a more specific storage period has been mentioned within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, deletion will take place after these reasons cease to apply.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent that has already been given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged violation. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of data to another controller, this will only be done to the extent technically feasible.

Access, Deletion, and Correction

Within the framework of the applicable legal provisions, you have the right to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, if applicable, a right to correction or deletion of this data at any time. You can contact us at any time regarding this and other questions on the subject of personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored with us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data, but you need it for the exercise, defense, or assertion of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may — apart from its storage — only be processed with your consent or for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

4. Data Collection on This Website

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

The collection of this data is based on Art. 6 (1) lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website — for this purpose, the server log files must be collected.

Web Analytics (Umami), only with your consent

If you give your consent, this website uses Umami, an open-source web analytics tool that works without cookies. We run Umami ourselves (self-hosted) at analytics.lucagerlich.dev; it is not the service of a third-party analytics provider, and the data is not passed on for other purposes. Without your consent, no analytics script is loaded and nothing is sent to the analytics server.

The following data is collected:

• Page URL (without the part after "#") and referrer URL
• Browser type and operating system
• Device type and screen size
• Country of origin (derived from IP address, which is not stored)
• Custom events (e.g., button clicks, form submissions — no personal data)

No personally identifiable information (PII) is collected. No fingerprinting or cross-site tracking takes place. No data is shared with third parties.

Session Recording, only with your separate consent

Optionally, and only if you consent to it separately, this website uses Umami's session recording feature to capture anonymized replays of interactions (mouse movements, clicks, scrolling). This helps us understand how visitors navigate the site and identify usability problems.

Session recordings are collected on a sampled basis (not every visit is recorded). Sensitive content on the page is masked so that no personal data — such as text input, email addresses, or form content — is visible in the recordings.

Text input is masked. The recordings contain interaction patterns (cursor position, click coordinates, scroll depth) and are not linked to your name or e-mail address. No cookies are used and no cross-site tracking takes place.

Our Umami installation is deployed on infrastructure of Vercel Inc. (USA), which processes the data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. The transfer to the USA relies on the EU-U.S. Data Privacy Framework and, where required, the EU Standard Contractual Clauses (see "Hosting"). Session recordings use the recorder of the same Umami installation and are stored there as well. IP addresses are not stored.

Analytics and session recording only run with your consent (Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG). You can consent to each separately and withdraw your consent at any time with effect for the future via "Privacy Settings" in the footer of this website. Withdrawal does not affect the lawfulness of processing carried out before it. Your decision is stored in your browser until you change it.

Cookies and Local Storage

This website does not set cookies. Your browser's local storage holds two settings: your privacy choice (dialedin-consent) and your light/dark preference (theme). They stay in your browser, are not sent to us and only serve to remember your choices (§ 25 (2) no. 2 TDDDG).

Maps (CARTO, OpenStreetMap)

Café reviews can show a location map. The map is only loaded after you click "Load map" or if you have allowed "External content" in the privacy settings. Until then, your browser makes no connection to the map provider.

Once loaded, your browser requests map styles, tiles, fonts and symbols directly from CARTO servers (basemaps.cartocdn.com and its subdomains). The provider receives your IP address and technical request data (browser, time, requested map area). The provider is CARTO (CartoDB Inc., 307 Fifth Avenue, Floor 9, New York, NY 10016, USA). The map data is © OpenStreetMap contributors (openstreetmap.org/copyright).

CARTO states in its privacy policy that it is certified under the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses where the framework does not apply. The legal basis is your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG). You can revoke it at any time with effect for the future via "Privacy Settings" in the footer; a map that is already displayed stays until you reload the page.

Shared Recipe Links

Recipe links from the app (dialedin-app.com/r#d=…) carry the recipe in the part of the address after the "#". Your browser never sends that part to a server. The page reads and displays it in your browser only; we do not receive, store or analyze it, and no analytics or session recording runs on this page.

5. Dialed In App — Privacy Notice

Scope

This section applies to the Dialed In mobile application, available as a native app for iOS (Swift) and Android (Kotlin). The app is a coffee companion designed with privacy as a core principle — it does not require an account, does not collect personal data, and does not integrate any third-party analytics or tracking.

iOS: On iOS, data is stored on your device and optionally synced via iCloud (CloudKit private database) to your other devices signed into the same Apple ID. No data is shared with us or any third party.

Android: On Android, the app has no network access (it does not request the INTERNET permission). Your data stays on your device and the app sends nothing to us or to third parties. The Android system services described below are separate from the app.

Data Collected

Dialed In only stores data that you actively enter. No data is collected automatically. The app does not record device identifiers, location, usage behavior, crash reports, or any other information beyond your explicit input.

• Coffee bean details — name, origin, roast level, process, flavor tags, flavor profile scores (acidity, body, etc.), arabica/robusta percentage, ranking, notes, roast and expiry dates, package weight
• Shot and brew logs — grind size, dose in/out, duration, timestamp, pressure, temperature, pre-infusion, RPM, water type, flavor coordinates, rating, notes
• Brew recipes — recipe name, method, steps, coffee and water amounts, temperature
• Equipment info — machine name, pressure, temperature, pre-infusion, tank volume; grinder name, RPM, grind settings
• Maintenance tasks — task name, type, interval, completion dates
• Bean photos — only images you explicitly select from your photo library
• App preferences — theme mode, grind settings, custom flavor attributes, locale

No personal data is collected: no name, email, phone number, location, device identifier, or account information.

Data NOT Collected

• Location, contacts, calendar, or microphone. Health data is never read (see "Apple Health").
• Browsing history, search history, or purchase data
• Device identifiers, IP addresses, or advertising IDs
• Usage telemetry, crash reports, screen tracking, or event logging
• Any automatically collected data of any kind

Data Storage

iOS

On-device: SwiftData (SQLite) for structured data, UserDefaults for settings, and the Documents/BeanImages/ directory for photos.

iCloud: CloudKit private database (iCloud.com.lucagerlich.dialedin). Data syncs only to devices signed into the same Apple ID. You control iCloud sync via iOS Settings > iCloud — the app does not manage this.

No external servers are contacted besides Apple's CloudKit infrastructure.

Android

All data is stored on-device only: DataStore for structured data, the app's files directory for photos.

Dialed In operates no account and no cloud service for Android. Android's own backup and device transfer may copy app data and photos, depending on your system settings.

Third-Party Services & Tracking

Dialed In does not integrate any third-party analytics, advertising, or crash reporting services on either platform.

• iOS uses exclusively Apple-native frameworks. No third-party SDKs are included. NSPrivacyTracking is set to false. No IDFA, ATTrackingManager, or SKAdNetwork usage.
• Android uses only standard UI and utility libraries (Jetpack Compose, Material 3, Coil, Vico, Glance, kotlinx.serialization, DataStore) and Google ML Kit for on-device image and text processing (see "Android System Services"). The app itself does not collect or transmit data.
• No cookies, no web views, no Firebase, no Amplitude, no Mixpanel, no Sentry, no advertising networks.

Android System Services (Google Play Services, ML Kit, Wear OS)

Removing the background from a bag photo runs on your device with Google ML Kit. The first time you use it, Google Play services downloads the subject segmentation model (about 19 MB) from Google. Your photos are not uploaded and stay on your device. Text recognition for the bag scanner also runs on the device, and on supported devices the scanner may use Google's on-device model Gemini Nano. Google Play services and ML Kit may send technical usage and performance data to Google according to Google's privacy policy; Dialed In itself has no network access.

If you pair a Wear OS watch, coffee data is transferred between phone and watch through Google Play services and cached on the watch. Shots saved offline on the watch stay queued until the phone confirms them.

Android backup and device transfer may copy app data and photos according to your system settings; the JSON export does not include photo files. Google Play services may download fonts. Sharing and external links use services you choose, under their own privacy policies. Notifications show coffee information on system surfaces according to your notification settings.

These services are provided by Google under Google's privacy policy; Dialed In has no influence on them. You can manage them in your Android system settings.

App Permissions

Permissions are only requested when you initiate the corresponding action. No data is sent to any server for any permission on either platform.

iOS

Android

User Controls

You have full control over your data:

• Delete any individual item (bean, shot, recipe, equipment, maintenance task) from within the app
• Export all data as a JSON file from Settings
• Import from a previously exported JSON file (merge or replace)
• iOS: iCloud sync is controlled entirely via iOS Settings, not the app
• Android: clear all data via Settings > Apps > Dialed In > Storage > Clear Data
• Uninstalling the app removes all local data on both platforms

Sharing Features

Dialed In includes a Visual Shot Sharing feature that generates sticker-style images of your shot statistics. Sharing is performed exclusively through your device's native share sheet (e.g., AirDrop, messaging apps, social media). The app itself does not upload any content to any server. If you choose to share an image to a third-party service (such as Instagram), that service's own privacy policy applies.

Apple Health (caffeine)

On iOS, Dialed In can optionally add each new shot's estimated caffeine to Apple Health (about 7 mg per gram of coffee, more for robusta). The feature is off by default and only starts once you turn it on in Settings and allow access in Apple Health. The app writes caffeine values only; it never reads health data and never shares health data with us or anyone else. The entries stay in Apple Health under your control.

You can turn the feature off in the app's Settings at any time, or revoke access in the Health app under Sharing › Apps › Dialed In. Values already written can be deleted in the Health app.

Data Retention

Data persists on your device until you delete it or uninstall the app. iCloud data on iOS follows Apple's standard retention policy. Dialed In operates no server and retains no data on a server: Android has no network access, and iOS uses only Apple's CloudKit private database. Exported files, shared images and system backup copies must be deleted separately.

Monetization

Dialed In is a one-time purchase on the App Store (€0.99 in Germany; the App Store shows the price in your country). There are no in-app purchases, no subscriptions, and no advertisements.

Children's Privacy

Dialed In is not directed at children under 13. The app does not collect personal data from anyone, does not require account creation, and does not include advertising or age verification mechanisms.

App Store Privacy Labels

• Apple App Store: "Data Not Collected" — no data is used to track you, no data is linked to you, and no data is collected.
• Google Play: Dialed In does not collect or share user data. Your coffee data stays on the device; see "Android System Services" for what Google Play services and ML Kit do on their own.

Developer Contact

Luca Gerlich, Bad Homburg, Germany
E-Mail: luca.dialedinapp@gmail.com