Privacy policy

What stays on your phone

• Your journal (wines, tastings, notes and any label photo attached to a tasting) is stored on your phone.
• The wine catalog used for search is bundled inside the app and searched on your phone.
• Small settings, such as which tasting mode you picked and which help cards you opened, are kept on your phone.
• You can delete any wine from your journal inside the app.

iCloud sync

This version of the app turns on iCloud sync.

• Your journal is mirrored to your own private iCloud database, so it can follow you across your devices.
• If you are not signed in to iCloud, your journal stays on your phone and syncs once you sign in. If the journal cannot be opened at all, the app tells you that new entries will not be saved.

When you scan a label or a wine list

A scan sends one photo to our server so it can be read.

• The photo is sent to our server. It must be a JPEG, PNG or WebP image of 4 MB or less.
• Our server passes the photo to an AI model (Anthropic's Claude) through Vercel AI Gateway, which reads the label or the list and sends back text. The gateway may route the request to another provider if needed.
• Our server does not save the photo or the text the model returns. It only keeps the small records listed in the next section.
• The model and gateway providers handle the photo under their own terms and privacy policies. We do not control how long they keep it.

What our server remembers

These records exist only to stop abuse and to count your free scans. None of them holds your name, your email or your photos.

• When the app proves it is a genuine copy using Apple's App Attest, we store a random key id, that key's public key, a counter, whether it is a production or test build, and the time. The record is deleted 400 days after your last scan.
• The one-time challenge used for that check is deleted when it is used, or after 60 seconds at most.
• Your scan count is stored under your App Attest key id (or, on a copy that has not been checked, a random install id the app generates). Monthly counts are deleted about a day after the month ends. The first-month list scan allowance is deleted about a day after that 30 day window ends.
• While you scan a multi-page list, a session record lets up to 6 pages count as one scan. It is deleted 15 minutes after your last page.
• On a copy that has not been checked, your IP address is turned into a one-way scrambled code (an HMAC with a secret salt) and used only to cap how many scans one network can make in a month. The address itself is not saved in those records.

What our server logs

• Each request writes one log line with the route, the result code and how long it took. A failed request may also add a short outcome label and the name of the error type. Our own log lines never include photos, model output, install ids or IP addresses. Our hosting provider (Vercel) and our records provider (Upstash) run the servers and keep their own standard operational logs under their own policies.

No ads, no analytics, no tracking

• The app contains no analytics, advertising or tracking code from anyone, and it does not ask permission to track you. The one outside library it uses is GRDB, an open source database library for searching the bundled wine catalog on your phone.
• Our server has no analytics or advertising code either.

Questions or changes

Email support@winesy.app. If this policy changes, the effective date above changes too.