Privacy Policy: Seventh Steep

Effective: 2026-10-18. Published by Mark Bielinskyi (Ukraine). Contact: hop_fairer9v@icloud.com.

In short

• There are no accounts, no ads, no analytics and no tracking.
• Your shelf, notes and settings stay on your iPhone.
• A photo leaves your iPhone only when you ask the app to identify a tea, and only after you agree. It goes to our server and then to Anthropic, an AI service provider, which processes it.
• You can withdraw your agreement at any time in Settings, and delete all app data on your iPhone.

1. What the app stores on your iPhone

Your tea shelf, brewing notes, brew settings (vessel, units, sound, last brew) and preferences. This data stays on your device. It is not sent to us. The app can prepare iCloud sync, but this version does not turn it on. Widgets and Live Activities read this data on the same device.

2. Photo identification (optional)

If you choose to identify a tea from a photo, the app makes a smaller copy of the photo (longest side 1024 pixels), and sends it over an encrypted connection to our server. Our server sends it to the Anthropic API to get an estimate of the tea type. Our server does not store the photo and does not write it to logs. The result is shown to you. You can save a photo you took yourself to your shelf; that copy stays on your device.

We use the photo only to give you this result.

3. Other data our server handles

To limit use and prevent abuse, the app creates a random install identifier and stores it in the iPhone Keychain. It sends this identifier with each identification request and, if you have Plus, the signed subscription receipt from the App Store. The server keeps only a hash of the install identifier, together with counters of how many photos were identified; for Plus, the counters are linked to the subscription's original transaction number. It does not know your name, email or Apple ID. The identifier is shown in Settings > Photo and AI (with a Copy button). It is the identifier you send by email to request deletion (section 8). "Delete all data" keeps it, so that deleting data cannot reset the free quota, and it may survive deleting and reinstalling the app. The server also sees your IP address while it handles a request, uses it for rate limits and does not write it to logs.

On devices that support Apple's App Attest, the app also creates a cryptographic key in the secure hardware of the iPhone. The private key never leaves the device. The app asks Apple's App Attest service to confirm that the key belongs to a genuine Apple device running our app; this request goes from your iPhone to Apple, as Apple's documentation describes. The app then sends our server the key identifier (a pseudonymous identifier) and Apple's confirmation. Our server stores the key identifier, the public key, a counter that rises with each use, and technical values from the confirmation (the app version and a device integrity category), all linked to the hashed install identifier. Later requests carry a short signature made with the key, which the server checks against the stored public key and counter. We use this only to prevent fraud and abuse of the free photo quota. It does not tell us your name, email or Apple ID. For these checks the server also issues short-lived random challenges; they are deleted when used or when they expire (within 24 hours). The server does not keep the confirmation itself or the signatures. If a device does not support App Attest, the app offers manual choice, and Plus works as usual.

4. Purchases

Subscriptions and tips are handled by Apple. We do not receive your card or payment details. We learn only whether a Plus subscription is active, from the signed receipt in section 3, and we keep counters linked to the subscription's original transaction number. Plus photo identification works the same way: your photos are sent to an AI service after you agree. Tips unlock nothing.

5. Third parties

• Anthropic (AI service provider): receives the photo you ask us to identify, and the instruction we send with it. Anthropic deletes API inputs and outputs within 30 days of receipt, except in limited cases such as content flagged for policy violations, or where the law requires longer storage. Under its commercial terms Anthropic does not train its models on this content. We have a duty to give your data the same protection as this policy states, and we use Anthropic only for this purpose.
• Apple: App Store, purchases, and the App Attest check, for which your iPhone contacts Apple's App Attest service (section 3).
• Hosting provider: our server runs on Amazon Web Services (Amazon Lightsail, Stockholm, Sweden), which processes requests for us.

We do not sell your data and we do not share it for advertising.

6. Your consent and how to withdraw it

The app asks for your permission when you tap Identify, before any photo is resized or sent. The sheet names Anthropic. If you tap "Not now", nothing is sent and you can still choose your tea manually. To withdraw consent, open Settings > Photo and AI. "Delete all data" also clears your consent. After you withdraw, the app asks again before it sends any new photo. Photos already processed cannot be recalled from Anthropic, but they are deleted by Anthropic within the period in section 5.

7. How long we keep data

Photos: not kept by us; kept by Anthropic for up to 30 days (except the limited cases in section 5). Quota counters: deleted 90 days after the month or day they count has ended. Server logs (no photos, no receipts): up to 14 days. Data on your iPhone: until you delete it. Attestation key records: deleted after 180 days without use. App Attest challenges: deleted when used or when they expire (within 24 hours).

8. Deleting your data

• On your iPhone: Settings > Delete all data removes your shelf, notes and settings, and also clears your photo consent. It keeps the random install identifier that the app uses to count free photos; that identifier may also survive deleting and reinstalling the app. The counters on our server linked to it are deleted automatically 90 days after the period they count has ended, or earlier on request (see below). It also keeps the App Attest key, which is stored in the Keychain like the identifier. The key record on our server is deleted after 180 days without use, or earlier on request.
• On our server: we hold no name or email. To have the counters and App Attest key records tied to your install or subscription deleted, email hop_fairer9v@icloud.com and send the identifier shown in Settings > Photo and AI (or your subscription's original transaction number) so we can find it. We delete it within 30 days.
• Photos at Anthropic: they are deleted automatically within the period Anthropic states for API data (30 days when this policy was updated), except in the limited cases named in section 5. We cannot delete them earlier.

9. Children

The app is not directed at children. We do not knowingly collect personal data from children.

10. Your rights

Depending on where you live (for example the EU, the UK or California) you may have rights to access, correct or delete your data and to complain to a data protection authority. Write to hop_fairer9v@icloud.com.

11. Security

Data is sent over encrypted connections. No system is perfectly secure.

12. Changes

If we change this policy, we publish the new text at this address and update the date above. For a material change about photos, the app asks for your consent again.

13. Contact

Mark Bielinskyi, hop_fairer9v@icloud.com.