Privacy Policy

1. Who we are

Bigote Labs LLC (“we,” “us”) operates the Wine Wine Wine app and the website winewinewine.app (together, the “Services”). This policy explains what we collect, why, who helps us process it, and the choices you have.

2. Information we collect

2.1 Information you give us

• Account details: your name and email address as provided when you sign in with Apple or Google. If you use Sign in with Apple and choose to hide your email, we receive a private relay address instead. We never receive your Apple or Google password.
• Your cellar: the wines you add (producer, name, vintage, quantity), the names you give your storage locations, and the details we add to each wine.
• Label photos: front and back photos of labels you take or upload.
• What you open: consumption entries, including the reason, date, rating, notes, where the wine was in its drink window, and, if you add it, where you opened it: a venue name, address or map location.
• Pairing conversations: what you ask the pairing assistant, including any photo of a dish or menu, or a menu PDF.
• Messages to us: support requests and Android waitlist sign-ups made on our website.

2.2 Information collected automatically

• Device information: device model, operating system and app version.
• Usage analytics, only if you turn them on (see §6): which features and screens you use, with a random identifier, timestamps, app version, operating system, device type and your level.
• Crash reports, through Apple (if you choose to share diagnostics with app developers) and, if analytics are on, PostHog.
• On our website: pages viewed, measured without cookies; and the signals Cloudflare Turnstile uses to tell people from bots, such as IP address and browser characteristics.

2.3 Information from others

• Apple: which subscription product and level you have, through Apple's StoreKit. We never receive your payment card details. If you let the app use your location to find a nearby venue, the search goes through Apple Maps. [CONFIRM: whether device location is stored, or only used for the search.]

3. How we use it

• To run the Services: storing your cellar, syncing across your devices, and showing your wines where they are.
• To identify wines and write their tasting notes, drink windows and pairings.
• To provide estimated values on Connoisseur and market values on Master.
• To apply your level's limits and manage your subscription.
• To answer support requests.
• To understand how the Services are used and to improve them, using analytics.
• To keep the Services secure and prevent abuse.
• To meet legal obligations.

4. AI processing

We use Anthropic's Claude, through Anthropic's API, to read label photos, identify wines, write wine details and answer pairing questions. Before we send anything about you to Anthropic for the first time, we ask your permission in the app and record your choice. With your permission, we send Anthropic:

• your label photos and the details of the wine being identified;
• your pairing messages, including any dish or menu photo or menu PDF;
• for pairing, the wines currently in stock in your cellar, with only these details: producer, name, vintage, grape, region, country, drink window, and how many bottles you have when it's more than one. We never send storage locations, purchase or opening history, or your private notes.

We do not send your name, email or account details. What you send can still contain personal information, such as a name on a label or something you write in a pairing message, and we send it only to get you the result you asked for. Anthropic processes this data as our service provider under its Commercial Terms and Data Processing Addendum, which do not allow it to train its models on this content. Under its standard terms, Anthropic deletes API inputs and outputs within 30 days. Its exceptions include certain API features, other agreements, enforcing its usage policies and meeting legal obligations. To fill gaps in a wine's details, we may search public sources using the wine's details; we design these searches to leave out your account details.

[CONFIRM: Anthropic is used directly, not through a cloud provider; which API features are used (for example web search) and any retention exceptions they carry; no special retention agreement exists; user content is never submitted to Anthropic as feedback.]

5. The shared wine catalog

When you add a wine, its factual details (producer, name, vintage, region, grape and what the label states) may be added to a shared catalog, which helps everyone's wines be identified faster and more accurately. The catalog never includes your identity, notes, ratings, storage locations or how many bottles you own.

Your label photos may also be shown in the catalog to other collectors, without your name or account attached. A shared photo is stored under a random name, with its location and other metadata removed. A photo can still show something personal, such as a handwritten note or a reflection, so photograph the label alone. When you delete your account, we remove your photos from the catalog too. The factual wine details stay, because they describe the wine, not you.

6. Analytics, and your choice

We use PostHog to understand how the app is used. Analytics are off until you choose to turn them on, and you can turn them on or off at any time in Settings › Privacy › Share usage analytics. When they're on, events carry a random identifier (which still counts as personal information), event names, timestamps, app version, operating system, device type and your level. They never include your name, email, cellar contents, photos, pairing conversations or anything you type, and we don't record sessions. We set PostHog not to keep IP addresses or locations derived from them. Turning analytics off stops optional analytics from both the app and our servers. It doesn't delete events already collected, which expire as described in §10. Records we need for billing, security and fraud prevention are kept separately and aren't affected by this setting.

Our website measures visits without cookies. We use no advertising or cross-site tracking cookies, and we do not track you across other companies' apps or websites. Because we don't track you across sites, our website does not respond differently to browser “Do Not Track” signals.

7. Partner wineries and wine clubs

We may share aggregated statistics with partner wineries and wine clubs, such as how many collectors hold one of their wines, or how far into its drink window it is usually opened. These statistics never include your name, email, location, notes or individual records. Grouping data makes it much harder to identify anyone, but not impossible, so we apply several safeguards:

• we never show a statistic drawn from fewer than 10 collectors;
• we hold back small or distinctive groups, such as owners of a rare wine or a narrow date range;
• we use broad time periods and round figures;
• we review combinations of statistics before release;
• our agreements forbid partners from trying to identify anyone.

If you redeem a partner's code, the partner sees only aggregate figures for its campaign, such as how many times its code was redeemed. It never sees your name, email, account or cellar. If a partner gives a unique code to one named customer, the partner may be able to tell that the code was used.

8. Who we share information with

We do not sell your personal information, and we do not share it for advertising. We share it only with:

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply.

9. Where your data is stored, and how it's protected

Our database (Supabase) and app servers (Railway) are hosted in the United States. [CONFIRM: the Cloudflare R2 bucket's location, and any processing or support access outside the US.] Data is encrypted in transit and at rest [CONFIRM: true for every provider]. Your private cellar records can be reached only through your account. Shared catalog records are visible to other users, as described in §5. A small number of authorized administrators can access data to run and support the Services. No system is perfectly secure, but we work to protect yours.

10. How long we keep it

We keep your data while your account is open. When you delete your account (Settings › Delete Account):

• Access: we disable your account promptly.
• Your records: we delete your account, wines, entries and photos, including any of your photos in the shared catalog, from our production database and photo storage within 30 days.
• Our providers: we promptly ask the providers that hold your data, such as PostHog, Resend and Cloudflare, to delete it. They do so on their own schedules [CONFIRM: document each provider's process].
• Backups: copies in our backups stay restricted and expire within 90 days of production deletion [CONFIRM: verify across database backups, object versions, caches and logs before publishing]. Restoring a backup never reactivates a deleted account.

Where the law requires faster action, we follow it.

After deletion, we may keep limited information where the law requires or allows it: a record of your acceptance of our Terms, records needed for billing, tax or legal claims, and information needed to prevent fraud and abuse. Aggregated statistics and factual catalog details, which don't describe you, may remain.

Deleting your account does not cancel an Apple subscription; cancel it in your Apple ID settings.

How long we keep other information:

If you delete your account, the deletion schedule above applies instead, apart from the limited records described in this section.

11. Your rights

Wherever you live, you can ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate;
• delete your information (you can also delete your account yourself in Settings › Delete Account);
• send you a portable copy of your personal information, including your cellar data.

To make a request, email us at the address in §14, from the email address on your account if you can. If you use Sign in with Apple's private relay, or can't send from that address, tell us and we'll verify you another way [CONFIRM: for example, confirming the request from inside the app]. We respond within 45 days. We may keep some information where the law requires or allows it (see §10). If we decline any part of a request, we'll tell you why, and you can ask us to reconsider by replying to that email. If you're still not satisfied, you can contact your state's attorney general. We will not treat you differently for making a request. If the law where you live gives you additional rights, we honor those as well.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. The Services are currently offered only in the United States.

12. Age

The Services are for adults 21 or older in the United States, and elsewhere at least 18 and old enough to legally buy or drink wine where you live. We do not knowingly collect information from anyone younger. If we learn that we have, we delete it.

13. Changes

We will post changes here and update the effective date. For material changes, we will tell you in the app or by email before they take effect.

14. Contact

Bigote Labs LLC · 2108 N St #14837, Sacramento, CA 95816, USA · support@winewinewine.app