Privacy Policy

This Privacy Policy explains how Kubilay Tekin (“Cofai”, “we”, “us”, “our”) collects, uses, discloses, and protects information when you use the Cofai mobile app (“App”) and the website at cofai.app (“ Site”), together the “Service”. By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

1. Who we are

Cofai is developed and operated by Kubilay Tekin, an individual developer based in Turkey, acting as the data controller for the Service. You can reach us at tekinkubilay08@gmail.com.

2. Information we collect

a. Account information

• When you sign in with Apple or Google, we receive a unique identifier and, if you choose to share it, your name and email address (or Apple's private relay email).

b. Profile information you provide

• Display name (required), birth date, gender, relationship status, and focus areas (love/career/money/health/general) — all optional except display name, used to personalize your readings.

c. Content you create

• Photos of your coffee cup and, optionally, the saucer grounds, that you capture or upload to generate a reading.
• The AI-generated fortune reports produced from your photos, and your reading history.
• Gamification data such as your daily reading streak and total reading count.

d. Technical & usage information

• Basic device and app information (OS version, app version), crash and error logs, and a push-notification token if you enable notifications.

e. Website information

• Standard web request data (such as IP address and browser type) generated by visiting the Site. The Site itself does not use advertising or analytics cookies and does not require you to create an account.

3. How we use your information

• To generate your personal coffee-fortune reading from your photos.
• To personalize reports using your profile information and chosen focus areas.
• To maintain your reading history, streak, and account.
• To send optional push notifications, if enabled.
• To provide customer support and respond to your requests.
• To detect abuse, enforce fair-use limits, and keep the Service secure.
• To comply with legal obligations.

We do not use your cup photos for advertising, we do not use them to train general-purpose AI models beyond what is necessary to generate your own reading, and we do not sell your personal information.

4. How your photos are processed

To generate a reading, your cup and saucer photos are sent to a third-party AI vision provider (currently accessed via OpenRouter, using a Google Gemini vision model) solely to analyze the images and produce your fortune report. Photos are transmitted securely and are used only to fulfill your request — not to build advertising profiles.

5. Camera & Photo Library access

The App requests access to your device camera and, if you choose to upload an existing image, your photo library. This access is used solely to let you capture or select cup and saucer photos for your reading. We do not access your camera or photo library in the background, and we do not scan your existing photo library beyond the image you actively select.

6. Who we share information with

• Supabase — our database, authentication, and file-storage provider, which hosts your account data, reading history, and photos.
• AI processing provider (OpenRouter / underlying model provider) — processes your photos to generate each reading, as described above.
• Apple and Google — provide Sign in with Apple / Google authentication; we never see or store your password.
• Push notification service (Expo) — delivers notifications if you enable them.

We do not sell or rent your personal information to third parties. We may disclose information where we have a good-faith belief it is necessary to: comply with a legal obligation, court order, or governmental request; enforce these policies or our Terms of Service; detect, prevent, or address fraud, security, or technical issues; protect the rights, property, or safety of us, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in each case consistent with this Policy.

7. Data retention

We keep your account, profile, readings, and photos for as long as your account is active. When you delete your account in the App (Profile → Settings → Delete Account), your profile, readings, and photos are permanently and irreversibly deleted. You can also request deletion by emailing tekinkubilay08@gmail.com. Backups or logs retained for security or legal-compliance purposes are deleted or anonymized on a rolling schedule.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to withdraw consent, and to object to or restrict certain processing. This includes rights under the EU/EEA General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK). To exercise any of these rights, use the in-app account deletion feature or contact us at tekinkubilay08@gmail.com. We will respond within the timeframe required by applicable law. If you are in the EU/EEA or Turkey, you also have the right to lodge a complaint with your local data protection authority (in Turkey, the Personal Data Protection Board / KVKK Kurulu).

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended, may give you additional rights, including the right to know what personal information we collect, request deletion, and opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. To exercise your CCPA rights, contact us at tekinkubilay08@gmail.com.

10. Do Not Track

Our Site does not currently respond to browser “Do Not Track” signals, as there is no accepted industry standard for how to do so. The Site does not use advertising trackers.

11. Children

The Service is rated for ages 12 and up due to its mystical/fortune-telling theme and is not directed at children. You must meet the minimum age of digital consent in your country to use the Service, and sign-in requires an Apple or Google account. We do not knowingly collect personal information from children under 13 (or the applicable minimum age in your country). If you believe a child has provided us with personal information without appropriate consent, contact us and we will promptly investigate and delete it.

12. International data transfers

Our service providers may process and store information in countries other than your own, including outside the EU/EEA and Turkey. Where required, we rely on appropriate safeguards offered by our providers (such as standard contractual clauses) for such transfers.

13. Third-party links

The Service may contain links to third-party websites or services (such as the Apple App Store or Google Play). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing them with information.

14. Security

We use reasonable technical and organizational measures — including access controls and private storage — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you become aware of a security issue affecting the Service, please report it to tekinkubilay08@gmail.com.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you in the App or on the Site. Your continued use of the Service after changes take effect means you accept the updated Policy.

16. Contact us

Questions about this Policy or your data? Email tekinkubilay08@gmail.com.