Pour ScorePour Score
Privacy Policy
1. Who we are
Pour Score is a latte art coaching application operated by Marlon Kazim May, trading as Pour Score ("we", "us", "our"), a sole trader. We are based in the United Kingdom.
We are the data controller for personal data collected through the Pour Score app. This means we decide how and why your data is processed.
We are not required to appoint a Data Protection Officer under UK GDPR: our processing does not involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category data (such as health or biometric data). Marlon Kazim May is the person responsible for data protection matters at Pour Score and can be reached at the contact below.
For questions about this policy or how we handle your data, contact us at support@pourscoreapp.com. We aim to respond within 5 working days.
2. What data we collect and why
We collect only the data we need to operate the app and provide you with coaching and community features. Below is every category of data we collect, why we collect it, and the legal basis under UK GDPR.
2a. Account data
What: Email address, username (handle), and the date and time you confirmed you are 18 or older. If you sign in with Apple or Google, we may also receive and store a name or picture that they pass to us. We do not show any of this to other users.
Why: To create and manage your account, authenticate you, show your username, tier, streak and pour count to other users, and make sure Pour Score is only used by people aged 18 and over.
Legal basis: Performance of a contract — you need an account to use Pour Score.
Who can find you: Other signed-in users can find your username by searching for it, and in a list of people who have posted. There they see your username, tier and pour count, and a button to follow you. They can open your profile, which shows your streak and the pours you have made public. They cannot see your email address or the rest of your account data. If you block someone, they can no longer find you this way and you can no longer find them. To stop being listed or found by search, turn on "Hide me from search" in Edit profile. It is off by default. It removes you from the list and from search only: your username still shows on pours you have made public. You can also object by emailing support@pourscoreapp.com.
2b. Equipment profile data
What: Coffee machine brand and model, grinder brand and model, milk jug brand, model and volume, cup brand, model and volume, preferred milk type.
Why: To personalise AI coaching feedback and pattern guidance to your specific setup.
Legal basis: Legitimate interests — personalised coaching is the core purpose of the app and users reasonably expect this personalisation.
2c. Pour photographs
What: Photographs of your latte art that you capture or upload within the app.
Why: To provide AI-powered scoring and coaching feedback. Photographs you choose to post are also displayed to other users on the community feed.
Legal basis: Consent — you actively initiate each AI analysis and each community post. You can withdraw consent by not posting and by deleting existing posts.
Important: Pour photographs submitted for AI analysis are transmitted to OpenAI (see Section 4). Photographs you post publicly are visible to other Pour Score users. Photographs you do not post remain private.
2d. Pour log and progress data
What: Your pour history, AI scores across dimensions (symmetry, texture, contrast, definition), comfort scores (your private 1–5 self-rating), AI coaching notes, tier level and accuracy, streak count and personal best.
Why: To track your progress over time and deliver personalised coaching insights.
Legal basis: Performance of a contract — progress tracking is a core feature of the app.
Privacy note: AI dimension scores, comfort scores, coaching notes, and your last pour date are private to you. Only your tier, streak, and pour count are visible to other users.
2e. Community and social data
What: Posts you publish (photographs, captions), comments you write, likes you give, users you follow, users you block, reports you make, and reports other users make about your content.
Why: To operate the community feed and social features of the app, and to keep it safe: we use reports and blocks to review content, act on it, handle appeals and keep a record of what we did (Section 11 of our Terms).
Legal basis: Performance of a contract, because community features are part of the service you signed up for. Reviewing and acting on illegal content is also a legal obligation under the Online Safety Act 2023.
2f. Device and technical data
What: Device orientation sensor data (tilt angle, used for the guided pour feature only), device type and operating system version, app version, and, once push notifications are switched on, a push notification token.
Why: The tilt sensor data powers the real-time cup angle guide during a guided pour session. It is processed locally on your device and is not stored or transmitted. Device and OS data is used for technical support and to ensure compatibility. Once push notifications are switched on, push notification tokens are used to send you coaching results and streak reminders.
Legal basis: Legitimate interests for technical data. Consent for push notifications — you can withdraw this at any time in your device settings.
Time zone. We read your phone's time zone setting (a name such as "Europe/London" or "Australia/Sydney") and store it on your profile. We use it so your streak days, and your monthly AI score allowance, start and end at your own midnight. It is a device setting, not your location: we do not ask for location permission, do not use your IP address for this, and cannot tell where you are from it. It updates automatically if you change your phone's time zone, at most once a day. We keep it until you delete your account.
2g. Authentication data
What: If you sign in with Apple, Google, or email and password, we receive the information provided by that method. For Apple Sign In and Google Sign In, this is typically a unique identifier and, optionally, your email address. We never receive your Apple or Google password.
Why: To authenticate you securely without storing passwords ourselves where third-party sign-in is used.
Legal basis: Performance of a contract.
2h. The scoring library (not in use)
We do not currently keep copies of your pour photographs for a scoring library. If we ever do, we will ask you first and you will be able to say no and change your mind at any time. We will update this policy before we start.
2i. Our website and support email
What: When you visit pourscoreapp.com, your IP address and browser details are received by the company that hosts the site. If you email us at support@pourscoreapp.com, we receive your email address and your message.
Why: To deliver the website, keep it secure, and answer your questions and requests. The website sets no cookies, uses no analytics on the website, and serves its fonts from our own site.
Legal basis: Legitimate interests: running the website and replying to people who contact us.
We keep support emails only as long as we need them to deal with your query, and no longer than 2 years.
2j. Early access list
What: If you join the early access list on pourscoreapp.com, we collect your email address, the date and time you signed up, the date and time you confirmed it, and a record of the wording you agreed to. The sign-up form is the only place we ask for this, and we ask for nothing else.
Why: To email you about early access (beta) invitations, and to tell you when Pour Score launches. The sign-up form has a second, optional box for a weekly latte art tip, and tips go only to people who ticked it. People who signed up between 3 and 13 October 2026 agreed to tips as part of one combined box, and we count that as their agreement. We will not use your email for anything else, and we will not pass it on.
Legal basis: Consent. You tick a box to join, and we send you a confirmation email first. We only add you to the list once you click the link in it. You can withdraw consent at any time by using the unsubscribe link in any email from us, or by emailing support@pourscoreapp.com, and we will remove you.
Important: You must be 18 or over to join. If you take part in the early access programme and create an account, your account is covered by the rest of this policy. Joining the list does not agree you to anything else. If we ever ask you to take part in anything beyond these emails, we will ask you separately.
Technical note: The sign-up form sends your email directly to our database, which is run by Supabase (see Section 4). Supabase receives your IP address as part of that request, in the same way as any website.
2k. Crash reports and usage counts
What: When you use the Beta (TestFlight) and, later, the public app on the App Store and Google Play, the app sends crash reports, linked to your account ID. A crash report has what the app was doing when it failed, your device type, operating system and app version.
Not included: your pour photographs, captions, comments, messages or the contents of your pour log. We do not record your screen or your sessions.
Why: To find and fix crashes.
Legal basis: Legitimate interests: keeping the app working.
Usage counts. We count how often parts of the app are used, for example how many times a screen is opened or the Start free trial button is tapped. We add each one to a daily total on our own database. The total does not include your account, your device, your name, your email, your photos, anything you type, or the time of day, so we cannot tell which person did what. We use the totals to see where people get stuck and to improve the lessons and the subscription screen.
Legal basis: Legitimate interests: improving the app, using counts that are not about an identifiable person.
If you object: turn off Share usage counts in Edit profile (Privacy). This phone then stops adding to the totals. The counts already added cannot be traced to you, so we cannot take them back out. Until you turn it off, counting also happens before you sign in.
3. Data we do not collect
We do not collect or process:
- Your precise GPS location
- Your contacts or address book
- Payment card details (handled entirely by Apple's or Google's payment systems; we never see your card number)
- Any biometric data
- Any data about your device's other apps or browsing history
- Advertising identifiers (we do not run ads in V1 of the app)
- Any usage data that identifies you. The usage counts in Section 2k carry no account, device or time information.
4. Who we share your data with
We share data only where necessary to operate the app. We do not sell your data to anyone. One service below, push notifications, is not switched on yet. It says "when enabled" and applies only from the day we switch it on.
OpenAI (AI analysis)
When you log a pour with a photograph and ask for an AI score, that photograph is transmitted securely to OpenAI, L.L.C. via their API. We ask for your permission before the first photograph is sent. If you say no, your pour is still logged, without a score. OpenAI processes the image to generate your coaching score and feedback, then returns the result to us. Per OpenAI's API data usage policy, images submitted via the API are not used to train OpenAI's models. OpenAI retains API inputs and outputs for up to 30 days for abuse-monitoring purposes before deletion, unless a longer period is required by law.
We keep the score, the coaching note and a record that a score was used (for your monthly allowance and your tier progress). We do not use a score to decide anything about you other than your tier progress, which you can see in the app.
OpenAI is our data processor for this purpose, acting under our instructions. For more information on OpenAI's data practices, see openai.com/enterprise-privacy.
Supabase (database and file storage)
Your account data, early access list emails, pour log, progress data, and community content are stored on servers operated by Supabase, Inc. Our Supabase project is hosted in the UK (London region). Usage counts (Section 2k) are also stored there; they hold no personal data. Supabase acts as our data processor and processes data only on our instructions. For more information, see supabase.com/privacy.
Expo (app updates, and push notifications when enabled)
When the app checks for a new version, Expo's servers receive the device's operating system and a random token, and the device's IP address as part of the request. Push notifications are not switched on yet. Once they are, your device push token is also sent to Expo so it can deliver them. Expo acts as our data processor for these purposes. For more information, see expo.dev/privacy.
RevenueCat (subscription management)
When you start a trial or subscription, your subscription status and purchase history are managed by RevenueCat, Inc. RevenueCat does not receive your payment card details, which are handled directly by Apple or Google. RevenueCat acts as our data processor. For more information, see revenuecat.com/privacy.
GitHub (website hosting)
Our website, pourscoreapp.com, is hosted by GitHub, Inc. on GitHub Pages. GitHub receives visitors' IP addresses to deliver the pages and may keep them in its server logs for security. GitHub acts as our data processor for this purpose. For more information, see docs.github.com/site-policy/privacy-policies.
Zoho (email)
Emails you send to support@pourscoreapp.com, and the confirmation and early access emails we send you, are handled by Zoho Corporation's email service, hosted in its EU data centre. Zoho acts as our data processor for this purpose. For more information, see zoho.com/privacy.html.
Sentry (crash reports, from our Beta and public launch)
Functional Software, Inc. (Sentry) receives the crash reports described in Section 2k. Our project stores data in its EU data region, and Sentry acts as our data processor. For more information, see sentry.io/privacy.
Apple (Sign In with Apple, payments, App Store)
If you use Sign In with Apple, Apple processes your authentication. If you make an in-app purchase, Apple processes your payment. Apple acts as an independent data controller for these purposes under its own privacy policy. For more information, see apple.com/privacy.
Google (Sign In with Google, payments, Google Play)
If you use Sign In with Google, Google processes your authentication. If you buy a subscription on Android, Google processes your payment through Google Play. Google acts as an independent data controller for these purposes under its own privacy policy. For more information, see policies.google.com/privacy.
Our social media accounts and Buffer
We run Pour Score accounts on Instagram and TikTok and schedule our posts with Buffer. If you follow, comment on or message those accounts, Meta (Instagram) and TikTok process your data under their own privacy policies. We see what those platforms show us: your public profile, your comments and messages, and statistics about our posts. Buffer receives our posts and those statistics, and acts as our data processor. We do not copy your social media data into the Pour Score app.
Legal and safety disclosures
We may disclose your data if required to do so by law, court order, or regulatory authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Pour Score, our users, or the public.
5. How long we keep your data
| Data type | Retention period |
|---|---|
| Account and profile data | Retained while your account is active |
| Pour photographs | Retained while your account is active or until you delete the post |
| Pour log and progress data | Retained while your account is active |
| Community posts, comments, likes | Retained while your account is active or until you delete the content |
| Push notification tokens | Retained while your account is active |
| Early access list email | Until you unsubscribe or ask us to remove it, or 12 months after we announce the launch, whichever is sooner. Sign-ups that are never confirmed are deleted after 7 days |
| Technical and diagnostic data, including crash reports | 90 days on a rolling basis |
| Reports, blocks and moderation records | As long as we need them to keep the service safe, and no longer than 2 years after the report is closed. Blocks last until you remove them or delete your account |
| AI scores and the record of scans used | Retained while your account is active. Deleting a pour does not give the scan back |
| Daily usage counts | Kept while the app runs. They hold no personal data |
| Data after account deletion | Permanently deleted within 30 days of your deletion request, unless we must keep it by law, for example material reported to a child safety authority |
When you delete your account using the Delete Account feature in the app, we initiate a full deletion of all your personal data across our systems, including photographs stored in Supabase Storage. This process completes within 30 days.
6. Your rights under UK GDPR
As a UK resident, you have the following rights in relation to your personal data. Usage counts (Section 2k) cannot be linked to you, so we cannot find, correct or delete the counts that came from you.
Right to access: You can request a copy of the personal data we hold about you.
Right to rectification: You can correct inaccurate data through your profile settings, or contact us to correct data you cannot edit yourself.
Right to erasure: You can delete your account and all associated data at any time using the Delete Account button in your profile settings. We will complete the deletion within 30 days.
Right to restrict processing: You can ask us to pause processing your data in certain circumstances.
Right to data portability: You can request your data in a structured, commonly used format.
Right to object: You can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests. To stop being listed in the people list and handle search, you do not need to contact us: turn on "Hide me from search" in Edit profile.
Right to withdraw consent: Where processing is based on your consent (AI analysis, push notifications), you can withdraw at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at support@pourscoreapp.com. We will respond within one month. We will not charge you for requests unless they are manifestly unfounded or excessive.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
7. Data security
We take reasonable technical and organisational measures to protect your personal data:
- All data transmitted between the app and our servers uses HTTPS encryption (TLS)
- Data stored in Supabase is encrypted at rest by default
- Authentication tokens are stored in your device's secure storage (iOS Keychain or Android Keystore), not in plain text
- Access to our database is controlled by Row Level Security policies — each user can only access their own private data
- API keys and server credentials are stored as server-side secrets and never included in the app's code
No system is completely secure. If you believe your account has been compromised, contact us immediately at support@pourscoreapp.com.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected users without undue delay, as required by UK GDPR.
8. Children
Pour Score is for people aged 18 and over. We ask everyone to confirm they are 18 or older when they sign up. If someone tells us they are under 18, we do not create their account, or we delete it straight away if it was created through Apple or Google sign-in, and we keep no data from the attempt.
We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account or has given us personal data, contact us at support@pourscoreapp.com and we will delete it promptly.
9. International data transfers
Our primary data processors (Supabase, Expo, GitHub, Sentry, Buffer, OpenAI and RevenueCat) may process data in the United States or other countries outside the UK. Where data is transferred outside the UK, we ensure appropriate safeguards are in place. Depending on the provider, these are the UK Extension to the EU-US Data Privacy Framework (for US companies certified to it), standard contractual clauses together with the UK Addendum issued by the ICO, or the UK's adequacy regulations (which cover the European Economic Area, where our email provider's data centre is). Our hosting database is in the UK (London).
10. Changes to this policy
We may update this policy from time to time. When we make material changes, we will notify you via a push notification or an in-app notice at least 14 days before the change takes effect. The updated policy will always be available at pourscoreapp.com/privacy and within the app.
Continued use of Pour Score after the effective date of a change constitutes your acceptance of the updated policy.
11. Contact
Pour Score
Operated by Marlon Kazim May, trading as Pour Score
168a Battersea Park Road, London, SW11 4ND, United Kingdom
support@pourscoreapp.com
pourscoreapp.com
Responsible for data protection: Marlon Kazim May
For data protection queries: support@pourscoreapp.com
For ICO complaints: ico.org.uk
12. Additional information for people in Australia and New Zealand
Pour Score is run from the United Kingdom, and UK law applies to us. We collect and use your information in the same way wherever you are. This section adds what people in Australia and New Zealand are told about their rights. We try to follow the Australian Privacy Principles and the New Zealand Information Privacy Principles for people in those countries, whether or not the law requires us to.
12.1 Your rights
You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it. You can also delete your account and your data in the app (Profile, Delete account). Email support@pourscoreapp.com from the address on your account. We reply within 20 working days.
12.2 Sending your information overseas
Your information is stored in the United Kingdom, on servers in London run by Supabase. To run Pour Score we also send information to companies in other countries, as set out in Section 4: OpenAI (photographs you ask us to score, only after you allow it) and RevenueCat and Expo in the United States, and Sentry and Zoho in the European Economic Area. These companies may not be required by law to protect your information in the same way as the Australian Privacy Act 1988 or the New Zealand Privacy Act 2020. We have contracts with them that require them to protect it, and we stay responsible for it. By using Pour Score you agree to your information being sent to these companies for these purposes. If you do not want a photograph sent to OpenAI, say no on the permission screen, and your pour is still logged without a score.
12.3 Complaints
Please contact us first at support@pourscoreapp.com. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you are in Australia, or to the Office of the Privacy Commissioner (privacy.org.nz) if you are in New Zealand.
12.4 Data breaches
If a breach of security is likely to cause serious harm to you, we will tell you and, where the law of your country requires it, the privacy regulator.