HOME|PRIVACY POLICY
Effective date: October 15, 2026
MyCoffeeSettings ("MCS," "we," "us") is operated by NMN Investments, LLC, d/b/a MyCoffeeSettings, 920 Coral Way, Coral Gables, FL 33134, USA. We are the controller of the personal information described in this policy. You can reach us about privacy at info@mycoffeesettings.com.
This policy explains what we collect when you use our website, mycoffeesettings.com, our mobile apps, and related services (the "Service"), how we use and share it, and the choices and rights you have. It applies to all users, including roasters.
We collect information you give us, information created when you use the Service, and a limited amount from your device.
| Category | Examples | Source |
|---|---|---|
| Account information | Email address, password (stored only in hashed form), username, display name, profile photo, bio, confirmation that you are 13 or older | You |
| Coffee and journal data | Coffees, grinder model, grind settings, dose, ratio, brew method, tasting notes, ratings, dates | You |
| Photos | Coffee bag photos, profile photos, roaster images | You |
| Community activity | Posts, comments, votes, reports, blocks | You |
| Event information | Name, email, registration time, check-in status; optional consent to hear from a roaster | You, and the event organizer |
| Roaster information | Roastery name, address, website, social links, contact person; verification documents such as ID and business registration | Roasters |
| Communications | Support emails, appeals, privacy requests, marketing preferences | You |
| Device and usage data | IP address, device type, operating system, app version, and error logs | Your device and our servers |
| Location | Precise device location, only while you are using the Service and only if you allow it; not stored | Your device |
We do not collect payment information, and we do not ask for sensitive information such as health, religion, or government ID numbers, except roaster verification documents described in section 8. At events MCS itself organizes, we may take photos and video that include attendees, as described in the Event Terms; you can ask not to be featured at any time (legal basis in the EEA, UK, and Switzerland: legitimate interests).
We use personal information only for the purposes below. If you are in the European Economic Area, the UK, or Switzerland, the right column shows the legal basis we rely on.
| Purpose | Information used | Legal basis (EEA/UK/Switzerland) |
|---|---|---|
| Create and run your account, journal, and saved settings | Account, coffee and journal data, photos | Performance of our contract with you |
| Read a coffee bag label with AI when you use the scan feature | The bag photo you scan | Consent (asked before your first scan; you can enter details by hand instead) |
| Show community features, posts, and public presets | Community activity, public content | Performance of contract |
| Calculate anonymized community averages | Settings data, aggregated so it no longer identifies you | Legitimate interests (improving the database for all users) |
| Run event registration and share registrant details with the organizer | Event information | Performance of contract |
| Verify roasters and grant Official status | Roaster information, verification documents | Legitimate interests (platform integrity); performance of contract |
| Show nearby events and the roaster map | Location, if you allow it; IP address for map images | Consent for location; legitimate interests for the map |
| Send service emails (confirmations, password resets, security notices) | Account information | Performance of contract |
| Send newsletters and MCS news | Email address | Consent (unsubscribe anytime) |
| Understand usage, fix bugs, and improve the Service | Device and usage data | Legitimate interests (keeping the Service secure and working) |
| Moderate content, prevent fraud and abuse, enforce our Terms | Community activity, reports, account information | Legitimate interests; legal obligation where applicable |
| Respond to requests and comply with law | Communications, any relevant data | Legal obligation; legitimate interests |
We do not use your information for third-party advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our only AI feature today is the bag-label scan described in section 6. If we add other features that send your information to a third-party AI provider, we will tell you which provider and what data, and ask for your permission first.
Your personal settings and journal entries are private by default. They contribute to community averages only after being anonymized and aggregated.
The following is visible to anyone, including visitors who are not logged in: your username, display name, profile photo, and bio; any preset you choose to make public; and your posts and comments. Vote totals are public, but who voted is not. Your email address is never shown publicly.
Roaster pages, coffee listings, Roaster Recommended settings, and event listings are public by design.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows.
Event organizers. When you register for an event, we share your name, email, and registration and check-in status with the organizer of that event, usually a roaster. You will see this before you register. The organizer may use it to run the event and may send you marketing only if you check the separate box agreeing to hear from them. The organizer is responsible for its own use of your information.
Service providers. We use companies that process information on our behalf under contracts that require them to protect it and use it only to provide their services to us:
| Provider | What they do for us | Information involved | Location |
|---|---|---|---|
| Scalingo | Hosts the app, the database, and login sessions | Account information, hashed passwords, all content you submit, session data | France (EU) |
| Scaleway | Stores uploaded media | Bag photos, generated images, profile photos, roaster images | France (EU) |
| SwissCenter | Sends all emails (verification, password reset, notifications) | Email address and message content | Switzerland |
| OpenAI | Reads coffee bag labels when you use the scan feature | The bag photo you choose to scan | United States |
| OpenStreetMap Foundation | Provides map images on the roaster map; your browser connects to its servers directly | IP address and browser information | United Kingdom and other locations |
| UptimeRobot | Checks that the website is online | No user data | United States |
Legal and safety. We may disclose information if required by law or legal process, or if we believe in good faith it is necessary to protect the rights, safety, or property of MCS, our users, or others.
Business transfers. If MCS is reorganized, merged, sold, or transferred to another entity, including to a new company formed to operate MCS, your information may transfer as part of that transaction, subject to this policy.
With your direction. We share information when you ask us to, or when you make content public.
Location. If you allow it, the Service uses your device's precise location only while you are using it, to show nearby events and features. We use your location at that moment and do not store it on our servers or use it to build a location history. The Service works without location, and you can turn it off at any time in your device settings.
Camera, photos, and AI label scanning. We ask for camera or photo library access only when you choose to scan or add a photo. We remove location and other embedded metadata (EXIF) from photos when they are uploaded.
When you use the bag-label scan, the photo you take or choose is sent to OpenAI, a US company, which uses its AI model to read the label (for example, the roaster, coffee name, origin, and roast date) and to double-check that reading. We ask for your permission before your first scan, and you can always enter coffee details by hand instead. Only the bag photo is sent; we do not send your name, email, or account details with it. Under OpenAI's terms for business customers, it does not use this data to train its models and keeps it only for a limited period for abuse monitoring. Please avoid scanning photos that show people or other personal information.
Scanning an NFC tag on a bag reads information about the coffee, not about you.
We do not currently use third-party analytics, tracking, or advertising tools in the Service. To keep the Service secure and working, our servers record basic technical information such as IP address, browser and device type, and errors.
If we add analytics tools in the future, we will update this policy before they go live and, where the law requires, ask for your consent first.
We keep personal information only as long as needed for the purposes in section 3. We do not delete accounts for inactivity.
| Information | How long we keep it |
|---|---|
| Account, journal, settings, photos | Until you delete your account |
| Public posts and comments | Until you delete them; when you delete your account they remain but are anonymized as "deleted user" |
| Anonymized community averages | Indefinitely; they no longer identify you |
| Login sessions and short-lived security tokens | Until you log out or they expire |
| Bag photos sent to OpenAI for scanning | Up to 30 days at OpenAI for abuse monitoring, then deleted by OpenAI; the photo you save stays in your account |
| Event registrations | Anonymized 12 months after the event |
| Roaster verification documents | Deleted once the officializing decision is made, unless the law requires otherwise |
| Moderation records (reports, removals, appeals) | Up to 3 years, to handle appeals and repeat abuse |
| Support and privacy request emails | Up to 3 years |
| Server and error logs | Up to 1 year, kept by our hosting provider as required by French law. Short-lived rate-limiting counters linked to IP addresses expire automatically when the limit period ends |
| Location | Not stored |
| Backups | Overwritten within 90 days of deletion |
We may keep information longer where needed to comply with legal obligations, resolve disputes, or enforce our agreements.
For all users. You can:
EEA, UK, and Switzerland. You also have the right to access, correct, delete, restrict, or object to our processing of your personal information, the right to data portability, and the right to withdraw consent at any time without affecting earlier processing. You may object at any time to processing based on our legitimate interests. You may lodge a complaint with your local data protection authority (in Ireland, the Data Protection Commission; in Switzerland, the FDPIC), though we would appreciate the chance to address your concern first.
US state residents. Depending on where you live, you may have rights to know, access, correct, delete, and obtain a copy of your personal information, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information for targeted advertising or profiling. We will not discriminate against you for exercising your rights.
How to make a request. Email info@mycoffeesettings.com from your account email. We may need to verify your identity before acting. We respond within 30 days (or within any shorter period required by law), and may extend that period where the law allows. An authorized agent may submit a request for you with your written permission. If we deny a request, you may appeal by replying to our decision.
MCS is operated from the United States. Our hosting and storage providers process data in France (EU), and our email provider in Switzerland. OpenAI, in the United States, processes bag photos you scan. When you view the roaster map, your browser connects directly to OpenStreetMap's servers. This means your information may be processed outside the country where you live, including in countries whose data protection laws differ from yours.
When we transfer personal information from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at info@mycoffeesettings.com.
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users in the EEA must also meet the minimum age for digital consent in their country (up to 16), or have parental consent. If we learn that we have collected information from a child below the applicable age without required consent, we will delete it. Parents who believe their child has given us information can contact info@mycoffeesettings.com.
We use reasonable technical and organizational measures to protect personal information, including encryption in transit, hashed passwords, access controls, and contractual protections with our service providers. No system is completely secure. Please use a strong, unique password. If we become aware of a breach affecting your personal information, we will notify you and the authorities where required by law.
Because we do not track users across third-party websites for advertising, we do not change our practices in response to browser "Do Not Track" signals. We treat a Global Privacy Control (GPC) signal as a request to opt out of any sale or sharing of personal information; since we do not sell or share personal information, no further change results.
We may update this policy from time to time. For material changes, we will notify you by email and by a notice in the Service at least 14 days before they take effect, and where the law requires, we will ask for your consent. The effective date at the top shows when the policy was last updated.
NMN Investments, LLC, d/b/a MyCoffeeSettings920 Coral Way, Coral Gables, FL 33134, USAEmail: info@mycoffeesettings.com
