legal

privacy policy

last updated october 2026 · human made things

1. what stays on your phone

everything you make in beans is stored on your iPhone, using Apple’s SwiftData framework: the photograph of each bag and its cut-out, the details read off the label, anything you type, every dial-in attempt (grind, dose, yield, time, water temperature, your rating and notes), your equipment setup, and your settings. we do not run a sync service and we cannot read any of it.

reading a label starts on the phone, with Apple’s Vision text recognition and Apple’s on-device model. section 3 covers the one case where a label leaves the phone for a second reading.

if you have iCloud device backups turned on, your beans data may be part of that backup. that is Apple’s backup of your phone, and we have no access to it.

2. what we never collect

the app never sends us your name, email address, phone number or contacts, and Apple’s Private Cloud Compute (section 3) is between you and Apple, not us. the app asks for the camera and nothing else: no location, no photo library, no microphone and no contacts. from version 1.5.0 it can also ask to send you notifications, and you can say no (section 5). we do not use Apple’s advertising identifier, so beans shows no tracking prompt. the few usage events it records (section 11) and the crash and performance reports it sends from version 1.3.0 (also section 11) carry nothing you photographed or typed, we do not track you across other apps or websites, and nothing is sold or shared for advertising.

your dial-in attempts, notes and equipment never leave the phone, on any path.

this section is about the app. on this website, the quiz can share a few facts with Meta if you accept its cookies (section 13). section 14 covers a short time when the beans page did the same with OpenAI.

3. a second reading by Apple

if the on-device reading of a label leaves gaps, and your iPhone supports it, beans asks Apple’s Private Cloud Compute to read it again. this is a larger Apple model that runs on Apple’s servers instead of your phone. it is sent both photographs of the bag and the text the scan read off them, and it is the only place a photograph of a bag leaves your phone without you asking for a 3D render.

it happens automatically when the label needs it, and it is Apple’s system end to end: the request goes from your phone to Apple and the answer comes back, and none of it passes through us. Apple states that Private Cloud Compute does not store what it is sent and that it cannot be accessed even by Apple; that is Apple’s claim to make, and their terms govern it. nothing depends on it, and if it is unavailable the form simply keeps the on-device reading.

their description: security.apple.com/blog/private-cloud-compute

4. looking a coffee up on the web

after you scan a bag, beans can research it, so the form fills in what the label did not say: the roaster’s own description, the origin, the producer. this is the one thing beans sends to us.

what is sent

• the roaster and coffee names the scan found, and the origin if the label printed one
• the text read off the bag, sent with every lookup, because what identifies a roastery is the registered name and town printed on the back panel
• which fields are still blank, and the app’s own list of terms (roast levels, processing methods and so on) so the answer comes back in words the app understands

your photographs are never part of this lookup, and neither is anything you typed, any attempt you logged, or anything that says who you are. beans works without the lookup: it never blocks saving, it never overwrites something you typed, and with no signal you simply fill the form in yourself.

who handles it

the request is signed by Apple’s App Attest (section 7) and goes to a small server we run on Cloudflare Workers. that server holds the credentials, so they are never in the app, and forwards the request to OpenRouter, a service that passes it to a language model with web search. at the time of writing that model is DeepSeek’s V4 Flash, run by whichever provider OpenRouter routes to, and the searches the model makes, built from the names on your bag, go to a web-search service OpenRouter connects it to.

OpenRouter says it does not use your inputs or outputs for model training. it also says the model providers behind it process inputs under their own terms and may retain them, and we have not restricted routing to providers that keep nothing. the text in a lookup is printed on a coffee bag and not linked to you, but it is a transcript of your photograph, so treat it that way.

our server keeps a log line for each request: a random key identifier, how long it took, which fields came back filled and which web pages the model read. it does not log the transcript. Cloudflare keeps those logs for a few days.

their policies: openrouter.ai/privacy · cloudflare.com/privacypolicy

5. making a bag 3D

a render turns your bag into a 3D model for the shelf. it only happens when you ask for it, and it is the one thing beans sends that is a picture: a picture of the front of the bag, and of the back if you photographed it. the front is the cut-out, the bag with its background removed, or, when no cut-out could be made, the whole photograph. the back is only ever sent as a cut-out.

if it is the whole photograph, it includes whatever was behind the bag, so keep anyone and anything private out of frame when you photograph one you mean to render.

the pictures go through our server to Meshy, which builds the model and sends it back to be stored on your phone. our server does not keep the pictures. it keeps a task record: Meshy’s task number, your random device key and customer identifier, an identifier for the bag, timestamps, and whether the render was charged. that record is what stops anyone spending a render that is not theirs.

what Meshy does with it is Meshy’s to say, and we would rather quote them than paraphrase. Meshy’s documentation says generated models are deleted from its servers after three days. its privacy policy says it may use a limited selection of customer inputs and outputs to evaluate and test the quality, safety and performance of its models, and it is a US company that may process information anywhere in the world. we could not confirm how long it keeps the picture you upload, and we cannot opt you out. if that is not acceptable for a picture of your bag, do not make it 3D: the shelf works with the photograph, and nothing else in beans needs this feature.

their policy: meshy.ai/privacy-policy

notifications

from version 1.5.0, beans can ask whether to send you notifications: during onboarding, when a 3D render starts, after you buy renders, and when you turn on “ask how it tasted” in Settings or in what’s new. you can say no, and change your mind at any time in your iPhone’s Settings. if you allow them, your device’s push token, an address Apple makes so a server can send a notification to this one app on this one phone, is sent to our server with the random customer identifier from section 6. it is used only to tell you when your 3D bag is ready and when we add a render to your account, and it is deleted when Apple reports it is no longer valid. the notifications themselves are delivered by Apple, and carry nothing but their text and which bag they are about.

a reminder that you have renders left, and the nudge that asks how your cup tasted a few minutes after you save a shot, are scheduled on your phone and send nothing anywhere.

after a render, beans asks whether you are happy with your 3D bag. if you say no, Meshy’s task number for that render is sent to our server, so we can look at the model it made. nothing else is sent with it.

6. buying the app, a plan and renders

payment is handled by Apple. beans uses RevenueCat to know what you own and how many renders you have left. beans can also be bought as a plan, monthly from version 1.4.2 and yearly from 1.3.1, and RevenueCat reads the status of a plan, such as which one you have and when it renews, in the same way.

RevenueCat receives your App Store purchase receipt, basic device information such as model, iOS version and country, and an App User ID: a random identifier the app creates the first time it runs and keeps in your iPhone’s Keychain. it is kept there rather than with the app so a delete and reinstall keeps your renders. an iCloud backup restore or a phone-to-phone transfer carries it too; a phone set up as new does not, and starts a fresh identity. it never receives your name, your email address or your Apple ID.

the same identifier is how our server finds the balance to spend a render from. RevenueCat acts as our data processor, is based in the USA, and holds this data under a data processing agreement.

the welcome offer’s countdown is kept on your phone, in the Keychain beside that identifier, and is not sent anywhere. if you redeem an offer code, the redemption sheet is Apple’s.

their policy: revenuecat.com/privacy

7. proving the app is genuine

our server costs money to run, so it only answers a genuine copy of beans on a genuine iPhone. it asks Apple’s App Attest service, which makes a cryptographic key in your phone’s Secure Enclave. the key cannot leave the phone and every request is signed with it.

our server stores the key’s public half, a counter that stops a request being replayed, the app version, and the receipt Apple issues. none of it identifies you, and none of it carries a request’s contents. deleting the app and reinstalling makes a new key.

8. children

beans is not directed at children under 13 and we do not knowingly collect anything from them. nothing in the app asks for a name or an age.

9. lawful basis and where data goes

for the lookup and the render we rely on performing the service you asked for by tapping the button. for keeping the service secure, and for the server logs, our legitimate interest in running it safely. for usage analytics and crash reports, our legitimate interest in understanding which parts of the app work and fixing the ones that do not (section 11). PostHog processes those events in the European Union; the other services above, and Meta (section 13), are based in the USA and elsewhere, and where personal data leaves the UK or the EU, they rely on standard contractual clauses and the UK addendum to them, or on Apple’s and RevenueCat’s own frameworks, or, for Meta, the transfer arrangements its policy describes. for the launch waitlist, which has closed, the consent of the people who joined it (section 12). for the quiz’s measurement with Meta, your consent, which you give on its first screen and can withdraw at any time (section 13). for the beans page’s measurement with OpenAI, your consent, which you can withdraw at any time (section 14); OpenAI is based in the USA and transfers data under its own policy.

10. your rights

everything you make in beans is on your phone, so deleting the app removes it, permanently and with no way for us to recover it. export or photograph anything you want to keep first.

the data we and our processors hold is keyed to random identifiers, not to you, and that is the direct cost of not knowing who you are. an email address cannot be matched to a customer identifier, so we cannot look you up from one. the identifier is shown nowhere in the app, so write to us and we will work out with you what can be found and removed, including asking RevenueCat to erase a customer record, deleting the usage events PostHog holds, and removing our own task and key records.

for that, or any question about this policy, email help@humanmadethings.co.uk. the quiz on this website holds nothing we could look up or delete: withdraw your consent as section 13 describes, and write to us if you want anything else done. the data controller is human made things, in the United Kingdom, and, for the quiz’s measurement with Meta, jointly with Meta (section 13). if you are in the UK or the EU you may also complain to your data protection authority, which in the UK is the Information Commissioner’s Office.

11. usage analytics and diagnostics in the app

beans records a small number of events: which onboarding step you reached, whether a bag was photographed and saved, whether the paywall was shown, whether a 3D render or a dial-in attempt was started, how a 3D render ended and how long it took, when you open, remove or save a recipe for a bag, how many bags are on your shelf, the type of equipment you set up (such as your portafilter size and whether you use a puck screen, never a name), when you leave a paywall without buying, when you open the share studio, whether you opened its camera or put a photo behind a bag and whether that photo came from the camera or your library (never the photo itself), whether a share finished and to which kind of app (such as Instagram or Messages, never the picture itself), whether looking up a bag found anything, whether you said you would rate the app, whether you were happy with a 3D bag, whether you allowed notifications when asked and where you were asked (including whether you went to your iPhone’s Settings to allow them), whether the nudge that asks how your cup tasted is on and how many minutes it waits, when you rate a cup after that nudge and how many minutes after saving it, which of the ways to brew at home you picked when onboarding asks “how do you brew at home?” (an optional question, sent as a yes/no for each method such as espresso or pour-over, never anything you type, and nothing at all if you skip it; it is used only to understand what kinds of brewers use beans and is not sent to RevenueCat), and when something failed, including the errors the app recovers from on its own, such as a save that did not complete or a 3D model that would not load. these events carry no coffee names, roasters, notes, photographs or anything you type: only a step name, a count or a yes/no, and for an error, which operation failed and the system’s numeric error code. they are tied to the same random identifier described in section 6, created on your device, never to your name, email or Apple Account. they are processed by PostHog on servers in the European Union, and client IP addresses are discarded on arrival. purchase events from RevenueCat are joined to the same random identifier.

beans is advertised on the App Store, and the app shows no advertising itself. once per install, beans asks Apple whether the install came from one of our own App Store ads. the request carries a one-time token made by Apple’s AdServices framework on your phone and nothing that identifies you to us; Apple answers with the numbers of our campaign and search keyword, and the country the ad was shown in, or says the install did not come from an ad. beans records that answer as one usage event, with the region your iPhone is set to in Settings (such as GB). that is a setting you chose, not your location, and beans never asks for your location. we use this only to see which of our own ads bring people who go on to use the app. it needs no tracking permission because nothing is combined with data from other companies’ apps or websites.

from version 1.3.0, beans also sends crash and performance reports. when the app crashes, hangs, runs out of memory or is slow to open, Apple’s MetricKit framework writes a diagnostic report, and beans sends it the next time you open the app. a report holds what Apple puts in it: the kind of problem, a stack trace (a list of the app’s own code locations where it happened, not your data), the app and iOS versions, your iPhone’s model and the time. beans removes the parts of a report that could carry text you typed. a report never holds a coffee name, a note, a photograph or anything you typed. it is sent to our own server on Cloudflare Workers, the one described in section 4, and no crash-reporting company or other third party receives it. it is stored with the same random identifier as the usage events, never your name, email or Apple Account, and deleted after 90 days. a count of reports is also recorded as a usage event. nothing is sent from a copy of beans that did not come from the App Store.

we do not use any of this to show you advertising, we do not follow you across other apps or websites, and we do not share it with data brokers.

their policy: posthog.com/privacy

12. the launch waitlist

this part is about the website, not the app. before beans launched, this site’s beans page had a form where you could leave your email address to get a single email when beans was out on the App Store. the addresses were used for nothing else, and were never shared or sold.

the form was stored by Netlify, which hosts this website, in the USA. with each submission Netlify also recorded the time, the page the form was sent from and, for spam filtering, your IP address and browser details, which it passed to Akismet to check the submission was not spam. the launch email went out on 26 September 2026 from our iCloud Mail address, through Apple. after that we deleted every submission in Netlify, including any held as spam, the list we exported to send it, and the sent message. we keep no copy.

the waitlist ran on the consent of the people who joined it, given by sending the form. it has closed, the form is gone, and there is nothing left to withdraw.

their policy: netlify.com/privacy · automattic.com/privacy (Akismet)

13. the quiz on this website

this part is about the website, not the app. the quiz at /beans-coffee/quiz/ asks up to five questions and tells you which part of beans might suit you. your individual answers are not sent to us or to Meta and not saved, and they are gone when you close or reload the page. there is no form, and we do not ask for your name or email address. the one thing from your answers that can leave the page is the name of the result you reach, and only if you accept, as described below.

the first screen asks about cookies. it says that we use Meta’s cookies to see which of our ads work, and you choose accept or no thanks before you see the quiz. the two buttons are equal, and the quiz is exactly the same either way. until you accept, nothing of Meta’s is loaded, we read no cookies, and the only thing stored is your answer to that question. if your browser sends a Global Privacy Control or Do Not Track signal, the screen is not shown and it counts as no thanks. your choice is kept in your browser’s session storage until you close the tab, and the line at the bottom of the quiz changes it whenever you like.

if you accept, the page loads Meta’s Pixel from connect.facebook.net, and our server sends the same events to Meta’s Conversions API. there are four: that you said yes and are viewing the page (PageView); that you answered the first question (ViewContent); that you reached a result that suits beans (Lead), once; and that you tapped the button or link to the App Store (QuizAppStoreTap). only the last two carry anything from your answers, the name of your result, such as “coach-pourover”; the first two do not. if you accept after you have reached a result, the Lead is sent then. each event also carries the time and the address of the page. in our own copy that address is cut down to the quiz page and, if they are there, the click identifier (fbclid) that Meta adds to a link you tapped in one of its apps and any campaign parameters beginning utm_; nothing else in the address is sent by us. the copy our server sends also carries your IP address, your browser’s user agent, and the identifiers in Meta’s two cookies when they are there. if the _fbc cookie is not there but the address holds a click identifier, our own code builds the _fbc value from it and sends that instead. the Pixel’s own requests are Meta’s code and send more: the full address of the page, the address of the page you came from, and details of your screen and browser.

the cookies are _fbp, which Meta’s Pixel sets on this website, and _fbc, which it sets if you arrived from a Meta ad. they last up to 90 days. they are set only after you accept, on humanmadethings.co.uk as a whole, so your browser sends them to every page of this website, though only the quiz uses them. if you turn measurement off, using the line at the bottom of the quiz, while the tab where you accepted is still open, the page deletes both. it cannot do that in a later visit: saying no thanks then does not remove cookies set earlier. they stay until they run out after 90 days, or until you clear them in your browser. the Pixel’s requests to Meta can also carry Meta’s own cookies from facebook.com, which are Meta’s to describe.

what Meta does with it. the data goes to Meta Platforms Ireland Limited. Meta can link it to a Facebook or Instagram account, if you have one, and use it for its own purposes, including its advertising, under its own policy. for collecting this data on this website and sending it to Meta, we and Meta are joint controllers, under Meta’s Business Tools terms and Controller Addendum. Meta may transfer the data to the United States and other countries.

our server passes each event on and keeps nothing: no copy, no email, no name. if Meta turns an event down, our server logs Meta’s error message, which holds neither your data nor our access token, so that we can fix the set-up. Netlify, which hosts this website, also keeps the ordinary server logs it keeps for every request, such as your IP address and the page asked for.

the legal basis is your consent. turning measurement off stops anything further being sent and, in the same visit you accepted in, deletes the cookies, but cannot recall what Meta already has; for that, use the tools in your Facebook or Instagram settings and Meta’s policy.

the button to the App Store carries a campaign code in its link, one of five shared by groups of results (for example quiz-coach), so Apple’s App Store Connect can show us how many installs came from each. that count is Apple’s. the link holds nothing that identifies you, only the campaign code of your result, and it is the same whether you accepted or not.

their policies: facebook.com/privacy/policy · netlify.com/privacy

14. the beans page and ads in ChatGPT, 28 to 31 october 2026

this part is about the website, not the app. from 28 to 31 october 2026 the beans page at /beans-coffee/ asked whether we could use OpenAI’s cookies to see which of our ads in ChatGPT worked. it no longer asks, and it no longer loads anything of OpenAI’s.

if you accepted then, the page loaded OpenAI’s measurement pixel, which sent that you viewed the page (page_viewed) and tapped the App Store badge (lead_created), along with what such code usually sends, such as the page address, your browser and your IP address. it set two cookies: __oppref, which holds an ad reference for 30 days, and __obref, an identifier kept for up to 365 days. the page can no longer read or remove them; they stay until they run out or until you clear them in your browser.

OpenAI keeps what it received under its own policy and may have transferred it to the United States; we received only counts of conversions per ad. the legal basis was your consent. their policy: openai.com/policies/privacy-policy

15. changes

if this policy changes in a way that affects what leaves your phone, we will update the date at the top and say what changed. the version you are reading is the current one.