ShotGenius Privacy Policy

Last updated: November 6, 2026

1. Who we are

ShotGenius is published by FJB SAS, 6 rue Campagne Première, 75014 Paris, France (see the Legal Notice).

2. Data stored on your device

Your shots, beans, gear setup, scores, settings and photos are stored locally on your iPhone. If iCloud is enabled, Apple syncs them through your private iCloud database — we never see it, and it is covered by Apple’s iCloud terms.

3. What we receive when you use Genius or Explore

Genius

When you tap a Genius feature, the app sends our server what that feature needs to answer: the relevant coffee and shot parameters — including the notes you wrote on the shot or the coffee, which Genius reads as hints — the photo of the coffee bag you scan (for bag analysis, together with the roaster names already in your library so the model can recognize one), the address and text of a roaster’s page with the coffee’s name when Product page looks there for the coffee’s picture, and, for Similar’s coffee recommendations, your country and — when you allow it — your position rounded to a 250 m grid, so the suggestions can be bought near you and the cards can say how far a shop is. A recommendation limited to the roasters you know also carries the websites of the roasters in your library.

Explore

An Explore search sends the coffee you describe — the tasting notes, styles, roast, process, origin, variety and name words you pick, your filters and the websites of the roasters you pick — with your country and, when you allow it, the same rounded position; the server reads it for that one search and keeps none of it.

Your roasters and coffees

Separately, at most once a week, where our coffee index covers your country, the app checks the roasters of your library against it: it sends each roaster’s name with the website address saved in your coffee records, and the server answers from our roaster list. The name and website of a roaster our list does not know yet — from this check or from Similar’s options — are kept with no identifier attached, and our roaster search looks that name up on the web through our AI provider. It also asks our server whether our coffee index holds a coffee — each time you open the coffee’s page, tap Product page in its editor, add a coffee without its roaster’s website, import a coffee someone shared with you, or change a coffee’s name, roaster, origin, process or variety: it sends the coffee’s name (and the name it was first recognized by, if you renamed it), roaster, website, origin, roast, process, variety, tasting notes and description, which the server reads for one lookup and keeps nowhere — and, once you have allowed location, the same rounded position, so the page can say how far the roaster’s nearest shop is; the coffee’s page never asks for that permission itself.

Identifier

These requests also carry a pseudonymous technical identifier: the app transaction identifier Apple assigns to your App Store account (an opaque number containing no name, email or other readable personal information), or, when the app cannot read it, an identifier derived from your device’s attestation key. It serves quota accounting — the Similar and Explore searches of the Genius Starter Kit included — and abuse prevention. At launch the app also reports its version, your device model and iOS version.

Country and position

Our server records the country a request comes from — never your position: the rounded position a search carries is read to answer it and kept nowhere, neither in the request log nor in the 90-day copy of the request.

AI processing

AI processing is performed by our infrastructure provider Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) and our AI provider Anthropic, PBC (500 Howard Street, San Francisco, CA 94105, USA), acting as processors. These transfers to the United States are covered by appropriate safeguards (EU-U.S. Data Privacy Framework and/or standard contractual clauses). We keep the content of each request an AI model answers, and its answer, for 90 days, under your pseudonymous identifier, to diagnose failures and check suggestions, then delete it. We do not use your Genius queries to build a profile of you, to train models, or to sell them.

4. Shot sharing under a pseudonym

Each time you save a shot, the app sends our server a pseudonymous copy of its settings — brew parameters, equipment, the coffee (name, roast, origin) and your ratings — used to improve the app’s features (better grind and temperature guidance). This copy is tied to a dedicated pseudonym, shared by your devices through your iCloud, separate from the Genius identifier and impossible for us to link to you: we store no connection between the two. Your free-text notes and photos are never part of it, and only the hour of a shot is kept, not its exact time. Legal basis: our legitimate interest in improving the app, with a one-tap way out — Settings → RECIPES → Don’t share — which immediately deletes everything our server holds under that pseudonym and stops sharing on all your devices.

5. Purchases

Payments are processed entirely by Apple. We receive Apple-signed transaction information (product, dates, transaction identifiers) to activate your plan — never your name, address or payment details. These records are kept, without any name or address, as accounting records.

6. Feedback, contact form and crash reports

If you send in-app feedback, we receive your message, the photos you attach, your device model, iOS and app version, your language, your country, the gear you configured and a technical trace. The message is tied to your pseudonymous identifier, so we can look at your usage record to help you. Your email address reaches us only if you choose to provide it, and we use it only to reply to you. Through the contact form on this site, we receive your email address (required, so we can reply), the subject and message, your language and country, and, if you write as a professional, your roastery’s website. It receives no photos and no identifier. These messages are kept as long as in-app feedback, and the form keeps your network address for 48 hours to prevent abuse. Feedback is classified and translated by our AI provider Anthropic, acting as processor, so we can read and answer it.

Crash reports (Apple MetricKit) are sent automatically when iOS produces them. They contain no coffee data. They are linked to your pseudonymous identifier so we can match them with your feedback, and deleted after 90 days. Apple’s setting Share With App Developers controls whether your device produces them at all.

7. Connected gear

The app communicates with Bluetooth scales locally, on your device. If you connect a La Marzocco machine, authentication happens with La Marzocco’s cloud under their own privacy policy; your credentials and tokens are stored in your device Keychain. When Genius looks up a coffee on a roaster’s website, that website sees your device’s network address, as it would from a browser.

8. Permissions

Camera (photograph your coffee bags), Bluetooth (connect your scale), location while using the app (find coffees sold near you, in Similar and Explore, and say how far a roaster’s nearest shop is on a coffee’s page — rounded to 250 m on your device before it is sent, and kept nowhere) and adding to your photo library (save a bag photo from the share sheet), each optional and requested only in context. Importing a photo from your library uses Apple’s picker, which hands the app only the photo you choose and needs no permission.

9. Retention and deletion

On-device data is yours: delete the app, then its iCloud data (Settings → your name → iCloud → Manage Account Storage → ShotGenius → Delete Data) and it is gone for good. Without that second step, your iCloud restores your data if you reinstall the app. A few small technical items stay in the device keychain until the next install overwrites them — the cached App Store identity, your La Marzocco login if you set one, and a reinstall marker; none of them is your content.

Server-side, here is what we keep and for how long; whatever has a time limit is deleted automatically when it runs out:

• your usage ledger, under your pseudonymous identifier — while you use Genius, then 24 months after your last launch;
• the log of your Genius requests (type, cost, timing, country) — 13 months;
• the content of the requests an AI model answers, and of their answers, kept for diagnostics — 90 days; Explore and searches in our coffee index keep none of it;
• crash reports — 90 days;
• your support messages and our replies, with any photos — 24 months;
• your devices’ attestation keys — 12 months without activity;
• Apple’s purchase records, without name or address, and the link between an identifier derived from a device’s attestation key and your App Store account — kept as accounting records, with no deletion date;
• the names and websites of roasters our list did not know yet, with no identifier attached — kept to grow our list, with no deletion date; a name we find no website for is deleted 90 days after it was last asked about.

Our backups are kept 30 days: deleted data can remain in them for up to 30 days, then disappears. Shared shot settings are kept as long as you share them and can be erased at any time directly in the app (Settings → RECIPES → Don’t share). For any other erasure, write to us from the app (Settings → SUPPORT → Send Feedback): your message carries your pseudonymous identifier, which lets us find your data. If you have already written to us, the contact form works too, from the same email address.

10. Your rights (GDPR)

Access, rectification, erasure, restriction, portability, objection — write to us from the app (Settings → SUPPORT → Send Feedback), so that your message carries your pseudonymous identifier, or through the contact form. You may also lodge a complaint with your supervisory authority.

11. Children

ShotGenius is not directed at children under 13.

12. Changes

We will post any changes here and update the date above.