Privacy policy
Bollaspá reads coffee cups for entertainment. This page says exactly what the app and its server handle, and what they do not.
What we process
- Cup photos. When you ask for a reading, the photo of your cup (and the saucer, if you add one) is sent to our server and passed to Anthropic's Claude API, which produces the reading. We do not store the photo; it is discarded when the reading is returned. Anthropic processes it under its own API data policy, which retains inputs for a limited period for safety and abuse monitoring.
- Your name and question. If you type them, they travel with the photo to produce the reading and are not stored by us.
- The reading itself. Readings are kept only on your device (in your browser's or the app's local storage) so you can reopen them. Clearing the app's data removes them.
- A device identifier. The app generates a random identifier on first use. It is used to give each device one free reading and, in the App Store version, to tie your purchases to this device. It is not derived from your name, Apple ID, advertising identifier or hardware.
- Usage counters. Our server keeps short-lived counters keyed by a one-way hash of your IP address, to limit abuse (for example how many free readings can be started from one network per day). The hash cannot be turned back into your address and the counters expire.
- Purchases. In the App Store version, purchases are made through Apple. We use RevenueCat to verify that a purchase or subscription is valid before serving a paid reading; RevenueCat receives the device identifier and Apple's purchase receipt, not your payment details. On the web, payments are handled by Stripe and we receive only a payment confirmation and a subscription status, never your card details.
What we do not do
- No accounts, no email sign-up, no passwords.
- No advertising, no tracking pixels, no analytics SDKs, no sale or sharing of data for marketing.
- No photo is stored on our servers, and no photo is used to train any model by us.
- No precise location, contacts, or access to your photo library beyond the single photo you choose.
Who receives data
Anthropic (the reading model), Cloudflare (hosting, usage counters), Apple and RevenueCat (App Store purchases), and Stripe (web payments). Each processes only what is listed above.
Retention
Photos, names and questions: not retained by us. Usage counters: one to two days, purchase-consumption records: for as long as the purchase could be redeemed. Readings: on your device until you delete them.
Children
Bollaspá is entertainment for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children.
Your rights
Because we keep almost nothing, most requests are answered by the facts above. If you believe we hold data about you, or want a purchase record deleted, write to hjalti@urru.ai and we will answer within 30 days. Residents of the EEA and Iceland have the rights set out in the GDPR, including the right to complain to the Icelandic Data Protection Authority (Persónuvernd).
Changes
If this policy changes, the effective date above changes with it and the app shows the new version.