Privacy Policy

1. Data Controller

ZG Media
Gianluca Zgur
Am Fendlbach 13 A
82211 Herrsching, Germany

Email: support@kitetheworld.net

This privacy policy applies to the mobile app The Espresso (iOS & Android) and the associated Firebase Hosting website.

2. What Data We Collect

Depending on how you use the app, we process the following categories of data:

• Account data: Email address, display name, profile picture (optional)
• Shot data: Espresso parameters (dose, yield, time), photos and short videos of your shots
• Device data: Operating system, device type, app version (for error diagnosis)
• Usage data: Click and navigation data (anonymised)
• Payment data: Purchase ID, subscription status (for Pro subscription; no payment details)
• Community content: Recipes, tips, and posts you publish
• Communications: Support messages and screenshots you send us

3. Firebase Authentication & Sign-In Providers

For secure sign-in we use Google Firebase Authentication as well as the following optional sign-in providers:

• Email & Password – directly via Firebase
• Google Sign-In – Google LLC, USA (DPF-certified)
• Apple Sign-In – Apple Inc., USA (GDPR-compliant via Apple)
• Facebook Login – Meta Platforms, USA (DPF-certified)

During sign-in, name, email, and an authentication token are transmitted to Firebase depending on the provider chosen. Passwords are stored in encrypted form only. Firebase servers are located in the EU/USA. More information: firebase.google.com/support/privacy

Legal basis: Art. 6(1)(b) GDPR (contract performance)

4. Cloud Firestore & Firebase Storage

Your app data (profile, shot statistics, recipes) is stored in Google Cloud Firestore to enable cross-device synchronisation.

Images and videos (e.g. shot photos, profile picture) are stored in Firebase Cloud Storage. Uploads are limited to the following types:

• Photos: max. 10 MB, image/* formats only
• Videos: max. 50 MB, video/* formats only

All data is stored by Google encrypted with AES-256. You can delete your data at any time in the app settings. Legal basis: Art. 6(1)(b) GDPR

5. AI Features via Google Gemini

The Espresso offers optional AI features (shot analysis from photo or video, puck analysis, bean label recognition, Barista AI chat, dial-in coach). When you use one of these features, the data required for it is transmitted via our Firebase Cloud Functions to the Gemini API of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and analysed there by an AI model (Gemini).

What is transmitted (depending on the feature):

• Individual still frames or the short video of your extraction
• Shot, puck or bean label photos you take
• Brew parameters (dose, yield, time, temperature, bean age, grind setting)
• For the Barista AI chat: your question plus details of your machine, grinder, current bean and average shot score

What is NOT transmitted: Your name, email address or any other account data. Please do not enter personal details in the chat and make sure no people are visible in photos and videos.

Purpose: solely to generate the analysis or answer you requested. Google processes the data as a processor under the Gemini API Additional Terms of Service and the Google Data Processing Addendum; according to these terms, inputs from users in the European Economic Area are not used to train Google models. Google LLC is certified under the EU-US Data Privacy Framework (DPF).

AI-generated images: Preview images in the equipment and latte art catalogue are created with the FLUX.1-schnell model via the Inference API of Hugging Face, Inc., USA. Only the name of the catalogue entry (e.g. device name or motif) is sent as text – no photos, account data or other personal data. These images are labelled "AI-generated".

The AI features are voluntary – you can use the app fully without them.

Legal basis: Art. 6(1)(b) GDPR (provision of the feature you requested)

6. RevenueCat (Subscriptions)

For managing Pro subscriptions we use RevenueCat, Inc., USA. RevenueCat processes your anonymous user ID, subscription status, and purchase IDs from Apple/Google. Payment data (credit card etc.) remains exclusively with Apple or Google and is never shared with RevenueCat or us.

RevenueCat privacy policy: revenuecat.com/privacy

Legal basis: Art. 6(1)(b) GDPR

7. Community Features

When you use community features (sharing recipes, posts, tips, following users), the following data is visible publicly or to signed-in users:

• Your display name and profile picture
• Recipes, tips, and posts you publish
• Public shot statistics (only when explicitly shared)

You can disable community features in the app's privacy settings. Deleted content is permanently removed.

Legal basis: Art. 6(1)(a) GDPR (consent)

8. Push Notifications

With your explicit permission, we send push notifications via Firebase Cloud Messaging (FCM). An anonymous device token is stored for this purpose, which contains no personal data. You can disable push notifications at any time in your iOS/Android settings.

Legal basis: Art. 6(1)(a) GDPR (consent)

9. Usage Analytics and Crash Reports

We collect usage events (which features are used, screen names, platform) and crash reports via Firebase Analytics and Firebase Crashlytics. This data is linked to your user ID and is therefore personal data – not anonymous.

Only with your consent. You are asked on first launch. Nothing is collected before an explicit yes; the analytics components start disabled rather than being switched off afterwards.

• Legal basis: Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG (consent)
• Withdrawal: at any time in the app under Settings → Privacy. Withdrawal takes effect immediately and actually stops collection.
• Retention: usage events are deleted automatically after 180 days.

No personal data is shared with third parties for advertising purposes. Without consent the app is available to you in full.

9a. Offers from Partner Roasteries

Roasteries can deliver paid recommendations as a notification or as the tip of the day. This happens only with separate consent, which is distinct from agreeing to product notifications and has its own switch in the settings.

• Default: off. Without an active yes, no paid placement is delivered; this is enforced on the server as well.
• Labelling: every paid placement visibly carries an “Ad” label.
• Legal basis: Art. 6(1)(a) GDPR, Sec. 7(2) UWG
• Withdrawal: at any time via the same switch.

No personal data is passed to the roasteries; they only receive aggregated delivery figures.

9b. Maps and Address Lookup

Map display. When you open a map, the app loads map tiles, the map style and fonts from the OpenFreeMap service. For technical reasons your IP address, the requested map area, the time and your browser or device type are transmitted. No cookies are set and no account identifiers are sent.

• Recipient: Hyperknot Software Kft., Hungary (EU). According to its own policy, OpenFreeMap does not store IP addresses by default and only logs them during security incidents for at most 30 days. Cloudflare Inc. (USA, certified under the EU-US Data Privacy Framework) may be used as a content delivery network.
• Purpose: displaying the map
• Legal basis: Art. 6(1)(b) GDPR (providing the map feature you opened); Section 25(2) no. 2 TDDDG
• Trigger: only when you open a map or the map preview on the home screen is visible

If OpenFreeMap is unavailable or you are offline, the app shows a bundled world map (Natural Earth, public domain) and nothing is transmitted. Map data: © OpenMapTiles, © OpenStreetMap contributors (ODbL). Privacy information: openfreemap.org/privacy

Address lookup when adding a place. When you suggest a place, the app sends the coordinates of the map center to our own Cloud Function (Google Cloud, see above), which asks the Nominatim service of the OpenStreetMap Foundation (United Kingdom, EU adequacy decision) for the matching address. Only the coordinates are sent to Nominatim – not your IP address and no account data. Legal basis: Art. 6(1)(b) GDPR. Privacy information: osmfoundation.org

Device location. Only if you tap “My location” while adding a place and grant your operating system’s permission, your location is read once on the device to center the map. It is neither saved in your profile nor sent to us; only the point you then confirm as the place is transmitted. You can revoke the permission at any time in your system settings.

10. International Data Transfers

Some of our service providers (Google/Firebase including the Gemini API, RevenueCat, Hugging Face) are based in the USA. Data transfers are carried out on the basis of the following mechanisms:

• EU-US Data Privacy Framework (DPF) – for Google and RevenueCat
• EU Standard Contractual Clauses (SCCs) – additionally where required

Further information: dataprivacyframework.gov

11. Data Storage & Deletion

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations (commercial and tax law: 6–10 years).

You can permanently delete your account and all associated data at any time in the app settings under Account → Delete Account.

12. Your Rights

GDPR (EU/EEA): You have the right to access, rectification, erasure, data portability, restriction of processing, and the right to object. You can also lodge a complaint with the competent supervisory authority (Germany: bfdi.bund.de).

CCPA (California, USA): You have the right to know what personal data we hold about you, to request its deletion, and to opt out of its "sale" (which we do not conduct).

To exercise your rights, please contact us at support@kitetheworld.net.

13. Children's Privacy

The Espresso is not intended for children under 13 years of age. We do not knowingly collect data from children under 13. If you believe a child has created an account without permission, please contact us immediately.

14. Changes to This Policy

We update this privacy policy when our data processing practices change. The date of the last update is shown at the top of the page. For material changes we will notify you via push notification or at the next app launch.

15. Contact

For all privacy-related enquiries and to exercise your rights:

ZG Media – Gianluca Zgur
Am Fendlbach 13 A, 82211 Herrsching, Germany
Email: support@kitetheworld.net