Privacy Policy

CoffeeProphet — Turkish Coffee Cup Reading App

Effective Date: January 1, 2026 · Last Updated: October 19, 2026
Dinkel AI & MEDIA TECH GmbH · Simmeringer Hauptstraße 24/220, 1110 Vienna, Austria

1. Introduction

Dinkel AI & MEDIA TECH GmbH ("Company", "we", "us", "our") respects your privacy and is committed to protecting your personal data in accordance with European Union and Austrian law.

This Privacy Policy describes what data we collect, how we use it, how we protect it, and your rights regarding your data.

This Policy applies to:

• the Android application (Google Play Store);
• the web application at coffeeprophet.net/app/, including the Telegram Mini App;
• the coffeeprophet.net website as a whole, including our advertising landing pages.

2. Data Controller Information

3. Definitions

• Personal Data — any information that can identify a natural person directly or indirectly (e.g., name, email, Device ID, photograph).
• Processing — any action with personal data (collection, storage, use, transfer, deletion).
• Controller — the company that determines the purposes and means of processing (us).
• Processor — a company that processes data on behalf of the controller (e.g., OpenAI, RevenueCat, Stripe).
• Data Subject — a natural person whose information is processed (you, the user).

4. What Data We Collect

4.1. Data You Provide to Us

Authorization Data (Optional)

If you choose to sign in via your Google Account:

Sign in via Google is optional. You can use the app anonymously with Device ID.

Data You Actively Upload

Your three cup photographs are sent to OpenAI for analysis and deleted on their side per OpenAI's retention policy; we do not store the full photographs. A reduced thumbnail (~300px) of one photo is kept in your reading history until you delete the reading or your account.

Data Obtained During Use

Community Wall Data (Optional)

If you use the Community Wall:

Community Wall content passes an automated safety pre-filter (OpenAI moderation and classification). Content assessed as clean is published automatically and becomes visible immediately; content the filter flags is held for review by a human moderator before it becomes visible. Any decision to remove or restrict content is made by a human moderator. This automated pre-filtering produces no legal or similarly significant effect on you within the meaning of Art. 22 GDPR. Legal basis: consent (Art. 6(1)(a) GDPR) and our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

4.2. Technical Data Collected Automatically

Free reading limit. The web version offers one free reading per device. To enforce it we derive a short one-way hash from the browser characteristics listed above together with your IP address and user agent. We store that hash alone — never the underlying values — and use it for no other purpose: it is not linked to advertising identifiers, not shared with third parties, and plays no part in profiling, pricing, or the content of your reading. In the EEA, the United Kingdom and Switzerland we do not read these browser characteristics at all: there the limit is enforced using only the network information your browser transmits in the ordinary course of a request (IP address, user agent, language). Legal basis: our legitimate interest in preventing abuse of a free service (Art. 6(1)(f) GDPR; Recital 47). Because this hash is what prevents the free offer from being claimed repeatedly, it is kept separately from your account and is not deleted when an account is deleted; it is erased 12 months after the free reading was used. You may object to this processing at any time under Art. 21 GDPR by writing to the address in section 13, and we will weigh your objection against the grounds set out here.

In the app the same limit applies and is enforced the same way: a one-way hash derived from device and network characteristics, stored on its own with no link to your account, used for nothing else. Because this marker is what prevents the free offer from being claimed again and again, it is kept separately from your account and is not deleted when an account is deleted. Legal basis: our legitimate interest in preventing abuse of a free service (Art. 6(1)(f) GDPR; Recital 47). You may object at any time under Art. 21 GDPR by writing to the address in section 13.

4.3. Analytics Data

Some of these events — including in-app purchase conversion events — are shared with our analytics and advertising providers as described in Section 5.5. This may involve your device's advertising identifier and is therefore not always fully anonymous.

4.4. Payment Data

Payments are processed through:

• Google Play Billing (Android)
• Stripe (Web / Telegram Mini App)
• RevenueCat (subscription management intermediary)

4.5. Data We DO NOT Collect

• Photos of your face or personal photos (only coffee cup photos)
• Real-time location (only region by IP)
• Contacts from your phone book
• Web browser history
• Content of other apps
• Health information
• Biometric data

5. Third Parties and Data Transfer

5.1. OpenAI, Inc.

Purpose: Photo analysis and interpretation text generation (GPT-5.2 Vision)

Data transferred: Coffee cup photographs (3 photos), question text, dream descriptions you write for a dream interpretation, anonymized Device ID

Community Wall text: Community Wall text (impressions, comments, display names) is also sent to OpenAI's moderation and classification endpoints to pre-filter unsafe content and to produce a translation for human moderators. Content assessed as clean is published automatically; content that is flagged is routed to a human moderator before it becomes visible. This pre-filtering produces no legal or similarly significant effect on you (Art. 22 GDPR), and the content is not used to train models.

Storage: USA (Standard Contractual Clauses apply)

Photo handling: Uploaded to OpenAI API, analyzed, then deleted from OpenAI within 30 days. Not used for training models.

OpenAI Privacy Policy

5.2. RevenueCat, Inc.

Purpose: Subscription management and payment validation

Data transferred: Device ID, User ID, purchase receipt, subscription status, and the device attributes Google Advertising ID, IP address and Meta anonymous app ID

Forwarding to Meta: RevenueCat forwards your purchase and subscription events to Meta on our behalf via Meta's Conversions API (see Section 5.5).

Storage: USA (Standard Contractual Clauses apply)

RevenueCat Privacy Policy

5.3. Stripe, Inc.

Purpose: Payment processing for web version

Data transferred: Payment information (processed directly by Stripe, not stored by us)

Storage: USA (Standard Contractual Clauses apply)

Stripe Privacy Policy

5.4. Infrastructure (Railway / AWS)

Purpose: App server hosting (Backend)

Data transferred: User ID, reading history, interpretation results

Database: PostgreSQL with encryption at rest (AES-256)

5.5. Analytics and Advertising

Website (coffeeprophet.net)

Our website uses the following tracking technologies:

• Google Analytics / Google Ads — website analytics and advertising conversion tracking
• Meta (Facebook) Pixel — advertising conversion tracking
• TikTok Pixel — advertising conversion tracking

These tools store and read identifiers on your device. If our region check places you in the European Economic Area, the United Kingdom or Switzerland, they are activated only after you agree on our cookie banner: until then the Meta and TikTok pixels are not loaded at all and none of the cookies listed in Section 5.7 is set. The Google tag loads in a restricted mode that stores no identifiers on your device, although a basic request — including your IP address — still reaches Google so that the tag can run. Elsewhere these tools start together with the page, the banner says so, and you can switch them off at any time. See Section 5.7 (Cookies and Similar Technologies) for the full list and for how to change your choice.

Legal basis (website): in the European Economic Area, the United Kingdom and Switzerland we store and read analytics and advertising identifiers on the basis of your consent (Art. 6(1)(a) GDPR, read together with § 165(3) Telekommunikationsgesetz 2021, which implements Art. 5(3) of Directive 2002/58/EC). Elsewhere we activate them after telling you, on the basis of our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR, where that Regulation applies) and of applicable local law, and you may switch them off at any time. Storage that is strictly necessary to deliver the service you asked for — listed in Section 5.7 — needs no consent under § 165(3) TKG 2021 and is processed to perform our contract with you (Art. 6(1)(b) GDPR).

Mobile App (Android)

The Android app uses the following analytics and advertising SDKs:

• Google Firebase Analytics (Google LLC) — measurement of app usage, screens viewed and conversion events (including in-app purchase events — value and currency) to understand how the app is used and to improve it.
• TikTok Business SDK (TikTok Pte. Ltd. / ByteDance) — measurement and attribution of our advertising campaigns. When you view the paywall or complete a purchase, the app sends a corresponding event (e.g. view-content or purchase, including the transaction value and currency) to TikTok so we can measure how effective our advertising is.
• Meta SDK (Meta Platforms Ireland Ltd.) — measurement of our advertising campaigns on Facebook and Instagram and attribution of app installs. The Meta SDK automatically reports app install and app launch events. It does not report your purchases itself.

Purchase events sent to Meta via RevenueCat: when you buy a single reading or start or renew a subscription, RevenueCat (Section 5.2) forwards this purchase event to Meta on our behalf through Meta's Conversions API — event type (e.g. subscription started, purchase completed), product, value and currency, together with the Meta anonymous app ID, your device's advertising identifier (Google Advertising ID) and IP address. This lets us see which Meta campaigns lead to purchases.

Data shared with these providers: app and purchase/conversion events, your device's advertising identifier (Google Advertising ID), and approximate technical/device information. We do not send your coffee-cup photographs, reading texts, question text, email address or Community Wall content to these advertising/analytics providers.

Where: Google (USA), TikTok (USA and other countries) and Meta (Ireland and USA). Standard Contractual Clauses apply to transfers outside the EU/EEA; transfers from Meta Platforms Ireland Ltd. to Meta Platforms, Inc. (USA) are additionally based on the EU-US Data Privacy Framework.

Legal basis: our legitimate interest in measuring and improving the app and our advertising (Art. 6(1)(f) GDPR) and, where required by applicable law, your consent (Art. 6(1)(a) GDPR).

How to opt out: you can limit advertising measurement at the device level — Android Settings → Privacy → Ads → Delete advertising ID (or Opt out of Ads Personalization). This stops advertising attribution based on your advertising identifier.

Google Privacy Policy · TikTok Privacy Policy · Meta Privacy Policy

5.6. Cross-border Data Transfer

Data is transferred to the USA — and, in TikTok's case, to further countries (OpenAI, RevenueCat, Stripe, Railway, Google/Firebase, Meta and TikTok). We rely on Standard Contractual Clauses (SCCs) under GDPR, together with encryption in transit (TLS 1.3) and at rest (AES-256). For the event data collected by the Meta Pixel on our website and by the Meta SDK in our app (including purchase events forwarded by RevenueCat), we and Meta Platforms Ireland Limited act as joint controllers within the meaning of Art. 26 GDPR in respect of its collection and transmission; Meta's further processing is carried out by Meta alone under its own policies. The essence of that arrangement is set out in Meta's Controller Addendum.

5.7. Cookies and Similar Technologies

We use cookies and comparable browser storage on coffeeprophet.net, including the web app at /app/, the Telegram Mini App and our advertising landing pages. A cookie is a small file a website stores on your device; browser storage (localStorage, sessionStorage) works the same way for our purposes and is covered by this section.

Strictly necessary — always active

These make the service work at all: they keep you signed in, remember the language you chose, hold the reading you are paying for so it is not lost between screens, note that you have already had your free reading, and record your cookie choice so we do not ask again. They are not used for advertising and are not shared with advertising networks. Without them the service cannot function, so they do not require consent.

Analytics and advertising — only with your agreement

Alongside these cookies we keep, for the length of your visit, the campaign parameters contained in the link you arrived through, so that we can tell which campaign brought you. Where consent is required, this is stored only after you have agreed.

How we ask

If our region check places you in the European Economic Area, the United Kingdom or Switzerland, we show a banner before any analytics or advertising identifier is stored or read. Nothing in the table above is set until you choose Accept all; choosing Essential only keeps it off.

Everywhere else the analytics and advertising tools start together with the page, the banner says so and offers to switch them off. If you do, we send a withdrawal signal to Google, Meta and TikTok and delete the cookies listed above from your device. We cannot undo the events that were sent before you chose: to have those erased as well, write to us at the address in Section 13 and we will pass your request to the provider concerned.

We work out your region from your browser's time-zone and language settings, which is an approximation rather than a determination of where you are. If it is wrong for you, set your own preference through the Cookies link described below — your choice always overrides our guess.

When you make a choice we store it on your device and also record it on our servers — the choice itself, the time, and a random identifier generated for your browser — so that we can show, if asked, that it was given. This record contains no name, e-mail address or IP address.

Changing your mind

Your choice can be changed at any time through the Cookies link in the website footer, on this page, and on the welcome screen of the web app. You can also delete cookies through your browser settings; deleting them makes us ask again on your next visit.

Two pages for a different app

Two pages on this domain — /kahvedili/ and /mova/ — advertise Fincan, a separate application published by the same company. They carry the same banner and the same choice, and in addition they load a Google tag operated for that application. Your cookie choice applies to them in the same way.

Türkiye (Law No. 6698 — KVKK)

If you are in Türkiye, this section forms part of our disclosure under Art. 10 of Law No. 6698 on the Protection of Personal Data. The analytics and advertising cookies we use are listed in the table above; the banner tells you that they are in use and lets you switch them off at any time, and we act on that choice as soon as you make it. You may exercise your rights under Art. 11 of the Law — including access, rectification, erasure and objection — by writing to the address in Section 13, and you may lodge a complaint with the Kişisel Verileri Koruma Kurumu.

6. Your Rights Under GDPR

6.1. Right of Access (Article 15)

You can request a copy of all data we store about you. Email partners@sonaya.ai with "GDPR Access Request". We respond within 30 days, free of charge.

6.2. Right to Rectification (Article 16)

If your data is inaccurate, you can correct it via Settings → Account, or email us.

6.3. Right to Erasure (Article 17)

You can request deletion of all your data via Settings → Account → Delete Account. All data is deleted within 30 days, with two exceptions: payment receipts, retained for 7 years under Austrian tax law, and the free-reading marker described in section 4.2, which is kept separately from your account — otherwise the one-free-reading-per-device limit could be reset simply by deleting an account and creating a new one.

6.4. Right to Restriction of Processing (Article 18)

You can ask us to restrict processing of your data. Email partners@sonaya.ai.

6.5. Right to Data Portability (Article 20)

You can download your data in JSON/CSV format via Settings → Data & Privacy, or by emailing us.

6.6. Right to Object (Article 21)

You can object to data processing for marketing or profiling purposes.

6.7. Complaint to Regulator

Austrian Data Protection Authority (Datenschutzehörde): dsb@dsb.gv.at · dsb.gv.at · +43 1 521 52-0

7. Data Security

• Encryption in transit: All data via HTTPS / TLS 1.3
• Encryption at rest: PostgreSQL with AES-256; passwords as bcrypt hashes
• Access control: Only authorized personnel

Data Retention Periods

8. Data Breach Notification

In the event of a data breach, within 72 hours we will notify the Austrian Data Protection Authority and all affected users by email.

9. AI Usage

CoffeeProphet uses OpenAI GPT-5.2 Vision to analyze coffee cup photographs and generate text interpretations. This is not profiling — we do not draw conclusions about you based on interpretations. Each reading is independent. Results are generated for entertainment purposes and have no scientific basis.

10. Children

Minimum age: 4+ years (per Google Play classification). Users under 13 are recommended to use with parental consent. Users under 18 may require parental consent for subscriptions in some jurisdictions. Posting on the Community Wall requires users to be at least 16 years old.

11. Marketing and Communication

Unsubscribe from emails: Use the "Unsubscribe" link in any email, or email support@sonaya.ai.

Push notifications: Disable via your device's notification settings for CoffeeProphet.

12. Policy Changes

For critical changes, we notify via the app. For non-critical changes, we update the document and the date at the top. If you disagree with changes, you may delete your account and request data erasure.

13. Contact

Version 1.9 · October 19, 2026