Legal
Privacy Policy
Dosemojo is a coffee companion: you tell it how you like coffee, log what you brew, and Mojo, our AI assistant, uses that to give better answers. This policy explains what we collect to do that, why, who helps us process it, how long we keep it, and what you can do about it.
1. Who we are
The data controller for the Dosemojo app (web, iOS and Android) and this website is:
- Company
- Magic Pulpo Kft., a limited liability company registered in Hungary
- Tax number
- HU24077849 (EU VAT number)
- Registered address
- Széll Kálmán tér 15., 1122 Budapest, Hungary
- Registry
- Company registration number 01-09-392254, kept by the Budapest-Capital Regional Court as Court of Registration (Fővárosi Törvényszék Cégbírósága)
- hello@dosemojo.com
Write to hello@dosemojo.com with any question about your data. Put "Privacy" in the subject line and we will reply within one month.
2. What we collect
What you give us
- Account: your email address, and optionally a name, username, profile photo, bio and password. We sign you in with a code or link sent to your email.
- Taste profile: your answers when you join (how you drink coffee, your goals, the tastes you like, how you brew, your grinder) and the taste profile we build from them.
- Gear and coffee: the equipment you add to your rig, the coffees in your stash and the ones you save.
- Brews: what you log: coffee, recipe, method, dose, grind, ratings, tasting notes, photos, and for a cup at a café, the café and the drink.
- Conversations with Mojo: the messages you send and Mojo's replies, plus a technical record of each reply (see section 4).
- Scans: photos of coffee bags or gear you take with Scan Bag, and what we read from them.
- Community: posts, comments, likes, follows, shared recipes, cupping sessions, reports you file and contributions you send to the catalog.
- Home location: if you add one, the town or city you type and its coordinates.
- Feedback: thumbs up or down on Mojo's replies, and anything you write to us.
- Partners: if you fill in the "Join the project" form on this website, your organisation, name, work email, role and message.
What we collect when you use the app
- Precise location, only when you ask: when you ask for cafés near you, the app asks your device for your location, rounds it to about 11 metres, and uses it to answer that question.
- Usage events: which screens and features you use (for example "brew logged", "scan completed"), with a random device ID, a session ID, the app version, your device type and, if you arrived from a link, the campaign tags in it. Never the content of your brews or chats. You can turn this off (see section 11).
- Sponsored post measurement: whether a sponsored post was shown, tapped, saved or hidden, recorded against a one-way hash of your device ID, without your account.
- Abuse protection: a count of calls to our AI features per account, so one account cannot run up unlimited cost.
- Technical logs: our hosting providers keep standard server logs (IP address, time, request) for security and troubleshooting.
We do not collect payment details: nothing is sold in the app today. We do not buy data about you from anyone.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Run your account and the app: sign-in, your profile, journal, stash, rig, Mojo, Scan Bag, recipes, the feed | Account, profile, gear, brews, chats, scans, community content | Contract, Art. 6(1)(b) |
| Personalise Mojo's answers and recommendations to your taste and gear, and refine your taste profile from rated brews | Taste profile, gear, stash, brews, chats | Contract, Art. 6(1)(b). You can stop rated brews refining your profile in Settings → Taste data |
| Find cafés near you | Location at the moment you ask | Consent, Art. 6(1)(a), given through your device's location prompt |
| Send sign-in codes and account emails | Email address | Contract, Art. 6(1)(b) |
| Understand which features are used and improve the product | Usage events | Legitimate interest, Art. 6(1)(f): building a product people use. You can object at any time in Settings → Usage analytics |
| Check Mojo's answers for mistakes and fix them | Chats and their technical records, feedback | Legitimate interest, Art. 6(1)(f): giving accurate answers |
| Count views and taps on sponsored posts and report totals to advertisers | Sponsored post events (hashed device ID) | Legitimate interest, Art. 6(1)(f): funding a free app. Advertisers only see totals |
| Keep the service safe: bot checks at sign-in, limits, abuse prevention, checking posts and comments, moderation of reports | Call counts, logs, reports, the content of posts and comments | Legitimate interest, Art. 6(1)(f) |
| Product news and announcements | Your account | Consent, Art. 6(1)(a). Off unless you turn on Settings → Notifications → Product & news |
| Answer partner requests from this website | Partner form | Steps before a contract, Art. 6(1)(b) |
| Meet legal obligations | What the law requires | Legal obligation, Art. 6(1)(c) |
We do not sell your personal data, and we do not use your data to make decisions about you that have legal or similarly significant effects.
4. Mojo and AI
Mojo runs on Claude, a model made by Anthropic. When you send Mojo a message, scan a bag or ask for a recipe, we send Anthropic what it needs to answer: your message, the recent conversation, and the relevant parts of your profile (taste, gear, stash, recent brews, home town). Anthropic processes it on our behalf to produce the reply. Under our agreement with Anthropic, data sent through its commercial API is not used to train its models.
We do not train AI models on your data. "Mojo learns" means Mojo reads your saved profile and history each time it answers.
To check answers and fix mistakes, we keep a technical record of each Mojo reply: which catalog lookups it made, which cards it showed or dropped, how long it took and what it cost. A small team at Dosemojo may read conversations for that purpose. To search our coffee knowledge base, the text of your question is also turned into a search vector by Voyage AI.
You can switch off Mojo's recipe suggestions in Settings → Brew AI.
5. What other people can see
Your profile (name, username, photo, bio, gear, stash, follower counts) and your posts are public by default, so other members, and anyone with a link to your profile, can see them. Turn on Settings → Private profile to hide your profile from discovery; posts you already made public stay visible until you delete them. Your email, taste profile, journal, chats and scans are never shown to other people.
6. Sponsored posts and shop links
Dosemojo is free. Some posts in the feed, and some cards shown under Mojo's answers, are paid for by roasters, cafés or gear makers. They are always labelled "Sponsored", and "About this ad" tells you who paid and why you are seeing it. We choose them by context (for example the city or kind of product in Mojo's answer) and by frequency limits, not by your taste profile or a profile of your behaviour. Sponsored content never changes what Mojo recommends, and never appears under recipes or troubleshooting.
When you tap a link to a shop, you leave Dosemojo and that shop's own privacy policy applies. Some shops may pay us a commission on a sale; that never changes which shops Mojo shows.
7. Who processes your data
We use these providers to run Dosemojo. Each processes data only on our instructions, under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | EU (Ireland) |
| Vercel | Hosting of the web app and this website, and this website's visit counts (Web Analytics: pages viewed and where visitors came from, without cookies) | Global edge network; US company |
| Anthropic | Mojo, Scan Bag, AI recipes and dial-in advice, and the automatic check of posts, comments and their photos | US |
| Voyage AI | Search vectors for questions to the knowledge base | US |
| Cloudflare | Turnstile, which checks that a sign-in comes from a person: it sees your IP address and browser signals at that moment | Global edge network; US company |
| Web Risk, which checks links in posts and comments against lists of harmful websites: it receives the link, not who posted it | US | |
| Resend | Sign-in codes and account emails | Sent from the EU (Ireland); US company |
| Apple, Google | App distribution and, if you allow them, notifications | Global |
Some features also contact third-party services directly from your device, which therefore see your IP address:
- Komoot Photon (OpenStreetMap data), to turn the home town you type into a place.
- wsrv.nl, an image service that resizes coffee photos so they load fast.
- Google Fonts, which serves the app's and this website's typefaces.
- YouTube, in privacy-enhanced mode, only when you tap play on a video.
We may also disclose data when the law requires it, or to a buyer if Dosemojo is sold, in which case this policy continues to apply.
8. Transfers outside the EU
Where a provider processes data outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. Write to us for a copy of the relevant safeguards.
9. How long we keep it
- Your account and everything in it (profile, brews, chats, scans, posts): while your account exists. When you delete your account, it is closed at once and permanently erased after a 30-day grace period, in case you change your mind.
- Usage events of a signed-in account: deleted with the account. Events from a device that never signed in: deleted after 13 months.
- Search statistics (what was searched, with no account attached): 180 days.
- Allowance records (how many AI requests an account made, and when): 100 days.
- Partner requests from this website: while we are in contact, and up to two years after the last message.
- Server logs at our hosting providers: according to their own short retention periods.
We may keep some data longer where the law requires it, or to establish or defend a legal claim.
10. What we store on your device
This website sets no cookies. It counts page views and referrers with Vercel Web Analytics, which works without cookies and keeps no identifier of your visit beyond the day; nothing it records names you. Links from this website into the app carry campaign tags (where you came from, which button you tapped), which the app stores as described above.
The app stores, in your browser's local storage or your phone's app storage, what it needs to work: your sign-in session, your settings, a random device ID, answers you are still giving during sign-up, and conveniences such as which tips you have dismissed. Before you create an account, the app stores nothing that outlives the browser tab. It uses no advertising or third-party tracking cookies.
11. Your rights
Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting what was done before. Most of this you can do yourself in the app:
- Download my data (Settings → Account): everything in your account as a JSON file.
- Delete account (Settings → Account): closes the account and erases it after 30 days.
- Usage analytics (Settings → Preferences): turn off to object to usage events.
- Taste data, Brew AI, Location services and Private profile in Settings.
- Edit or delete your profile, brews, posts and comments at any time.
For anything else, write to hello@dosemojo.com. We may ask you to confirm the request from the email address on your account. If you think we have not handled your data properly, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu) or to the data protection authority where you live, but we would like the chance to put it right first.
12. Age limit
Dosemojo is for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has created an account, write to us and we will delete it.
13. Security
Data travels encrypted (HTTPS) and is stored with our database provider in the EU. Access to each person's data is limited by database rules that let you read and change only your own private data, and only a small team at Dosemojo has administrative access. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
14. Changes to this policy
When we change this policy we update the date at the top. If a change matters, for example a new use of your data, we will tell you in the app or by email before it applies.