Puck Life — Privacy Policy
Last updated: 11 September 2026
Puck Life ("the App") is a coffee-shot logging tool for espresso enthusiasts, built by AK Forge Ltd ("we", "us", "our"). This policy describes what data we collect, how we use it, who we share it with, and the choices you have.
The short version: Puck Life stores your coffee shots in your own Supabase project, scoped to your account via row-level security. We don't sell your data. We don't run analytics on your shots. The only third parties we talk to are Google (so you can sign in) and Supabase (so your data has somewhere to live).
01 What data we collect
Account data. When you sign in with Google, we receive your email address and a stable Google user identifier. We use these to authenticate you and to scope your data to your account.
Coffee logs. The shots you log — bean name, roaster, roast date, dose, yield, grind setting, shot time, taste score, notes, and the timestamps of when you logged them — are stored in our database. This is the core of what the App does.
Beans list. The beans you add — name, roaster, and roast date — are stored alongside your shots so the freshness widget can show them.
Bean selections. The "currently selected" bean pointer (which bean you've marked as in use) is stored locally on your device and in your account's cloud row.
App configuration. Your setup values (machine, grinder, basket size, target ratio, target shot-time range) are stored in your account so they sync across devices.
Local diagnostic data. When the App encounters a sync error it can't recover from automatically, the debug build of the App writes a single line to the device console describing the failure (a technical reason, not a transcript). This is only in debug builds and is never sent off-device.
We do not collect:
- Device identifiers or advertising IDs
- Location data
- Contact lists or calendar access
- Microphone, camera, or photo library contents (the App does not request these entitlements)
- Crash analytics from third-party SDKs (no Crashlytics, Firebase, Sentry, or similar)
- Product analytics (no Mixpanel, Amplitude, Segment, or similar)
02 How we use your data
- To provide the App. Your coffee logs are stored in your account and synced between your devices when you sign in.
- To authenticate you. Your Google identity is used only to verify that you are who you claim to be. We do not use it to build a profile of you, sell advertising, or share with third parties.
- To operate the freshness widget. A small summary of your current bean and its freshness is computed from your data and made visible in the App's home-screen widget.
- To send local notifications. Reminder notifications you configure (e.g. "log a shot at 18:00") are scheduled on-device via the iOS notification system. We do not send push notifications from a server.
We do not use your data for advertising, marketing, profiling, training AI models, or selling to data brokers.
03 Where your data is stored
Your data is stored in a Supabase project hosted in the London region on Supabase's infrastructure. Supabase's infrastructure and security practices are described at https://supabase.com/security.
Your data is stored in a row keyed by your Google user identifier, with row-level security policies that ensure you can only read and write your own rows. Our database administrators cannot read your shot rows in normal operation.
A copy of your most recent data is also held in your device's local storage (Apple's SwiftData/Core Data) and in the App Group container shared with the home-screen widget. This copy is wiped when you sign out or uninstall the App.
04 Who we share data with
Google. We use Google to authenticate you. Google receives your sign-in attempt and returns your email and stable user identifier. Google's handling of that data is governed by Google's privacy policy at https://policies.google.com/privacy.
Supabase. Our database and authentication backend. Supabase's handling is described in their privacy policy at https://supabase.com/privacy.
Apple. App Store distribution, in-app purchase processing (we don't have any), push notification routing (we don't have any). Apple's handling is described at https://www.apple.com/legal/privacy/.
Nobody else. We do not share your data with analytics providers, advertising networks, customer support tools, error trackers, marketing platforms, AI training pipelines, or any other third party. We do not sell your data.
05 Your rights
You can at any time:
- Export your data. The App's Settings → Data section lets you export your shot log as JSON.
- Delete your data. Sign out and contact us at the email below; we will delete your account row from our database within 30 days.
- Revoke Google access. Visit https://myaccount.google.com/permissions and remove Puck Life's access. This does not delete your existing coffee logs — for that, use the contact address below.
- Delete the App. Uninstalling the App removes the local copy of your data. The cloud copy remains until you request deletion as above.
If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR / UK GDPR / CCPA, including the right to data portability, the right to rectification, and the right to lodge a complaint with a supervisory authority. We honour these requests regardless of where you are based.
06 Children
The App is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us at the email below and we will delete it.
07 International transfers
Supabase hosts data in the London region. If you sign in from outside the UK / EEA, your data is transferred to the UK for storage. Supabase's standard contractual clauses and data processing addendum apply to these transfers; see https://supabase.com/legal/dpa.
08 Security
We use industry-standard practices: TLS for data in transit, Supabase's managed database encryption for data at rest, row-level security policies on every table, no secrets committed to the App's source code, OAuth credentials rotated when compromised (last rotated 11 September 2026).
No system is perfectly secure. If you discover a security issue, please report it to the contact address below rather than disclosing it publicly.
09 Changes to this policy
If we make material changes, we will:
- Update the "Last updated" date above.
- Show an in-app notice the next time you open the App.
Non-material changes (typos, clarifications) may be made without notice.
10 Contact
AK Forge Ltd
Email: team@akforge.co.uk
For data deletion requests, security reports, or any other privacy question, please email us. We aim to respond within 7 days.