Shot Ledger privacy policy.

Effective April 30, 2026 · Updated October 8, 2026 · Contact cairnappsstudio@gmail.com

Open in App Store Coming soon to Android

Summary Shot Ledger stores everything on your device, and the whole app works with no account, and we run no analytics. Signing in is the only thing that gives us anything about you: an account identifier and the email address, and possibly name and photo, your chosen provider hands over. The optional AI features, Taste Translator and Ask, are off until you agree to them, and then send the notes, questions and shot details described in Section 4 to Anthropic. If you choose to sign in and back up, your shot log is encrypted on your phone first, with a key only you hold. See Sections 2 and 4.

Cairn is operated by Taylor Satterfield.

1. Data storage

All data you enter into Shot Ledger, the shot dial-in log, is stored on your device using SQLite. The app is fully usable with no account, and nothing is uploaded by default. Your data leaves your device only when you export it, turn on the optional backup described in Section 2, or use an optional AI feature described in Section 4.

Deleting the app permanently removes your locally stored data. If you never signed in, deleting the app is also how you delete your data, because we hold nothing. If you did sign in, use Delete Account in Settings first: that removes your account and every backup it holds, across all Cairn apps that share the account.

2. Backup (optional)

Backup is off until you choose it. Sign in with Apple, Google or your email address in Settings, then back up. Before anything is uploaded, your beans, equipment and shots are encrypted on your device with a key generated on your device and stored in your iCloud Keychain. We never receive that key, so a backup we hold is unreadable to us, including your tasting notes. Backing up is part of Pro, on demand or automatically after changes; signing in and restoring an existing backup are free.

Restoring pulls your latest backup and decrypts it on your device. We keep your five most recent backups and delete older ones automatically. Signing out leaves your backups in place. Delete Account in Settings removes your backups and your account record.

3. Personal information

You can use the whole app without an account. You can sign in with Apple, Google, or your email address. Email sign-in means either choosing a password, held by our authentication provider and never visible to us in plain text, or using a one-time link we email you that needs no password at all. When you sign in, we receive an account identifier and the email address you used or the one your provider gives us, which may be Apple's private relay address if you chose to hide yours. Apple also gives us your name the first time you sign in; Google gives us your name and a profile photo URL along with your email. The app does not display your name or photo anywhere; we do not otherwise collect any personal information.

4. AI features (optional)

The app has two optional AI features, Taste Translator and Ask, which use Anthropic, the AI provider, through Cairn's server. Nothing is sent until you turn on "Send my notes, questions and shot data to Anthropic" in Settings and accept the disclosure, or, if you are not signed in, accept the disclosure the first time you use Taste Translator. You can turn it off in Settings at any time, and nothing is sent while it is off.

Taste Translator sends the tasting note text you ask it to read, and nothing else about the shot.
Ask needs a signed-in account. It sends the question you type, the earlier messages in that conversation, and today's date and your time zone. To answer, it looks up your shot log on your device and sends what it finds: bean names, roasters and roast dates, and each shot's dose, yield, time, grind setting, rating and date, plus figures worked out from them. It does not read your saved tasting notes. If you ask it to log a shot, the change is made by the app on your device.

Cairn's server, hosted by Vercel, checks that you agreed and that you have usage left, then passes the request to Anthropic and the answer back. It does not store your notes, questions, shots or the answers, with one exception: when Ask proposes a change, such as logging a shot, our server keeps a copy of that proposed change with your account so that a retried request cannot apply it twice. After 30 days that copy is cleared, leaving only a note of which kind of change was proposed and when, and both are deleted if you delete your account. To count usage, our server records your account identifier or, if you are not signed in, a random identifier the app creates, along with your network address. Those usage counters are deleted after 31 days. Your past Ask conversations are kept on your device only.

We do not send your account identifier or email address to Anthropic. Under Anthropic's commercial terms, Anthropic does not use these requests or its answers to train its models, and keeps them only for a limited period for trust and safety. We do not use your data to train any model either.

5. Analytics and crash reporting

The app does not collect usage analytics: no screen views, no feature usage, no behavioural tracking.

We use Apple's AdServices to see which App Store ad brought you to the app, if any. It does not identify you and is not used for tracking.

It does report crashes, unhandled errors and basic performance measurements to EAS Observe, a service run by Expo, so that faults can be found and fixed. A report contains the error and its stack trace, the app version, the device model and operating system version, and timings such as how long the app took to start. It also contains an anonymous installation identifier, which distinguishes one install from another and is not linked to you, your account or your email address. Reports never include your entries or any other content you create in the app, and are never used for advertising or sold or shared for tracking.

6. Subscriptions and payments

In-app subscriptions are processed entirely by Apple through the App Store. We do not collect, process, or store any payment information. The app uses the RevenueCat SDK to check your purchase and subscription status with Apple. RevenueCat receives that status tied to an app user ID: a random ID the app creates, or, once you sign in, your Cairn account identifier, so Pro follows your account to a new phone. It also receives your device's vendor identifier (IDFV, an Apple-provided device ID that resets when you delete all apps from this developer). This is used only to validate your purchase and restore it across your own devices. It is never used to track you across apps or websites, and RevenueCat does not receive your name, email address or payment details.

For questions about payments, refunds, or billing, contact Apple Support or manage your subscriptions in Settings » [Your Name] » Subscriptions.

Learn more about RevenueCat at revenuecat.com/privacy.

7. Third-party advertising

The app does not display any third-party advertisements. We do not use ad networks or tracking pixels.

8. Data sharing

We do not sell, rent, or share your data with third parties. The only external services that receive any data from the app are:

RevenueCat: purchase and subscription status, tied to your Cairn account identifier once you sign in (see Section 6)
Apple or Google: subscription payment processing (Apple only) and sign-in, if you choose one of them over email (see Sections 2 and 6)
Supabase: hosts our database and file storage, handles email sign-in if you choose it over Apple or Google, and holds your encrypted backups if you turn backup on (see Section 2)
Anthropic: your AI requests, including the shot details Ask looks up, only if you turn on an AI feature (see Section 4)
Vercel: hosts our server, which passes AI requests to Anthropic (see Section 4)
Expo: crash and performance reports through EAS Observe (see Section 5)

Apart from AI requests you choose to make (Section 4), none of these services receive your shot log in readable form. Backups are encrypted on your phone with a key we never receive, so neither we nor Supabase can read them. Account-related email is delivered by Resend, our email delivery provider, as described under Email below.

For California residents: we do not sell or share your personal information as defined under the California Consumer Privacy Act (CCPA).

9. Email

If you sign in, we send the emails your account needs: confirming your address, password resets and sign-in links. If you buy Pro while signed in, we also email you a short note when it starts, when a subscription is set not to renew, and when it ends. They are sent to the address on your account through Supabase, our account provider, and Resend, our email delivery provider. Any reminder email carries an unsubscribe link. If you unsubscribed from our emails, we keep your email address on a do-not-email list after your account is deleted, so we never email you again.

10. Children's privacy (COPPA)

The app is not directed at children under the age of 13. We do not knowingly collect any information from children under 13. If you believe a child under 13 has provided information through the app, please contact us at cairnappsstudio@gmail.com and we will take steps to address the concern.

11. Data retention

Data on your device stays there until you delete it, and deleting the app removes it. If you back up, we keep your five most recent encrypted backups and delete older ones automatically. Delete Account in Settings removes your stored backups, your account record and any AI records kept with your account. Anthropic keeps AI requests only for a limited period under its commercial terms (see Section 4).

12. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted at this URL with an updated effective date. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact

Email: cairnappsstudio@gmail.com
Support: /espresso/support

This privacy policy is provided as general information and does not constitute legal advice.