The short version
Kawaii Coffee Timer can be used without an account. Guest timer, brew-journal, bean, achievement, and customization data stays on the device. If you create an optional account or use an account feature, the app sends the information described below to Supabase for authentication and hosted app functions. The current release does not sell data, serve ads, track activity across other companies’ apps or websites, or use a configured production analytics service.
Information stored on your device
The app uses local storage to keep the experience working between launches. Depending on the features you use, this can include:
- timer lengths, current progress, points, themes, cup colors, accessories, sound choices, tutorial status, and onboarding selections;
- brew method, time, rating, notes, coffee and water amounts, and approximate caffeine totals;
- bean names, roasters, origins, roast levels, grind sizes, and flavor notes;
- achievements, streaks, and other app progress; and
- local notification and reminder settings.
Guest use does not require this information to be associated with an online account.
Optional account and hosted data
Kawaii Coffee Timer uses Supabase for optional authentication, database records, and file storage. If you create or use an account, Supabase may process:
- your email address, display name, account identifier, authentication-provider information, and security-session information;
- authentication audit events containing the linked account identifier, IP address, and user agent; the IP address can indicate coarse approximate location but is not device GPS or precise location;
- retained API, authentication, storage, and Edge Function request, response, and error metadata used to debug failures, protect the service, and maintain reliability, such as timestamps, service source, route or operation, response status, and error details;
- selected onboarding and profile preferences, including barista name, brew-method preference, daily goal, flavor profile, theme, and reminder choices;
- an avatar image if you explicitly select and upload one; and
- brew methods, sessions, beans, or related app records when a cloud-data feature is used.
Supabase automatically retains authentication audit events in external log storage to secure accounts, detect abuse, and support compliance. Its platform Logs Explorer also retains request, response, and error metadata from API, authentication, storage, database, and Edge Function services according to the project plan. These records can be associated with an account or network request, so Kawaii Coffee Timer discloses linked Other Diagnostic Data for app functionality, as well as linked coarse location derived from IP address. The app does not request device location permission or collect GPS coordinates. See Supabase Logging. Passwords are handled by Supabase authentication and are not provided to the publisher in readable form. Row-level access controls are used to separate authenticated users’ app records. No internet system can be guaranteed completely secure, so please use a unique password and do not put sensitive personal information in brew notes.
Sign-in options
The current Kawaii Coffee Timer build supports optional email-based accounts and guest mode. It does not expose Sign in with Apple because the Apple provider is not enabled or verified, and Google sign-in remains hidden unless a valid production client is configured. The app does not claim either provider works in this release.
Notifications and device features
The app may request notification permission after a completed brew or when you enable reminders. Current timer and reminder notifications are scheduled locally; the app does not register a server-side push token for marketing. If you choose an avatar, the app requests photo-library access only to select that image. If you enable biometric sign-in, Apple performs Face ID or Touch ID matching on the device; the app does not receive biometric templates.
Analytics, diagnostics, advertising, and tracking
The release described by this policy does not include the Sentry, RevenueCat, Superwall, or Google Sign-In native SDKs and does not contain a production PostHog key. It therefore does not send product analytics or crash reports to those services and has no live purchase catalog. Supabase service logs are still retained for app functionality as described above. The app does not serve advertising, request permission for cross-app tracking, sell personal information, or share personal information for targeted advertising. If a future release enables analytics, additional diagnostics, purchases, or advertising, this policy and the App Store privacy disclosures will be updated before collection begins where required.
Purchases
The current release does not offer a live in-app purchase or subscription. If a future release enables App Store purchases, Apple will process payment information and may provide purchase status needed to unlock and restore features. This policy will identify any additional purchase-validation provider before that service is activated.
Why information is used
Information is used only to provide the feature you request, authenticate and secure optional accounts, preserve preferences and progress, respond to support or deletion requests, prevent abuse, and meet legal obligations. It is not used to build an advertising profile.
Retention and deletion
Local data remains until you reset it, delete the app, or the operating system removes it, subject to Apple’s backup behavior. To clear timer progress and customizations while keeping the app, use Settings → Reset All Data.
To delete a hosted account in the app, sign in, open Profile, scroll to Delete Account, tap it, and confirm the red Delete Account action. The server requires both a valid signed-in session and that explicit confirmation. It removes the hosted Kawaii Coffee Timer profile, preferences, brew methods, beans, sessions, and hosted avatar objects associated with the user, then permanently deletes the Supabase authentication identity.
The Supabase authentication tenant is shared with other publisher services. Deleting the authentication identity is therefore global and irreversible, and can also delete or make inaccessible records in those services that are linked to the same identity. This cannot be undone. Provider backups expire under the provider’s retention process. Supabase authentication audit logs, API and service diagnostics, and limited records may remain under the provider’s plan-based retention controls when needed for security, reliability, fraud prevention, compliance, dispute handling, or law.
If you cannot sign in or access the in-app deletion control, email isaiahdupree33@gmail.com from the account email with the subject Kawaii Coffee Timer account deletion. Ownership may be verified before processing this fallback request.
Service providers and disclosures
Supabase processes optional account data on the publisher’s behalf. Apple provides the App Store, operating-system services, and any future App Store purchase processing. Google processes information only if a configured Google sign-in option is offered and you choose it. Information may also be disclosed when required by law, to protect users or the service, or as part of a business transfer subject to applicable safeguards.
Children
Kawaii Coffee Timer is a general-audience productivity and coffee app. It is not directed to children under 13, and the publisher does not knowingly collect personal information from a child under 13. A parent or guardian who believes a child supplied account information can contact the address below to request deletion.
Changes
If data practices change, this policy will be updated and the “Last updated” date will be revised. Material changes will be communicated in the app or by another appropriate method when required.
Contact
Privacy questions and requests can be sent to isaiahdupree33@gmail.com.
Controller
Kawaii Coffee Timer is published by Isaiah Dupree. Contact: isaiahdupree33@gmail.com