Privacy Policy

CoffeeProphet — Turkish Coffee Cup Reading App

Effective Date: January 1, 2026 · Last Updated: June 17, 2026
Dinkel AI & MEDIA TECH GmbH · Simmeringer Hauptstraße 24/220, 1110 Vienna, Austria

1. Introduction

Dinkel AI & MEDIA TECH GmbH ("Company", "we", "us", "our") respects your privacy and is committed to protecting your personal data in accordance with European Union and Austrian law.

This Privacy Policy describes what data we collect, how we use it, how we protect it, and your rights regarding your data.

This Policy applies to all versions of the application:

• Android version (Google Play Store)
• Web version (coffeeprophet.net/app/ — Telegram Mini App)

2. Data Controller Information

3. Definitions

• Personal Data — any information that can identify a natural person directly or indirectly (e.g., name, email, Device ID, photograph).
• Processing — any action with personal data (collection, storage, use, transfer, deletion).
• Controller — the company that determines the purposes and means of processing (us).
• Processor — a company that processes data on behalf of the controller (e.g., OpenAI, RevenueCat, Stripe).
• Data Subject — a natural person whose information is processed (you, the user).

4. What Data We Collect

4.1. Data You Provide to Us

Authorization Data (Optional)

If you choose to sign in via your Google Account:

Sign in via Google is optional. You can use the app anonymously with Device ID.

Data You Actively Upload

Your three cup photographs are sent to OpenAI for analysis and deleted on their side per OpenAI's retention policy; we do not store the full photographs. A reduced thumbnail (~300px) of one photo is kept in your reading history until you delete the reading or your account.

Data Obtained During Use

Community Wall Data (Optional)

If you use the Community Wall:

Community Wall content passes an automated safety pre-filter (OpenAI moderation and classification). Content assessed as clean is published automatically and becomes visible immediately; content the filter flags is held for review by a human moderator before it becomes visible. Any decision to remove or restrict content is made by a human moderator. This automated pre-filtering produces no legal or similarly significant effect on you within the meaning of Art. 22 GDPR. Legal basis: consent (Art. 6(1)(a) GDPR) and our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

4.2. Technical Data Collected Automatically

4.3. Analytics Data

Some of these events — including in-app purchase conversion events — are shared with our analytics and advertising providers as described in Section 5.5. This may involve your device's advertising identifier and is therefore not always fully anonymous.

4.4. Payment Data

Payments are processed through:

• Google Play Billing (Android)
• Stripe (Web / Telegram Mini App)
• RevenueCat (subscription management intermediary)

4.5. Data We DO NOT Collect

• Photos of your face or personal photos (only coffee cup photos)
• Real-time location (only region by IP)
• Contacts from your phone book
• Web browser history
• Content of other apps
• Health information
• Biometric data

5. Third Parties and Data Transfer

5.1. OpenAI, Inc.

Purpose: Photo analysis and interpretation text generation (GPT-5.2 Vision)

Data transferred: Coffee cup photographs (3 photos), question text, anonymized Device ID

Community Wall text: Community Wall text (impressions, comments, display names) is also sent to OpenAI's moderation and classification endpoints to pre-filter unsafe content and to produce a translation for human moderators. Content assessed as clean is published automatically; content that is flagged is routed to a human moderator before it becomes visible. This pre-filtering produces no legal or similarly significant effect on you (Art. 22 GDPR), and the content is not used to train models.

Storage: USA (Standard Contractual Clauses apply)

Photo handling: Uploaded to OpenAI API, analyzed, then deleted from OpenAI within 30 days. Not used for training models.

OpenAI Privacy Policy

5.2. RevenueCat, Inc.

Purpose: Subscription management and payment validation

Data transferred: Device ID, User ID, purchase receipt, subscription status

Storage: USA (Standard Contractual Clauses apply)

RevenueCat Privacy Policy

5.3. Stripe, Inc.

Purpose: Payment processing for web version

Data transferred: Payment information (processed directly by Stripe, not stored by us)

Storage: USA (Standard Contractual Clauses apply)

Stripe Privacy Policy

5.4. Infrastructure (Railway / AWS)

Purpose: App server hosting (Backend)

Data transferred: User ID, reading history, interpretation results

Database: PostgreSQL with encryption at rest (AES-256)

5.5. Analytics and Advertising

Website (coffeeprophet.net)

Our website uses the following tracking technologies:

• Google Analytics / Google Ads — website analytics and advertising conversion tracking
• Meta (Facebook) Pixel — advertising conversion tracking
• TikTok Pixel — advertising conversion tracking

These tools collect anonymized usage data on our website. You can opt out via your browser's Do Not Track setting or by using ad-blocking extensions.

Mobile App (Android)

The Android app uses the following analytics and advertising SDKs:

• Google Firebase Analytics (Google LLC) — measurement of app usage, screens viewed and conversion events (including in-app purchase events — value and currency) to understand how the app is used and to improve it.
• TikTok Business SDK (TikTok Pte. Ltd. / ByteDance) — measurement and attribution of our advertising campaigns. When you view the paywall or complete a purchase, the app sends a corresponding event (e.g. view-content or purchase, including the transaction value and currency) to TikTok so we can measure how effective our advertising is.

Data shared with these providers: app and purchase/conversion events, your device's advertising identifier (Google Advertising ID), and approximate technical/device information. We do not send your coffee-cup photographs, reading texts, question text, email address or Community Wall content to these advertising/analytics providers.

Where: Google (USA) and TikTok (USA and other countries). Standard Contractual Clauses apply to transfers outside the EU/EEA.

Legal basis: our legitimate interest in measuring and improving the app and our advertising (Art. 6(1)(f) GDPR) and, where required by applicable law, your consent (Art. 6(1)(a) GDPR).

How to opt out: you can limit advertising measurement at the device level — Android Settings → Privacy → Ads → Delete advertising ID (or Opt out of Ads Personalization). This stops advertising attribution based on your advertising identifier.

Google Privacy Policy · TikTok Privacy Policy

5.6. Cross-border Data Transfer

Data is transferred to the USA — and, in TikTok's case, to other countries (OpenAI, RevenueCat, Stripe, Railway, Google/Firebase, TikTok). We use Standard Contractual Clauses (SCCs) under GDPR, along with encryption in transit (TLS 1.3) and at rest (AES-256).

6. Your Rights Under GDPR

6.1. Right of Access (Article 15)

You can request a copy of all data we store about you. Email partners@sonaya.ai with "GDPR Access Request". We respond within 30 days, free of charge.

6.2. Right to Rectification (Article 16)

If your data is inaccurate, you can correct it via Settings → Account, or email us.

6.3. Right to Erasure (Article 17)

You can request deletion of all your data via Settings → Account → Delete Account. All data is deleted within 30 days, except payment receipts retained for 7 years per Austrian tax law.

6.4. Right to Restriction of Processing (Article 18)

You can ask us to restrict processing of your data. Email partners@sonaya.ai.

6.5. Right to Data Portability (Article 20)

You can download your data in JSON/CSV format via Settings → Data & Privacy, or by emailing us.

6.6. Right to Object (Article 21)

You can object to data processing for marketing or profiling purposes.

6.7. Complaint to Regulator

Austrian Data Protection Authority (Datenschutzehörde): dsb@dsb.gv.at · dsb.gv.at · +43 1 521 52-0

7. Data Security

• Encryption in transit: All data via HTTPS / TLS 1.3
• Encryption at rest: PostgreSQL with AES-256; passwords as bcrypt hashes
• Access control: Only authorized personnel

Data Retention Periods

8. Data Breach Notification

In the event of a data breach, within 72 hours we will notify the Austrian Data Protection Authority and all affected users by email.

9. AI Usage

CoffeeProphet uses OpenAI GPT-5.2 Vision to analyze coffee cup photographs and generate text interpretations. This is not profiling — we do not draw conclusions about you based on interpretations. Each reading is independent. Results are generated for entertainment purposes and have no scientific basis.

10. Children

Minimum age: 4+ years (per Google Play classification). Users under 13 are recommended to use with parental consent. Users under 18 may require parental consent for subscriptions in some jurisdictions. Posting on the Community Wall requires users to be at least 16 years old.

11. Marketing and Communication

Unsubscribe from emails: Use the "Unsubscribe" link in any email, or email support@sonaya.ai.

Push notifications: Disable via your device's notification settings for CoffeeProphet.

12. Policy Changes

For critical changes, we notify via the app. For non-critical changes, we update the document and the date at the top. If you disagree with changes, you may delete your account and request data erasure.

13. Contact

Version 1.4 · June 17, 2026