Fovma Terms of Service

These Terms govern your use of Fovma, a milk-foam practice companion for home espresso enthusiasts. “Fovma,” “we” and “us” refer to the app operator. Read these Terms and the Privacy Policy on the welcome screen or in Profile before selecting the agreement checkbox and tapping Start Brewing, or choosing Agree & Continue in the existing confirmation prompt. Entry sends installation and device-context information as explained below and in the Privacy Policy.

Accepting these Terms does not by itself authorize an AI submission or microphone access. Those choices are requested separately when you use the relevant feature. If you do not agree, do not enter the workshop.

You can photograph or select a cup of milk foam; record foam type, steam pressure, tip depth, steam duration, starting temperature, an optional measured final temperature and a note; request an AI texture review with illustrated annotations; compare saved sessions; view score trends; and plan or time practice sessions.

Educational examples are identified separately from your records. They are not analyses of your own work. Scores describe visible texture and are estimates, not measurements of exact bubble size, actual temperature, hygiene or food safety. The app cannot guarantee a particular improvement, score or result.

Account access, saving, AI processing and purchase synchronization require an internet connection. Follow your equipment instructions and use an appropriate thermometer; the app is not a substitute for safe steaming practices.

Fovma uses quick entry rather than email/password registration. The app sends its installation identifier, installation proof and device context to the Fovma backend. Our backend calls an upstream account service, obtains the account identifier, session credential and separate display Profile ID, and associates available workshop data with that account. Login context includes device family and system label, time-zone identifier and GMT/UTC offset, language and locale, calendar, preferred text size, VoiceOver status and Reduce Motion status, together with app/build and request metadata. App-start sends account/device and app/request context plus language, locale, calendar, preferred text size, VoiceOver status and UTC offset; it does not send Reduce Motion status again. The reading and accessibility values are required by the current request contract; the backend checks them but does not use them for scoring, advertising or personalized results. There is no separate in-app switch to omit individual fields. You may decline entry by not accepting the agreements; the Privacy Policy explains recipients and choices. Your profile, records, plans and coin balances are managed by our service.

The permanent installation identity consists of a canonical identifier, a random installation proof and the project-specific device mark. The app creates or reads this identity locally during initialization, before sign-in. It is kept in the iOS Keychain separately from the account identifier and session credential. The identifier initially uses the iOS vendor identifier when available, otherwise a generated UUID. A separate successful-login flag in the app sandbox is excluded from device backup and contains no installation or account secrets. Automatic entry requires this flag and complete account credentials in Keychain. An eligible cold launch obtains fresh account credentials before startup; cached credentials alone do not authorize entry. Sign Out sends the Fovma logout request, removes the separate account credentials from Keychain, resets the sandbox login flag to signed out, clears account memory and applicable caches, and returns to welcome, while preserving the installation identity and server business data. It does not promise to revoke an upstream account or every upstream session.

Keychain entries may survive removing and reinstalling the app. A new sandbox has no successful-login marker, so Fovma clears residual account credentials and requires explicit sign-in; it does not clear the surviving permanent installation identity. Reinstalling therefore neither guarantees a new upstream identity nor guarantees recovery of an old journal or balance. A later explicit sign-in may reconnect to an existing account if the upstream account service and retained associations permit it. iOS can also remove Keychain data, and offloading that preserves app data differs from deleting the app. Do not share installation or account secrets. Server retention alone does not guarantee renewed access; see the purchase and deletion sections for the limits.

Submit only photos and information you have the right to use. Keep unrelated people, private documents and sensitive information out of foam photos and notes. You retain rights in your submissions and grant Fovma a limited permission to transmit, process and store them to provide the features you request, including saved results and history.

Camera use is optional. The system photo picker gives Fovma access only to items you select, without broad photo-library permission. Optional dictation uses the microphone and Apple Speech to produce editable text. You can review, edit, apply, undo or discard the draft. Saving or submitting an applied field sends that text as part of the form, not an audio recording.

Before submitting a new review, you must enable the review-specific agreement in the form. This authorizes Fovma to send the selected foam photo, entered parameters and optional note through our server to OpenRouter and the Google Gemini model provider. The workflow analyzes the photo and parameters and generates an illustration; our service also lays out validated labels and scores around the original photo.

You can decline by leaving the agreement off, turn it off before submission, or leave without submitting. This permission is for that submission only, not future reviews. After the request has been sent, closing the screen or continuing in the background does not retract it or stop processing already underway. There is no persistent AI-consent switch in Profile.

AI may be inaccurate, incomplete, delayed or unavailable. Generated decoration is illustrative, not additional evidence. Do not rely on it for safety-critical decisions. Third-party handling is subject to their applicable terms and policies; we do not promise immediate deletion by all processors, zero retention or universal exclusion from model training.

A review is completed only when its validated analysis, required image and saved record are available. A failed review does not consume a free review or coins. A pending request can temporarily reserve the necessary allowance so that simultaneous requests cannot overspend it; the reservation is released when the request fails or is marked indeterminate.

If a connection is interrupted, use Check review status or the pending review in Workshop. Rechecking the same request is not a new review or a second charge. Starting a new request after a failure is a separate submission. Provider processing may still incur costs to Fovma even when no app allowance is charged.

A new eligible profile starts with 120 promotional coins. Promotional coins and purchased coins are tracked separately. Free-review usage follows the associated wallet and is not reset simply by signing out and returning to the same account. Coins have no cash value and cannot be transferred to another user or exchanged for money.

Coin packs are one-time consumable in-app purchases, not subscriptions or automatic renewals. The native Coins tab and separate reserve page show the product, coin amount and reference price supplied by our backend catalog. When you choose a pack, StoreKit 1 requests that product from Apple; Apple presents its payment price and handles payment. We do not receive payment-card details or your Apple ID password.

After StoreKit 1 reports a purchased or restored transaction, the app reads the App Store unified receipt. It checks locally for the current transaction and product identifiers as a readiness check, not as cryptographic proof of payment. If they are absent, it requests one Apple receipt refresh and checks the local file for a bounded period. Only after readiness does the app encode and upload the complete unified receipt file to the Fovma backend, without limiting it to the selected transaction, together with the current transaction identifier, product identifier, account identifier, session credential and installation device mark. The request also includes an original-transaction reference (or the current transaction ID if no original is available), the backend goods identifier when available, a recovery flag and limited app/request metadata. A unified receipt can contain other in-app purchase entries for this app; it is not limited to the selected pack.

Our backend uses the account-service result from login to choose the receipt acceptance path. One path forwards the receipt and required account/transaction fields to its upstream receipt service; the other accepts the request directly without independently validating the receipt. These paths are not equivalent proofs of Apple payment authenticity. A positive backend acceptance ends the StoreKit transaction even if an attached local coin-credit operation is unavailable; it does not by itself guarantee that the displayed balance increased. When a matching local catalog/account record is available, a separate idempotent operation saves the credit and ledger. If the receipt is not ready, the app sends no receipt confirmation for that attempt and leaves the purchase pending. Use Check Pending Purchases in Coins, return to Coins or relaunch to process an unfinished purchase again; do not buy another pack to resolve the same transaction. There is at most one backend receipt submission per processing attempt. Certain definitive upstream rejections also end the transaction, without granting coins, while other failures leave it pending.

Consumables already delivered are not restored by a general App Store restore-purchases action. Remaining purchased balance is retained separately by our service and is not assigned to another user. Signing out and explicitly signing back into the same available account normally preserves access. The current app has no recovery-code creation, entry or paid-balance recovery screen. Surviving Keychain identity after reinstall does not guarantee account recovery. Account deletion removes the independent account credentials and resets the sandbox login flag while leaving the permanent installation identity; a newly allocated profile does not automatically inherit the retired account’s paid coins. Contact support before deleting or reinstalling if a purchase remains unresolved. We do not promise manual balance recovery or transfer; mandatory consumer rights remain unaffected.

Refund requests are handled by Apple under its applicable rules, including Report a Problem. Nothing here excludes mandatory consumer rights. Fovma does not promise that every refund request will be approved.

Use Profile → Delete Account and confirm. This sends an account-associated deletion request to the Fovma backend. For a locally stored workshop, the backend retires the business profile, removes its name, uploaded photos and portrait references, saved analyses, practice plans and promotional balance, invalidates its local sessions and disables prior local installation associations. A receipt-forwarding account can have no local business record to remove. The app waits for a successful acknowledgment identifying the affected account before removing its account identifier/session entries from Keychain, resetting the sandbox successful-login flag to signed out, and clearing account data in memory and applicable caches/legacy local business storage. Resetting the flag does not erase the sandbox marker file or the permanent identity. The permanent installation identifier, installation proof and device mark remain in Keychain. This request is not an upstream account-deletion call and does not guarantee deletion of upstream records or credentials.

Purchased balance and its financial/ownership ledger remain separately on the service and are not assigned to a newly allocated profile or another user. Deletion ends this app’s authenticated access to the retired workshop. The app provides no screen to recover its paid balance after deletion. The backend also retains account/Profile ID associations, receipt-routing/catalog records and limited technical job metadata; deletion is not a claim that every technical record or copy held by another service disappears. Contact support first about unresolved purchase access. Deletion is not an Apple refund request, and mandatory consumer rights remain unaffected.

Removing the app is not the same as sending this deletion request. Keeping the permanent installation identity does not restore deleted business data. See the Privacy Policy for retention, device-storage and third-party deletion boundaries.

Do not submit unlawful content, infringe others’ rights, bypass access controls, forge transaction reports, abuse free allowances, interfere with service operation or attempt to access another account. We may restrict misuse and suspend features for security, maintenance or service-provider outages, subject to applicable law.

We aim to operate the service reliably but cannot promise uninterrupted access or permanent availability of every feature. Keep copies of information important to you. No business-history export button is currently provided.

Fovma is provided as available. To the extent permitted by law, we do not guarantee AI accuracy or fitness for a specific purpose and are not liable for indirect losses from reliance on estimates. These limitations do not exclude liability or statutory rights that cannot lawfully be excluded.

We may revise these Terms and will publish the revised date with the current text. Where a change requires notice or new consent under applicable law, that requirement applies; this document does not imply that the current app has a dedicated policy-change notification feature.

For support, account issues or legal questions, contact nulerolldev@proton.me with a subject such as “Fovma — Steam Diary support.” Do not send session or installation secrets, payment credentials or private API keys by email. Applicable consumer protections and courts with lawful jurisdiction remain available.