Fovma Privacy Policy

This Policy explains the current data practices of Fovma, the Steam Diary and Milk Foam Workshop. Fovma provides server-backed quick entry, a configurable workshop profile, foam-photo reviews, a journal and comparison tools, practice plans and consumable coin purchases.

Our aim is to collect data for these features rather than advertising. We do not use advertising identifiers, advertising profiles or third-party advertising/analytics SDKs in the app. The app does not automatically send feature-interaction histories or session-length analytics. Network services necessarily receive connection information needed to deliver and protect requests.

After you accept the welcome agreements and choose Start Brewing or Agree & Continue, Fovma sends its canonical installation identifier, installation proof, device mark and login/device context to the Fovma backend. The initial identifier uses iOS’s vendor identifier when available, with a generated UUID as fallback; the proof is a random secret. The backend forwards the device mark, canonical identifier, device family/system label, time-zone identifier and GMT description to its upstream account service. That service supplies an account identifier, session credential and a separate numeric Profile ID used for display. These associate requests with an account; no email/password registration form is required. Eligible later cold launches obtain a fresh login response before app-start, rather than relying only on an old session.

The app creates or reads its permanent installation identity locally during initialization, before sign-in; this local step is separate from sending the login request. That identity consists of the canonical identifier, random installation proof and project-specific device mark, stored in the iOS Keychain. Account identifier and session credential occupy separate Keychain entries; Profile ID, journal data, portraits and balances are not saved there. The entries use device-only accessibility after the first device unlock and are not configured for iCloud Keychain synchronization. A separate successful-login flag is stored in a marker file in the app sandbox. Its directory is excluded from device backup. The file contains only that login flag, not installation proofs, account/session secrets or business data. Automatic restoration requires both that marker and a complete Keychain account pair. Keychain values can survive uninstall, whereas deleting the app normally removes the sandbox marker. On a fresh sandbox, surviving account credentials are cleared and the app requires explicit sign-in, while retaining the permanent installation identity. Offloading that preserves app data is different. Keychain persistence across every reset, transfer or reinstall is not guaranteed.

After our backend confirms Sign Out, the app removes the independent Keychain account entries, resets the sandbox login flag to signed out, and clears account memory and applicable caches; the permanent installation identity remains, as does server business data. The Fovma relay does not treat a cached session as its own local session registry, and sign-out is not a promise to revoke the upstream account or all upstream credentials. Deletion cleanup happens after the matching backend acknowledgment and has the boundaries in Section 8. Reusing a surviving installation identity during explicit sign-in may reconnect to an existing upstream account, subject to the service response and retained associations; neither reinstall nor Keychain survival guarantees recovery. Our backend retains account/Profile ID mappings and receipt-routing/catalog metadata; it does not persist the current relay session credential as a local session record.

• Profile: your generated or edited workshop name and the portrait you choose. A name may identify you if you choose to enter your real name; the earlier claim that we never collect names does not apply.
• Review submissions: the selected foam image, foam type, steam pressure, tip depth, duration, starting temperature, optional measured final temperature and optional note.
• Results: estimated texture score, uniformity and temperature feedback, issues, suggestions, labels, generated artwork and the illustrated result, together with record identifiers and dates.
• Practice: titles, focus, notes, planned dates, durations and completion state you save. The session timer runs in the app; saved plans and completions are service data.
• Reserve: free-review usage, promotional and purchased balances, reservation/consumption records, account-ownership hashes where present, and transaction metadata described below.

These data are sent to and stored by the Fovma service to provide your profile, saved history, comparisons, trends, practice and reserve. Examples and educational content are delivered separately from your personal data. Choosing an image creates a preview; saving the portrait or submitting a review uploads it. Images are resized/compressed and metadata is removed as part of preparation and server normalization.

Private uploaded media require account authorization and there is no public gallery of your submissions. In addition to the installation and account information in Section 2, login sends each of the following: time-zone identifier; GMT description and UTC offset; the fixed entry-language tag and preferred interface-language tag; interface locale; calendar identifier; preferred text-size category; VoiceOver on/off status; Reduce Motion on/off status; device family, form factor and system label; app identifier, version, build and distribution label; fixed application-context and consent fields; a request UUID and timestamp. The system label identifies iOS, not your personally assigned device name; the current request does not include the iOS version. App-start sends account/session/device and app/request context plus preferred interface language, interface locale, calendar identifier, preferred text-size category, VoiceOver on/off status and UTC offset; it does not send Reduce Motion status again. These values are read when constructing login or app-start and reach the Fovma backend, where their presence and basic format are checked as required by the current request contract. Coin-catalog, ordinary business and receipt-confirmation requests do not capture this reading/accessibility snapshot. The backend forwards the canonical identifier, device mark, device family/system label, time-zone identifier and GMT description to the upstream account service for login. App-start forwards account/session/device context; it does not forward the reading/accessibility fields to that private login or app-start call. The current backend does not use VoiceOver, Reduce Motion, calendar or text size for foam analysis, advertising, account eligibility or a personalized result, and does not save those settings in its business records. Their transmission is request context, not a claim that a server feature needs them. Local accessibility rendering can use iOS settings independently. No uploaded reading/accessibility setting is supplied to the AI review provider. Avoid putting unrelated personal information in photos or notes.

Camera: requested when you choose to take a photo for a foam review. Declining does not prevent selecting an existing image or using features that do not require a new camera capture.

Photo selection: Fovma uses the iOS system photo picker for cup photos and portraits. It receives only the selected items; it does not request broad photo-library access or scan your library. The picker is a user selection mechanism, not permission to access all photos.

You can change camera permission in iOS Settings. Fovma does not request location or contacts access for these features and does not perform face recognition or biometric identification.

Dictation is available for editable form fields such as steam parameters, review notes, practice entries and the workshop name. Opening the dictation panel does not start recording. Tapping Record words requests Speech Recognition and Microphone permissions as needed, then captures audio for Apple Speech transcription.

Depending on device, language and Apple’s service availability, audio may be processed on the device or sent to Apple. Fovma does not force on-device-only recognition. Apple’s processing and retention follow its applicable terms and privacy information; we do not promise that Apple retains nothing. See Apple’s Siri and Dictation privacy information.

Fovma uses audio buffers for the active transcription and does not save audio files or upload recordings to the Fovma server, OpenRouter or Google for foam review. Recording stops when you stop it, close the panel, move the app to the background, encounter an interruption or reach the recording limit.

You may edit the transcript, apply it to the field, undo the application before closing, or cancel and discard it. Only text you apply becomes form content. When you later save or submit that form, the text is handled like typed input; an applied review note is included in the AI analysis request. Denying either permission leaves typing available. You can revoke permissions in iOS Settings.

Each new review requires a separate affirmative choice in its submission form. The selected photo, entered steam parameters and optional note are sent to the Fovma service, then through OpenRouter to the Google Gemini model provider for analysis and image generation. Analysis produces the score, observations and next-step advice. The image stage uses the original photo and validated analysis; its prompt does not include the raw optional note. Fovma also composes precise labels around your original photo using the returned analysis.

We do not intentionally include your workshop name, portrait, installation secret, session token, account-ownership secrets or payment details in AI requests. Anything you place inside the selected photo or optional note is nevertheless part of the submitted content; please avoid personal or sensitive material.

Leave the form’s agreement off, turn it off before submitting, or close the form to decline processing. Permission applies only to the current submission and is not granted by the welcome-screen checkbox. There is no persistent AI-consent setting. After submission, leaving the app or hiding the progress view cannot retract a request already received by a processor; it may finish in the background. You can delete saved records or delete your account afterward.

OpenRouter and the model provider have their own service and privacy rules. Retention, abuse monitoring and any training use depend on those rules and the applicable provider configuration. We do not guarantee zero retention, immediate third-party deletion or blanket exclusion from training. See OpenRouter’s Privacy Policy and Google’s Privacy Policy. Fovma stores your submitted content and results as described here rather than discarding all data immediately after processing.

Apple handles one-time consumable coin-pack purchases through StoreKit 1. Fovma receives no payment-card number, banking credentials or Apple ID password. Before payment, the app requests the chosen product from Apple; display catalog prices and coin amounts come from the Fovma backend. After a purchased/restored transaction, the app reads Apple’s unified receipt and checks that it contains the current product and transaction identifiers. This is a local readiness check, not signature or payment verification. When needed, one Apple refresh is followed by bounded local file checks. The complete ready unified receipt file is Base64-encoded and uploaded to the Fovma backend, without limiting it to the selected transaction, together with the current transaction ID, product ID, account identifier, session credential and installation device mark. The original-transaction reference falls back to the current transaction ID if no original is available; the backend goods ID is included when available, along with a recovery indicator and limited app/request metadata. The receipt may include other in-app purchase entries for Fovma, not just the purchase being confirmed.

The backend selects an acceptance path from the upstream account-service response obtained at login. In the forwarding path, the unified receipt, product/current transaction identifiers, optional goods ID and account/session/device context go to the upstream receipt service, which decides acceptance. In the direct path, the backend accepts without an upstream receipt call or independent Apple receipt validation. Local readiness and backend acceptance therefore do not establish the same thing. Attached coin-credit processing, when local account/catalog data permit it, durably records an idempotent credit. The service retains transaction/product identifiers, credited amounts/dates, balances and account-ownership records to avoid duplicate credit and maintain the reserve; the current Fovma Node implementation does not durably store the raw uploaded receipt. This is not a claim about the upstream receipt service’s retention. The first six completed reviews are free, then each completed review uses 12 coins; failed/indeterminate work releases reserved allowance.

If receipt readiness expires, that attempt makes no backend receipt submission and leaves the StoreKit transaction unfinished. Check Pending Purchases in Coins explicitly retries unfinished purchased/restored transactions; account restoration, returning to Coins and foreground reconciliation can also process them. Each processing attempt submits at most one ready receipt. A backend acceptance finishes the StoreKit transaction even if optional local credit did not occur, so an accepted response is not proof of a balance increase. A definitive upstream rejection marked by the backend also finishes the transaction without a credit; other failures leave it available for a later attempt. Apple handles refund requests. Consumables already delivered are not restored as reusable App Store entitlements.

Remaining purchased balance is retained separately on our service and never assigned to another user. Explicitly signing back into the same available account normally preserves access. The current app has no recovery-code creation, entry or paid-balance recovery screen. Reinstallation may preserve permanent Keychain identity, but a missing sandbox marker requires explicit sign-in and clears residual account credentials. Account deletion removes that account pair and resets the sandbox login flag while retaining the permanent identity. Neither action guarantees reconnection to the former paid wallet, and a newly allocated profile does not automatically inherit it. Contact support about purchase-access issues; proportionate ownership evidence may be needed, but we do not promise manual recovery or transfer. Apple’s refund rules and mandatory consumer rights remain applicable.

Business data are service-owned. The app holds form drafts, downloaded profiles and catalog data in memory, including a shared bounded image cache. Account memory and applicable image/URL caches are cleared on sign-out or deletion; the app does not maintain a persistent offline journal or local coin ledger. Legal and reserve WebViews use nonpersistent web sessions. Keychain installation/account values and the separate sandbox login marker are handled as explained in Section 2; sign-out and account deletion do not erase the permanent installation identity.

Purchased coins do not expire merely because the app has not been opened. Remaining paid balance, the transaction/product/credit ledger, account-ownership information where present and the lifetime free-review counter are retained separately. They are not given to a newly allocated profile or another user. A later sign-in associated with the same available wallet can show its retained paid balance with a fresh business profile, but cannot restore reclaimed records or promotional coins. A surviving installation identifier alone is not a promise that this association remains accessible.

Delete Account: confirming Profile → Delete Account sends the current account/session/device context to the Fovma backend. The backend retires a local business record if present, removes its name, portrait/uploaded-media references, saved analyses, practice plans and promotional balance, revokes its local sessions and disables its local installation associations. Removing media references makes those files inaccessible through the account API and triggers removal of unreferenced image files; this is not a guarantee of instantaneous physical erasure of every copy. Only after an acknowledgment matching the affected account does the app remove the Keychain account identifier/session, reset the sandbox successful-login flag to signed out, and clear account memory, applicable caches and retired local business storage. The marker file can remain with a false login flag; this is not deletion of all installation storage. The permanent Keychain identifier, installation proof and device mark remain. The backend retains paid balance and financial/ownership records, account/Profile ID mappings, receipt-routing/catalog records and limited job metadata. It does not send deletion to the upstream account or receipt service. The retired workshop’s paid balance is not assigned to the next profile, and there is no in-app screen to recover it. Contact support first for unresolved purchase-access issues; ledger retention or support contact does not guarantee recovery.

Individual saved pours and practice plans can also be deleted using their controls. Removing the app alone sends no server deletion request. Keeping the permanent device identity does not recover deleted business data. Deletion from Fovma does not revoke Apple payments, request a refund or guarantee deletion of previously transmitted data from the account/receipt service, Apple or AI processors; their own retention and deletion procedures apply.

Fovma and its service infrastructure receive the installation/account/device context, profile, storage and purchase requests described above. The upstream account service receives the login device/identifier/time-zone fields and account/device context for app-start; the upstream receipt service receives purchase evidence only in the forwarding acceptance path. These are distinct from OpenRouter and Google, which receive AI inputs described in Section 6. Apple handles optional Speech, product/payment requests and receipt refreshes. Audio is not part of a foam-review or receipt-confirmation request. Data can be processed outside your country by these services, subject to applicable legal protections.

Connection information such as the client IP address is processed to route requests and protect endpoints against abuse. A valid public client address can be forwarded with account/start/receipt relay requests to the upstream service. Business processing can retain status/error codes, timings, job identifiers, provider request identifiers and costs. The published Release app excludes full request/response logging, and the Node service does not intentionally log credentials or complete receipt/photo bodies. This does not mean those values are not transmitted to the relevant services, or guarantee another service’s logging policy.

The app uses HTTPS for the published Fovma API. Private media endpoints enforce authorization. API credentials remain on the server and sensitive provider configuration is encrypted at rest. These measures reduce risk but do not guarantee absolute security. We do not sell personal data or use submissions for targeted advertising. Disclosures required by lawful process may still apply.

You can edit your workshop name and portrait, edit or delete practice plans, delete saved review records, decline a new AI submission, revoke camera/microphone/Speech permissions in iOS Settings, sign out or use Delete Account. Declining optional permissions does not prevent typed entry or other unaffected features. Before entry, review the welcome disclosure and linked agreements; you can decline by leaving acceptance off and not signing in. Login and automatic startup after a previously completed login send the fields listed in Section 3; there is no separate per-field transmission switch. iOS settings control the values for language, calendar, text size, VoiceOver and Reduce Motion; changing or disabling an accessibility feature changes the reported value rather than suppressing that field. You need not disable accessibility features to use Fovma. Sign-out resets automatic entry, but retains the permanent Keychain identity. Purchase confirmation requires the full unified receipt described in Section 7, including when retrying an unfinished transaction; it cannot be reduced to the selected transaction alone by an in-app choice. You can decline a new purchase; declining a retry does not cancel a payment already made to Apple or obtain a refund.

To delete one saved review, open it in Journal or in Profile → Steam Archive, tap the trash icon labelled Delete saved pour, and confirm. The service deletes that review and its settings, along with its photos unless another saved pour still uses them. This cannot be undone. Other saved pours and your coin balance are unchanged; deletion does not restore a used review allowance. A connection to the service is needed to confirm deletion.

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, request portability, withdraw consent where it is the basis of processing, or complain to a competent privacy authority. For requests not covered by current controls, email nulerolldev@proton.me. There is no dedicated in-app export or global AI-consent-withdrawal button. We may need proportionate ownership verification before releasing or changing protected data; never email session or installation secrets, ownership secrets or payment credentials.

Withdrawal does not undo processing lawfully performed before it. Mandatory legal rights are not limited by these descriptions.

Fovma is not directed to children under 13, or the higher age at which parental authorization is required where you live. We do not knowingly seek their personal information. Contact us if you believe a child has provided data so we can investigate and take appropriate action.

We publish updates with a revised effective date. If a material change requires notice or renewed permission by law, we must provide it; this Policy does not claim the app currently includes a dedicated update banner. The current Policy remains accessible from the welcome screen and Profile.

Privacy and support contact: nulerolldev@proton.me. Suggested subject: “Fovma — Privacy request.” We aim to reply within 30 calendar days or the period required by applicable law.