Privacy Policy

• Account. Your email address and a securely hashed password (or, if you use Google/Apple sign-in, the identifier they return). We never see your raw password. We also keep the public nickname, if you set one, and your answer to the AI question below.
• Your entries. The text, voice transcripts, photos, and videos you log, plus the structured fields we extract from them and any corrections you make — and the brews, beans, recipes, goals and experiments you keep.
• Health & fitness data (only if you connect it). If you enable Health sync in the mobile app, we read the specific categories you authorize — sleep, steps, and body weight — from Apple Health (HealthKit) on iOS or Health Connect on Android. We read only what you grant, only to create journal entries for you. The only thing the app writes to Apple Health is, while you leave it on, the estimated caffeine of each brew you save; we do not access any other health categories. See Apple Health and Health Connect below.
• Billing. If you purchase a subscription or credits, payments are processed by Stripe. We store a Stripe customer reference and your plan/credit status, never your full card number.
• Feedback you send us. If you use Send feedback in the app or on the web, we keep your message and the screenshot you choose to attach, if any, with your account, together with a few details the app or website adds: the app version (in the app, also its build and update), your platform and your language; in the app, your operating system, your device model and, if you connected a scale since you opened the app, its name, model and firmware; on the web, the page you sent it from. The app lists these details before you send. A copy is forwarded to the developer through Telegram (see below). An attached screenshot is re-encoded on our server before it is stored, which removes its location, camera details and all other embedded metadata.
• Limited diagnostics. Standard server logs (e.g. request timing, errors) to keep the service running and secure, and crash and error reports with some performance timings (see Sentry below). If you turn on “Send raw scale data with brews”, the raw Bluetooth readings of your coffee scale (weights and timing, no personal data) are attached to each brew so we can find and fix scale problems; they are never shown publicly. If you send a recording from Scale diagnostics in the app, it contains the same kind of raw readings plus your phone’s operating system and version, the app version, and the scale’s name, model and firmware.

• To provide the core features: storing your entries and extracting structured data from them.
• To generate your summaries, correlations, insights, and answers to your questions about your own log.
• To process payments and apply your plan/credits (via Stripe).
• To secure the service, prevent abuse, and fix problems.

We do not sell your data, we do not use it for advertising, and we do not use your health data for anything other than the journaling features you ask for.

The iOS app asks whether you want to use AI features right after you sign in, before it makes any AI request. On the web and in the Telegram bot, AI features stay on until you turn them off; on the web, a one-time card on the Record page offers the same choice. App versions installed before this question was added don’t ask either, so there too AI features stay on until you turn them off.

You can answer Allow or Not now, and turn AI features off or on at any time with the AI features switch: in the app under More → Settings, on the web under Settings → Account (/settings/account). The switch belongs to your account, so it applies everywhere you use BellaJournal, the Telegram bot included.

With AI on, the relevant entry text (including voice transcripts) and, for photo entries, the images are sent to our AI provider, OpenRouter, which passes them to a model provider — OpenAI, Google or Anthropic — to compute the result: when you log something, ask a question, request insights, a brew note, a coffee-bag scan, a recipe import or a new custom activity, and when the app writes your daily summary or coaches you on a goal. Those answers draw on your recent entries, which include entries made from your Health data. When you use BellaJournal in a language other than English, the names and field labels you typed for your own custom activities are also translated with AI. When you compare an insight with the wider community, the text of that insight is also used for a web search. This processing happens only to produce features for you.

If you send the Telegram bot a voice note, we download the recording and send it to OpenRouter to be transcribed — only while AI features are on. The audio isn’t stored; the transcript becomes your entry.

A bag photo is kept with the bean; an imported screenshot is not stored.

With AI off, nothing is sent to an AI provider: your entries and brews are still saved — just not analysed — and the AI actions are hidden.

When you dictate an entry in the app or on the web, the speech recognition built into your phone or browser — Apple’s, Google’s or, in Microsoft Edge, Microsoft’s, depending on your device and browser — turns your voice into text. Apple, Google or Microsoft may process the audio on their own servers, under their privacy terms. From dictation we receive only the resulting text, never the audio. (Voice notes sent to the Telegram bot are different: see AI features above.)

If you connect Apple Health (HealthKit) on iPhone, or Health Connect on Android, the app reads sleep, steps and body weight — only the categories you allow.

On iPhone, each brew you save with a dose also adds its estimated caffeine(about 10 mg per gram of coffee) to Apple Health as Dietary Caffeine, named after the brew’s bean, once per brew, if you allow it. Brews made on the Demo scale (no coffee was made) and doses over 40 g (more than one cup) are not written. You can turn this off in the app under More → Settings → Apple Health, or deny it in the Health permissions. Nothing else is written to Health, and nothing is read back from what the app writes.

This data is used only to log journal entries for you and to show your summaries and insights (with AI on, those entries are part of what the AI features analyse, as described above). It is never used for advertising or marketing, never sold, and never shared with anyone except the service providers listed below, only to provide these features.

You can revoke access at any time: on iPhone in Settings → Health → Data Access & Devices → BellaJournal; on Android in the Health Connect settings. Revoking it stops all future syncing; entries already made stay in your journal until you delete them or your account.

Photos and videos you attach to entries, and coffee-bag photos, are stored as you upload them — including any details your camera embedded, such as where they were taken. The cover photo of a shared brew is re-encoded on our server before it is stored, which removes its location, camera details and all other embedded metadata.

We share data only with the service providers needed to run the app:

• Cloudflare — sits in front of the website and the app’s connection to our servers to deliver and protect them; it handles all traffic, including your IP address.
• Amazon Web Services (AWS), in the United States — runs our application server, database and file storage.
• OpenRouter, and the model providers it routes to (OpenAI, Google, Anthropic) — AI text/image processing for extraction, summaries, insights and answers, only while AI features are on. Community insights use a web search through OpenRouter.
• Apple, Google or Microsoft (Edge) speech recognition — only when you dictate (see above).
• Stripe — payment processing (only if you buy a subscription or credits).
• Telegram— only if you choose to link the optional Telegram bot to log from chat. Voice notes you send it are transcribed through OpenRouter while AI features are on (see above). The feedback you send us is also forwarded to the developer through Telegram: your message (up to its first 1,500 characters), your nickname if you set one (otherwise the start of your internal account id), the details listed under “Feedback you send us” above, and, if you attached a screenshot, a link that only our admins can open. Alerts about new errors reach the developer the same way: the error’s title, where in the code it happened, the app version and a link to Sentry — never who ran into it.
• Sentry(Functional Software, Inc.), in the United States — crash and error reports from the website, our server and the iOS and Android apps, so we can find and fix what broke, and, for about one in ten page loads, requests and app launches, how long they took. A report contains the type of error and where in the code it happened (the stack trace), the app version, your browser or device model and operating system, and the page or screen. Reports from our server and the app also carry your internal account id (in the app while you’re signed out, a random installation ID that Sentry creates instead) — never your email, your entries, notes, photos or anything else you wrote, no record of what you tapped, and no request contents. Like any server, Sentry sees the IP address a report comes from; it is set not to store it, or any location derived from it. Reports are deleted automatically after at most 90 days.
• Expo(650 Industries, Inc.), in the United States — delivers updates to the iOS and Android apps. When the app checks for an update (when it starts, and when you come back to it after a while), it sends its platform, the app and update version and a random install ID that isn’t linked to your account, and, after a launch that failed, the error message; Expo also sees your IP address. No journal content or account details are sent.

Each of these providers processes your data only to provide its service, and is bound by terms that require it to protect your data at least as strictly as this policy does.

We do not share your data with anyone else unless the law requires it, and we never sell it.

Brews are private by default. If you set a brew to link only, anyone with its link can see that one brew; if you set it to public, it also appears in Discover. A shared brew shows its curve, recipe numbers, equipment, bean details (with how many days off roast, never the roast date), tasting scores, the one-line public comment you write for it, and the AI note — never your email, your account name, journal entries, or the free-text tasting notes you typed. Because the AI note can paraphrase those notes, you can hide it on any shared brew.

A shared brew is anonymous unless you turn on show my nickname for that brew; then it shows the public nickname you chose (never the name on your Google or Apple account). If you add a cover photo, we re-encode it on our server before it is stored, which removes its location (GPS), camera details and all other embedded metadata.

Anyone can like a shared brew without an account. To count each visitor once, we set an anonymous cookie (a random id, not linked to you) and store only a one-way hash of it — or your account id if you are signed in. To stop abuse of likes and reports we use a hash of your IP address that changes every day; raw IP addresses are never stored. Shared brews also show how many people brewed or saved them, without saying who. You can make a brew private again at any time, and anyone can report a shared brew for review.

Your data is stored on our servers and database in the United States and is transmitted over encrypted (HTTPS) connections. On your phone, your login token is stored in the device’s secure keystore (iOS Keychain / Android Keystore). We keep your data for as long as your account exists.

When you delete your account, your entries, brews, photos and everything else in it are deleted from our database and file storage straight away, and your sign-ins end on every device. What remains:

• Stripe keeps its own records of past payments, as the law requires.
• Our server logs (which record your account id, not your email) and backups are not edited one by one; they are overwritten on a rolling basis. Error reports in Sentry expire on their own (see above).
• Feedback you sent is deleted with your account, but the copy already forwarded to the developer’s Telegram chat stays there.
• A shared brew’s page and cover image may stay in browser and Cloudflare caches for up to 5 minutes, and link previews that chat apps already fetched can’t be recalled.

• Export. You can export all of your entries as CSV or JSON at any time.
• AI features. Turn them off or on at any time with the AI features switch in Settings.
• Delete. You can delete individual entries, disconnect Health sync, or delete your entire account yourself — in the app under More → Settings → Delete account, or on the web under Settings → Account. See how to delete your account.
• Health permissions. You can revoke the app’s Health access at any time in the iOS Health app or Android Health Connect settings; revoking it stops all future syncing.
• Sign out. Signing out of the app removes its login token from that phone; deleting your account revokes it on every device.

BellaJournal is not directed to children under 13, and we do not knowingly collect their data.

We may update this policy; we’ll revise the “Last updated” date above and, for material changes, notify you in the app.

BellaJournal is operated by Bellarivia Limited, Hong Kong. Questions about your data? Email [email protected].