Privacy Policy for Sip Journal

Effective date: 13 September 2026 · Last updated: 13 September 2026

This privacy policy applies solely to the Android application Sip Journal (package com.mtgtechnical.sipjournal, referred to here as "the App"), published on Google Play by GeorgyGeorgy ("we", "us", "our"). It describes what data the App collects, how it is used and stored, who processes it, and how you can delete it.

In short: the App needs an account so your coffee journal can be saved, and what you save is stored with Google's Firebase services and kept private to your account. There are no ads and no analytics, and we do not sell or share your data. When the App crashes or something fails, it sends a crash report so we can fix it. You can delete your account and everything in it at any time.

1. Data we collect

Account information

To use the App you create an account, either with an email address and password or with Google Sign-In. Accounts are managed by Firebase Authentication, a Google service.

• Email and password sign-up: your email address. Your password is handled by Firebase Authentication.
• Google Sign-In: the basic profile Google provides when you choose to sign in with it, as held by Firebase Authentication: your name, email address, and the URL of your Google profile photo.

Firebase Authentication also sends account emails on our behalf: a message to verify your email address, and a password reset message when you ask for one.

Profile information you choose to add

In Your Profile you can optionally enter a first name, last name, your coffee experience, and a location. All of these are free text that you type yourself, and all are optional. This profile location is only the text you type.

Your coffee journal

The content you create in the App is saved to your account so that it is there whenever you sign in:

• Tasting journal entries: the entry name, the flavours and tasting notes you select, your free-text notes, the date and time of the entry, whether it is a draft, the bean and recipe you linked to it, and, if you add one, where you had the coffee (see below).
• Saved coffee beans, including their tasting notes.
• Brew recipes.
• Equipment lists: the brewers, grinders and other equipment you add, including custom items you create.

Where you had your coffee (optional)

When you log a tasting you can choose to add where you had it. If you do, the entry stores the place's name and address (when known), its map coordinates, and whether you chose it by searching, from nearby cafés, from your current location or by dropping a pin. The App shows these locations back to you on your entries and on your journal map.

The App reads your device's location only on the screen where you choose where a tasting happened, and only if you allow location access. If you have already allowed it, the App takes one position as soon as you open that screen for a tasting that has no location yet; if you have not, it asks only when you tap Use my location. The App uses that position to centre the map and to look for cafés nearby, which means sending it to the Overpass API (see below). It never tracks your location in the background, and nothing about your position is saved to your account unless you choose to add it to an entry.

Photos

When you create a custom equipment item you may attach a photo to it. The App only accesses a photo when you pick one yourself using the system picker, and only the photo you pick. The App saves a small square copy of it, without its metadata (such as where it was taken), in Cloud Firestore under your account. The App does not access your photos at any other time.

Map and place search services

Maps and place search use free services built on OpenStreetMap data. They are separate from your account and receive no account information, but like any website they receive your IP address with each request:

• OpenStreetMap map tiles (tile.openstreetmap.org, operated by the OpenStreetMap Foundation) receive requests for the map areas you view.
• Photon (photon.komoot.io, operated by komoot) receives the text you type into place search together with the coordinates the map is centred on, which may be your current position, so that nearer places are listed first. It also receives the coordinates of a pin or your current position when the App looks up its address.
• Overpass API (overpass-api.de) receives your device's position when the App looks for cafés near you.
• Nominatim (nominatim.openstreetmap.org, operated by the OpenStreetMap Foundation) receives an area of about 1.5 km around your device's position when the Overpass API can't answer, to look for cafés near you instead.

Crash reports

If the App crashes, or an action fails (for example a save that could not complete), the App sends a crash report to Firebase Crashlytics, a Google service, so we can find and fix the problem. A report contains the technical details of the failure (the error type and code, where in the App it happened, and which action was being performed), your device model, Android version, the App version, and an installation identifier created by Crashlytics. Crash reports do not include your name, email address, account identifier, journal entries, notes, locations or photos. Crashlytics keeps crash reports for 90 days.

App integrity checks

To protect your account and data from requests that do not come from the genuine App, the App uses Firebase App Check with Google Play's Play Integrity API. When the App talks to Firebase, Google checks that the request comes from an unmodified copy of the App installed from Google Play and issues a short-lived token. This check involves information about your device and App installation, processed by Google; it is not used to identify you and is not stored with your account.

Technical data processed by Google

To provide Firebase services, Google may process technical data such as your IP address and information about your device and app installation. This is handled by Google as described on Google's Firebase privacy and security page. We do not use it to track or profile you.

2. How we use your data

We use the data above only to provide the App to you:

• to create your account, sign you in, verify your email address and let you reset your password;
• to save your journal entries (including any locations you add), beans, recipes, equipment, profile details and photos, and show them back to you when you are signed in;
• to show maps, find places you search for, and find cafés near you while you choose where a tasting happened;
• to find and fix crashes and failures (crash reports), and to check that requests come from the genuine App (App Check).

We do not use your data for advertising, and we do not use it for anything unrelated to running the App.

3. Where your data is stored and who processes it

The App is built on Google Firebase. Google acts as our service provider (processor), hosting and processing the data on our behalf:

• Firebase Authentication holds your account information.
• Cloud Firestore holds your profile details, your coffee journal and any photos you attach to custom equipment. The database is located in Europe, in Google Cloud's eur3 multi-region.
• Firebase Crashlytics holds crash reports, which contain no personal content (see section 1).
• Firebase App Check and Google Play's Play Integrity API check that requests come from the genuine App.

The App also shows reference content that we curate: the bean finder catalogue, brew guides, and the equipment catalogue. This is shared, read-only content that is the same for every user, and it contains no personal data.

4. What we do not do

• The App shows no advertising and contains no advertising SDKs.
• The App contains no analytics SDK. Crash reports (section 1) are used only to fix problems, never to measure or profile how you use the App.
• We do not sell your data, and we do not share it with third parties. Google processes it only as the service provider described in section 3. The map and place search services in section 1 receive only the requests described there, never your account or journal.

5. Security

Your data is private to your account. The database's security rules restrict each user's data to that user: when you are signed in, you can read and change only your own profile, journal entries, beans, recipes and equipment, and no other user can read yours.

Data travelling between the App and Google's servers is encrypted in transit using HTTPS (TLS).

6. Data retention

We keep your account information and the content you save for as long as you have an account. It is kept until you delete it or delete your account, as described below. Crash reports are deleted automatically after 90 days.

7. Deleting your account and data

You can delete your account in either of two ways:

• In the App: go to Your Profile → Delete account and confirm. This permanently deletes your account and all of your journal entries (with any locations you added), beans, recipes, equipment, profile data and uploaded photos.
• By email: write to support@mtgtechnical.com from the email address your account uses and ask for your account to be deleted.

Step-by-step instructions, and the full list of what is deleted, are on the Delete your Sip Journal account page.

8. Children's privacy

The App is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us at support@mtgtechnical.com and we will delete it.

9. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with a revised "Last updated" date above.

10. Contact us

If you have questions about this privacy policy or the App's data practices, contact GeorgyGeorgy at support@mtgtechnical.com.