Privacy Policy

1. What information do we collect?

Information you give us

Account information. When you create an account we collect your email address and a password (stored only as a salted hash by our authentication provider; we never see or store your plaintext password). If you use Sign in with Apple, we receive an Apple user identifier and, on your first sign-in only, the name you choose to share. If you use Apple's Hide My Email, we only ever see the relay address, not your real one.

Your name or nickname. Whatever you enter as a display name, or the name Apple supplied, editable or clearable any time in the Profile tab.

Your taste profile. Your answers to the onboarding taste quiz and the preference scores we derive from them: sweetness, acidity, tannin, body, oak, whether you lean fruit-forward, the regions and grape varieties you prefer, characteristics you dislike, and the "archetype" we assign.

Wines you name. Wines you enter as favorites, and the wine searches you run in the app. Search terms go to our database to find a match, and to our AI provider when the assistant looks something up for you. We do not keep a search-history list.

Ratings and tasting notes. Your 1–5 score for a wine, any free-text notes, and the context you record (at a restaurant, at home).

Journal entries. Titles, free-text bodies, and, importantly, the restaurant or venue name you attach to a scan or entry, along with the date. Over time that builds a record of where and when you drink. Treat it with the care you'd give a diary, because that's what it is.

Photos of wine lists and wine labels. See section 5. How we handle these is the part of this policy most worth reading.

Messages you send to the AI sommelier, plus any photo you attach.

Anything you send us by email: support requests and feedback.

Information collected automatically

App activity (analytics). We record how you move through onboarding: which screen you saw, which option you picked, when you changed a pick, skipped, went back, finished or abandoned, and how long you spent on each screen, in milliseconds. Each event carries a session identifier and, once you sign in, your account identifier.

Two things you should know, because they aren't obvious:

• The record includes the actual choices you made, not just that you made one.
• Events recorded before you signed in are stored with a device-generated session identifier and are linked to your account once you sign in.

Device and app context. With the first event of each session we record your locale, time zone, app version and build number, and whether the app is running in a simulator.

Where you are: only when you ask, and we never receive it. The scan screen has a "Find where I am" button that fills in the restaurant name so you don't have to type it. Tapping it asks iOS for your location while you're using the app. What happens next matters, so here it is exactly:

• Your coordinates go straight to Apple's MapKit, which returns a list of nearby restaurants. That is one lookup, and it ends there.
• Your coordinates are never sent to our servers, never written to our database, and never logged anywhere.
• The only thing saved is the restaurant name you confirm, the same string you could have typed by hand.
• If you never tap the button, the app never asks for your location at all. You can decline the permission and keep using every part of Sommly.

Crash and error reports. If the app crashes we receive a technical report: stack trace, device model, OS and app version. We have deliberately configured our monitoring tool not to attach personal identifiers, IP addresses, or request contents. We also collect performance traces on a sample of sessions (about one in five) to find slow screens and requests. Crash reporting does not run at all in development builds.

Scan metadata. How many wines a scan found, the price range on the list, and how many pages you scanned.

What we do not collect

We want to be specific, because "we don't collect much" is what everyone says. Sommly does not collect:

• Your location. As described above, the optional restaurant lookup hands your coordinates to Apple's MapKit and never to us. We store no coordinates, no coarse location, and no location history, only restaurant names you confirm, which are just text you could have typed. We never ask for background or "always" location, and we do not track where you go.
• Your phone number, postal address, or date of birth.
• Your payment information. Sommly does not process payments. If in-app purchases are added later, Apple handles payment and we will update this notice before that ships.
• Your contacts, calendar, photo library at large (we only receive the specific photos you pick), microphone, or health data.
• Any advertising identifier. We don't show the App Tracking Transparency prompt, because we don't track you.
• Browsing history, cross-app activity, or any cross-site identifier.

Sensitive information

We do not intentionally collect sensitive personal information as defined by GDPR Article 9 or the CCPA. Be aware that free text you write yourself, such as tasting notes, journal entries or chat messages, may contain anything you put there, including health or religious detail. Please don't put anything there you wouldn't want stored. We don't analyze that text for sensitive characteristics and we don't use it to infer anything about you beyond wine preference.

2. How do we process your information?

We use each category of data for a specific purpose, and only that purpose:

What we never do with it: we don't build advertising profiles, we don't sell it, we don't share it for cross-context behavioral advertising, and we don't use your content to train our own AI models. On what Google may do with data sent to its AI service, see section 5; we're honest there about the limits of what we control.

3. What legal bases do we rely on?

For users in the EEA, the UK and Switzerland. Under GDPR we must have a valid legal basis for each purpose.

You may object to processing based on legitimate interests at any time. See section 13.

4. When and with whom do we share your information?

We do not sell your personal information. We never have and we do not plan to. We share it only with the service providers below, each processing it on our instructions to make a specific feature work.

Each of these providers processes your data under its own published data processing terms, which limit it to processing on our instructions for the service we bought. We do not authorize any of them to use your data for their own purposes, and none of them is paid in data.

Other situations. We may disclose information if required by law, subpoena or valid legal process, or where we believe it necessary to protect our rights, investigate fraud, or respond to a threat to someone's safety. If Sommly is involved in a merger, acquisition or sale of assets, your information may transfer as part of that deal. We'll notify you before it becomes subject to a different privacy policy.

5. How does the AI work, and what does it see?

This is the section we'd want to read first, so here it is in plain terms.

Photos of wine lists and labels

1. Your iPhone shrinks the photo and sends it to our server function.
2. That function passes the image straight to Google's Gemini AI, which reads the wines off it.
3. Google returns structured text: names, producers, vintages, prices, tasting notes.
4. We keep the text. We do not save the photo. The image is never written to our database or file storage; it exists only for the seconds it takes to process the request.

Before your first scan, the app shows you a plain-language version of the two points above and asks you to agree. Declining is a real button, and the scan does not happen.

The AI sommelier chat

When you send a message, we send Google: your message, up to the last 20 turns of that conversation, a plain-language summary of your taste preferences, and any photo you attached.

The assistant also has tools it can use on your behalf. If you ask about wines you've tried, it will read your recent journal entries, including restaurant names, and include them in the request to Google so it can answer. If you ask it to remember a wine, it writes a new entry to your journal. If it needs current information (a price, a recent vintage), it runs a Google Search on a query it composes from your conversation.

We do not store your chat transcripts. There is no chat history table in our database. The conversation lives in the app's memory for that session and is gone when you leave the screen, except for anything you explicitly asked the assistant to save to your journal.

The AI can be wrong

Sommly's recommendations, tasting notes, price readings and identifications are generated by an AI model. They are informational, they can be inaccurate or incomplete, and they are not professional advice of any kind. Check anything that matters, especially a price on a wine list, and especially any health-related question, which you should take to a doctor and not to a wine app.

6. Third-party websites

The app and this site may link elsewhere: a producer's site, a source the assistant cites, our TestFlight page. We don't control those sites and aren't responsible for their privacy practices. When you leave Sommly, read the privacy notice of wherever you land.

7. Cookies and tracking technologies

In the app: none. Sommly's iOS app uses no cookies, no advertising identifier, no tracking pixels, and no third-party analytics or attribution SDK. We do not present an App Tracking Transparency prompt because we do not track you across apps or websites.

On this website: also none. This site sets no cookies and uses no analytics or tracking scripts. It runs no JavaScript at all and loads no third-party resources. Every image, icon and font on the page is served from our own domain or is already on your device. That's why you aren't being asked to accept cookies: there are none to accept.

If we ever add analytics, we'll name the tool here, say what it collects, and, for anything capable of building a cross-site profile, ask EEA and UK visitors for consent first.

The app's local data is stored on your device, not in cookies, and is removed when you delete the app.

8. How do we handle Sign in with Apple?

Apple gives us a stable identifier for you, an email address (your own, or a private relay address if you chose Hide My Email), and, only on your very first sign-in, the name you agreed to share. We store the identifier and email with your account and copy the name into your profile so we can greet you. We never receive your Apple ID password, and we receive nothing else about you. Apple's own privacy policy governs what Apple does.

9. Is your information transferred internationally?

Yes. We are based in the United States and our database is hosted in the United States (region us-west-1). Our providers (Supabase, Google, Sentry and Apple) are US companies and may process your information in the United States and other countries where they or their subcontractors operate.

If you are in the EEA, the UK or Switzerland, this means your personal information leaves your country for somewhere whose data-protection laws may be less protective.

We want to be precise about what protects that transfer, because this is a place where privacy policies routinely overclaim. Supabase, Google and Sentry each publish a data processing addendum that incorporates the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and those published terms apply to the services we use. We rely on our providers' standard terms. We have not negotiated bespoke transfer agreements with any of them, and we are not claiming to have.

10. How long do we keep your information?

We keep your account data for as long as your account exists. We don't currently run an automatic deletion schedule; your wines, ratings, notes and journal stay with you until you delete them or delete your account, because that history is the point of the product.

• Photos you scan are not retained at all (section 5).
• Chat messages are not retained (section 5).
• Crash reports are retained by our monitoring provider under its own window, typically 90 days.
• Analytics events about onboarding are retained while your account exists. When your account is deleted, these events are deleted outright along with it, not merely de-linked.
• Anonymized or aggregated information that can no longer identify you may be kept indefinitely.

We deliberately don't publish a fixed retention window, such as "analytics deleted after 24 months", because no automated job enforces one today, and a retention promise nobody keeps is worse than no promise. What we offer instead is the control that actually matters: delete your account and it all goes at once, on demand, from inside the app (section 13).

11. How do we keep your information safe?

• Encryption in transit. All communication between the app and our servers, and all calls to our AI provider, use HTTPS/TLS.
• Encryption at rest. Our database and file storage are encrypted at rest by our hosting provider.
• Row-level security. Every table holding your data has database-enforced policies so your rows can only be read or written by your own authenticated session, enforced by the database itself, not just by app code.
• Least privilege. Our AI keys live only on the server and are never shipped inside the app.
• Password handling. Passwords are hashed by our authentication provider. We never store or log a plaintext password.
• Minimized crash reports. Error monitoring is explicitly configured not to attach personal identifiers.

No system is perfectly secure and no internet transmission can be guaranteed. Please use a strong, unique password, and tell us at support@sommly.app if you believe your account has been compromised. We read security reports first and we won't be annoyed that you wrote.

If there is a breach. If a security incident affects your personal information, we will notify you and the relevant regulators within the deadlines the law sets: GDPR Art. 33 and 34 in the EEA and UK, and the US state breach-notification laws that apply to you. We state that here rather than leaving you to look it up.

12. Do we collect information from minors?

Sommly is for adults of legal drinking age and is not directed to children.

The app is about wine. It contains frequent references to alcohol, discusses alcoholic products in detail, and is rated accordingly on the App Store. You may use Sommly only if you are at least 21 years old, or the legal drinking age where you live, whichever is higher. See the Terms of Service.

We do not knowingly collect personal information from anyone under 18, and we do not knowingly permit anyone under the legal drinking age to use the service. We do not have age-verification technology and we do not ask for a date of birth.

13. What are your privacy rights?

Depending on where you live you may have some or all of these rights. We extend all of them to every user, wherever you are. It's simpler and fairer than sorting people by jurisdiction.

• Know / access. Ask what we hold about you and get a copy.
• Portability. Get your data in a portable, machine-readable format.
• Correct. Fix anything inaccurate. Your name, taste profile, ratings and journal entries are directly editable in the app.
• Delete. Delete your account and everything in it yourself, from the Profile tab. You don't have to ask us. See "Deleting your account" below.
• Opt out of sale or sharing. There is nothing to opt out of: we don't sell your personal information and we don't share it for cross-context behavioral advertising.
• Limit use of sensitive information. We don't collect sensitive personal information for the purposes that trigger this right.
• Object / restrict. (EEA, UK) Object to processing based on legitimate interests, or ask us to restrict processing.
• Withdraw consent. Where we rely on consent, meaning notifications and the nearby-restaurant lookup, withdraw it any time in iOS Settings. Withdrawal doesn't affect processing that already happened.
• Non-discrimination. We won't degrade your service, charge you more, or treat you differently for exercising any of these rights.
• Appeal. If we refuse a request you may appeal by replying to our decision; we'll respond in writing with our reasoning.
• Complain to a regulator. EEA/UK users may complain to their local supervisory authority. California residents may contact the California Privacy Protection Agency or the Attorney General.

How to exercise them

Email support@sommly.app from the address on your account and tell us what you want. We'll verify it's really you, usually by confirming you control the account email, and respond within 45 days for US state-law requests (extendable once by 45 more days if we tell you why) and within one month for GDPR requests (extendable by two more months for complex requests). An authorized agent may act for you with written proof of authorization.

You can also do a lot of this yourself in the app: edit your name in the Profile tab, retake the taste quiz to replace your profile, and delete individual ratings and journal entries.

Deleting your account

You can delete your account and everything in it from inside the app. Open the Profile tab and choose Delete Account. You'll be asked to type DELETE to confirm, because this cannot be undone.

When you confirm, a server-side routine removes:

• your scans and the wines each scan found;
• your journal entries, including restaurant names;
• your ratings and tasting notes;
• your Wine Passport stamps;
• your favorite wines;
• your onboarding analytics events;
• your taste profile;
• your profile record, including your display name;
• anything in your private scan-image folder;
• and finally your login itself.

Your device's local copies (cached taste signals and app preferences) are cleared in the same pass. There is no grace period and no recovery: when it's done, it's done. Please export anything you want to keep first.

If deletion fails part-way, the app tells you so plainly rather than pretending it worked. If that happens, email support@sommly.app and we'll finish it by hand and confirm when it's done.

14. Do-Not-Track and universal opt-out signals

Do-Not-Track. Most browsers offer a "Do-Not-Track" setting. No common standard for honoring it has been finalized, so this website does not currently respond to DNT signals. If a standard is adopted, we'll update this notice.

Universal opt-out mechanisms (Global Privacy Control). Several US state laws in California, Colorado, Connecticut, Texas and others require businesses to honor an opt-out preference signal such as GPC for the sale or sharing of personal information. Sommly doesn't sell or share personal information for advertising, so there is nothing for a GPC signal to turn off. If that ever changes, we'll honor GPC signals on this website and we'll say so here first.

15. California residents (CCPA/CPRA)

If you're a California resident, the CCPA as amended by the CPRA gives you specific rights.

Sources: you, directly; your device, automatically; and Apple, if you use Sign in with Apple. Business purposes: as described in section 2. Disclosures: to the service providers named in section 4, each contractually limited to processing it for us.

Sale and sharing. We have not sold personal information, and have not shared personal information for cross-context behavioral advertising, in the preceding twelve months. We don't do so now and we don't sell or share the personal information of anyone, including minors under 16.

Your California rights: know, delete, correct, opt out of sale/sharing (nothing to opt out of), limit use of sensitive personal information (none collected), and non-discrimination. Email support@sommly.app. We verify identity via your account email; an authorized agent may act for you with written permission.

Shine the Light (Cal. Civ. Code §1798.83): we don't disclose personal information to third parties for their own direct-marketing purposes.

16. Other US state privacy rights

Comprehensive privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states give residents rights to confirm, access, correct, delete and port their personal data, and to opt out of targeted advertising, sale, and certain profiling.

Rather than track which state you're in, we extend the full set of rights in section 13 to every user. Email support@sommly.app and we'll respond within your state's deadline (45 days in most states). If we deny a request you may appeal by replying to our decision; we'll respond within 60 days and, if we still deny it, tell you how to complain to your state Attorney General.

Targeted advertising, sale, and profiling: we do none of these. We don't use your data for targeted advertising, we don't sell it, and we don't use automated profiling to make decisions with legal or similarly significant effects about you. Ranking wine recommendations by your stated taste is the only profiling we do, and its worst-case consequence is a wine you don't love.

Nevada residents: we don't sell personally identifiable information as defined by Nevada law.

17. Do we make updates to this notice?

Yes. We update this notice when the app's data practices change, and we review it at least once a year. The "Last updated" date at the top always reflects the current version.

If we make a material change, such as a new category of data, a new provider or a new purpose, we'll tell you in the app or by email before it takes effect, and where the law requires it we'll ask for your consent. We won't retroactively apply a weaker policy to information we already collected under a stronger one.

18. Contact, review, update, or delete your data

Data controller: Ashwood Data LLC.

[JORDAN-DECISION 1] Confirm the controller is Ashwood Data LLC, as the site footer already asserts, and add its state of formation. Every entity reference in this policy and in the Terms follows whatever you confirm here.

Privacy contact: support@sommly.app, the same address for privacy requests, security reports and support. One monitored inbox beats three unmonitored ones, and the CCPA and GDPR response deadlines are legally binding.

[JORDAN-DECISION 4] Add a physical mailing address or a toll-free number here. The CCPA requires one of the two, and App Review expects a real contact; an email address alone does not satisfy either.

To review, update or delete your data:

• Update: edit your name, retake the taste quiz, and edit or delete individual ratings and journal entries directly in the app.
• Delete your account: do it yourself in the app, under Profile → Delete Account (section 13). You don't need to ask us, and you don't need a reason.
• Access or export: email support@sommly.app from the address on your account and we'll send you a copy of your data.

Governing law: set out in section 17 of our Terms of Service, and the same choice governs this policy.