Privacy Policy

1. What information do we collect?

Information you give us

Account information. When you create an account we collect your email address and a password (stored only as a salted hash by our authentication provider; we never see or store your plaintext password). If you use Sign in with Apple, we receive an Apple user identifier and, on your first sign-in only, the name you choose to share. If you use Apple’s Hide My Email, we only ever see the relay address, not your real one.

Your name or nickname. Whatever you enter as a display name, or the name Apple supplied, editable or clearable any time in the Profile tab.

Your taste profile. Your answers to the onboarding taste quiz and the preference scores we derive from them: sweetness, acidity, tannin, body, oak, whether you lean fruit-forward, the regions and grape varieties you prefer, characteristics you dislike, and the “archetype” we assign.

Wines you name. Wines you enter as favorites, and the wine searches you run in the app. Search terms go to our database to find a match, and to our AI provider when the assistant looks something up for you. We do not keep a search-history list.

Ratings and tasting notes. Your score for a wine, from 1 to 5, any free-text notes, and the context you record (at a restaurant, at home).

Journal entries. Titles, free-text bodies, and, importantly, the restaurant or venue name you attach to a scan or entry, along with the date. Over time that builds a record of where and when you drink. Treat it with the care you’d give a diary, because that’s what it is.

Photos of wine lists and wine labels. See section 5. How we handle these is the part of this policy most worth reading.

Your conversations with the AI sommelier. Whatever you type, plus any photo you attach, and the sommelier’s replies. We keep the text of the conversation on your account; photos are not kept (section 5).

Anything you send us by email: support requests and feedback.

Information collected automatically

Onboarding analytics. We record how you move through onboarding: which screen you saw, which option you picked, when you changed a pick, skipped, went back, finished or abandoned, and how long you spent on each screen, in milliseconds. Each event carries a session identifier and, once you sign in, your account identifier.

Two things you should know, because they aren’t obvious:

• The record includes the actual choices you made, not just that you made one.
• Events recorded before you signed in are stored with a device-generated session identifier and are linked to your account once you sign in.

App usage. Once you are signed in, we also record a short list of things you do in the app. Every event comes from a closed list of names written into both the app and our database, and a new kind of event is added to that list on purpose, in both places, and held to the same rules below. Today they cover:

• opening the app, and coming back to it after a break;
• your first steps after installing: finishing the taste quiz, your first scan, and the first bottle you save;
• scanning: a scan started, finished, or closed before you did anything with it, and which action you took on the results;
• sending a message to the sommelier;
• saving a rating, and opening your journal or your Wine Passport;
• sharing: a share button shown to you, and a share card made;
• Sommly Reserve: the subscription screen shown to you, and that screen closed without a purchase.

Each of these rows carries your account identifier, a session identifier, the event name, the app version and build number, whether the app was running in a simulator, and the time. Some of them carry a few small structured details beside that, each from a closed list of detail names: whether a scan came from a wine list, a bottle or a photo you attached; a page count or a result count; how long something took, exactly or in broad bands; an outcome such as ok, failed or cancelled; how an entry was created, and which screen or button led to it; which action you took; whether the app had just launched; how many days had passed since you first opened the app, in broad bands; and, on the Reserve screen, which plan it showed first and whether it offered a free trial.

No free text ever reaches this record. The app admits whole numbers, true or false, and short labels from a fixed vocabulary, and nothing else, so a tasting note, a chat message, a photo, a wine name, a search term or a location cannot be expressed in an event at all. The database then independently rejects any event name and any detail name that is not on its own list, so a new kind of event or field cannot be smuggled in by a future version of the app without a database change too. Neither side admits a purchase or a price: there are no revenue events in this record, and a purchase itself records no event at all.

The session identifier is generated on your device, is not derived from your hardware, and starts over after thirty minutes of inactivity.

What we use these counts for, plainly: how many people use Sommly and how often, whether people come back after their first week, whether a change we shipped helped, which parts of the app lead people to Reserve or to sharing, and how many sommelier messages you have sent this calendar month, which is how the free tier’s monthly allowance is applied. We read all but the last in aggregate.

Device and app context. Alongside the onboarding screen views, we record your locale, time zone, app version and build number, and whether the app is running in a simulator. The app-usage rows above carry the app version, the build number and the simulator flag, and not your locale or time zone.

Where you are: only when you ask, and your own position is never stored. The scan screen and your journal’s place field both offer to fill in the restaurant name for you. There are two ways they do it: a location button, which asks iOS for your location while you’re using the app and lists places near you, and a search over the name you type, which uses your location only to order the results nearer first, when the app already has it. What happens next matters, so here it is exactly:

• Whatever your device knows goes straight to Apple’s MapKit, which returns a list of places. That is one lookup, and it ends there.
• Your own coordinates are never sent to our servers, never written to our database, and never logged anywhere. The device’s reading lives in memory for the length of that lookup and then it is gone.
• When you pick a place from the results, from either of those two lists, we save that name and the map point Apple publishes for that venue: a latitude and longitude for the restaurant, stored on the journal entry the place belongs to. It is a fact about a restaurant, not a reading of where your phone was. This happens whether you pick the place while scanning and then record the bottle, or later on the entry itself.
• If you type a name and never pick a result, no map point is saved. The name is stored exactly as you typed it, the same string you could have written on a napkin.
• Changing or clearing the place on an entry is meant to clear the map point with it, so that a pin does not outlive the name it described. That is what the app asks the server to do, and, like the original write, it is a best-effort request rather than one we retry until it succeeds.
• What the map point is for: the map view of your own history. Nothing in the app draws it today. It is recorded now so that when that view arrives, your entries carry real geometry instead of a guess made years later.
• If you never tap the button and never pick a suggestion, the app never asks for your location, and none of this happens. You can decline the permission and keep using every part of Sommly.

Crash and error reports. If the app crashes or hits an error, we receive a technical report: the stack trace and the error, your device model, your OS and app version, and a short trail of what the app did just before, such as the screens it showed and the web addresses of its recent requests to our servers and whether they succeeded. Before a report leaves your phone, the app strips account identifiers, email addresses and sign-in tokens out of it, and we have deliberately configured our monitoring tool not to attach a user record, your IP address or the contents of requests. A web address in that trail can still name a wine you looked up. We also collect performance traces on a sample of sessions (about one in five) to find slow screens and requests. Crash reporting does not run at all in builds running in Apple’s simulator.

Scan metadata. How many wines a scan found, the price range on the list, and how many pages you scanned.

What we do not collect

We want to be specific, because “we don’t collect much” is what everyone says. Sommly does not collect:

• Your own location. As described above, the optional place lookup hands whatever your device knows to Apple’s MapKit and never to us. We store no device coordinates, no coarse location and no location history, we never ask for background or “always” location, and we do not track where you go. What we do store is described in “Where you are” above: the name of a venue you picked from a list of map results, and the map point Apple publishes for it, on the journal entry it belongs to.
• Your phone number, postal address, or date of birth.
• Your payment information. Sommly Reserve, our optional subscription, is sold and billed by Apple. We never receive your payment details: no card number, no billing address, and no Apple Account name. When you subscribe, the app sends us Apple’s signed record of the purchase so our server can confirm your account is a Reserve member: the subscription’s Apple identifier, which plan, whether it is active and when it renews. Apple’s servers may also send ours the same kind of record when the subscription renews, ends or is refunded. We keep no price, no currency and no payment method, and no purchase or price ever reaches an analytics event. How long we keep that record is in section 10. See section 12 of the Terms of Service for how the subscription itself works.
• Your contacts, calendar, photo library at large (we only receive the specific photos you pick), microphone, or health data.
• Any advertising identifier. We don’t show the App Tracking Transparency prompt, because we don’t track you.
• Browsing history, cross-app activity, or any cross-site identifier.

Sensitive information

We do not intentionally collect sensitive personal information as defined by GDPR Article 9 or the CCPA. Be aware that free text you write yourself, such as tasting notes, journal entries or chat messages, may contain anything you put there, including health or religious detail. Please don’t put anything there you wouldn’t want stored. We don’t analyze that text for sensitive characteristics and we don’t use it to infer anything about you beyond wine preference.

2. How do we process your information?

We use each category of data for a specific purpose, and only that purpose:

What we never do with it: we don’t build advertising profiles, we don’t sell it, we don’t share it for cross-context behavioral advertising, and we don’t use your content to train our own AI models. On what Google may do with data sent to its AI service, see section 5; we’re honest there about the limits of what we control.

3. What legal bases do we rely on?

For users in the EEA, the UK and Switzerland. Under GDPR we must have a valid legal basis for each purpose.

You may object to processing based on legitimate interests at any time. See section 13.

4. When and with whom do we share your information?

We do not sell your personal information. We never have and we do not plan to. We share it only with the service providers below, each processing it on our instructions to make a specific feature work.

Email delivery. Your account and security email is sent by our hosting provider today. If we move that to a dedicated email provider, or start receiving your replies through one, we will name it in the table above before that happens, as section 17 requires.

Each of these providers processes your data under its own published data processing terms, which limit it to processing on our instructions for the service we bought. We do not authorize any of them to use your data for their own purposes, and none of them is paid in data.

Other situations. We may disclose information if required by law, subpoena or valid legal process, or where we believe it necessary to protect our rights, investigate fraud, or respond to a threat to someone’s safety. If Sommly is involved in a merger, acquisition or sale of assets, your information may transfer as part of that deal. We’ll notify you before it becomes subject to a different privacy policy.

5. How does the AI work, and what does it see?

This is the section we’d want to read first, so here it is in plain terms.

Photos of wine lists and labels

1. Your iPhone shrinks the photo and sends it to our server function.
2. That function passes the image straight to Google’s Gemini AI, which reads the wines off it.
3. Google returns structured text: names, producers, vintages, prices, tasting notes.
4. We keep the text. We do not save the photo. The image is never written to our database or file storage; it exists only for the seconds it takes to process the request.

Before your first scan, the app tells you the photo goes to Google’s Gemini AI to be read, puts what we keep and what a restaurant photo can catch one tap away under “How this works”, and asks you to agree. Declining is a real button, and the scan does not happen.

The AI sommelier chat

When you send a message, we send Google: your message, up to your last 20 messages and replies in that conversation, a plain-language summary of your taste preferences, and any photo you attached. When you ask from a scanned list with the list attached, your message also carries the wines read from that list (up to 60 of them, with their prices) and your budget, if you set one. You send this to Google by sending the message; the question the app asks before your first photo is about photos.

The assistant also has tools it can use on your behalf. If you ask about wines you’ve tried, it reads up to 25 of your most recent journal entries and includes them in the request to Google so it can answer: the entry titles, the notes you wrote, the restaurant names, the dates, your scores and any note you left with a score. The venue map points are not sent. If you ask it to remember a wine, it writes a new entry to your journal. If it needs current information (a price, a recent vintage), it runs a Google Search on a query it composes from your conversation.

We store your chat transcripts. Each message you send, and each reply the sommelier finishes, is saved to your account in our database: the words, the time, and which conversation it belongs to. When you ask from a scanned list, the words include the list sent with your question, and we also keep the short line naming that scan, with the restaurant name if you added one. With each reply we keep a note of which of the assistant’s tools it used, such as a journal lookup or a web search, and how the reply ended. A photo you attach is not stored; we keep its caption, or the words “Sent a photo”, in its place. A reply that fails partway is not saved.

We keep them for two reasons: so your most recent conversation is waiting when you reopen the app, and so we can read conversations to find and fix answers that went wrong. They are not used for advertising, not sold, and not shared with anyone beyond the service providers in section 4 that host our database.

You can delete all of them at any time in Profile, then Clear chat history. They are also deleted when you delete your account. Storing them changes what goes to Google in one way only: when you reopen the app within six hours of your last message, the recent messages of that conversation go with your next message, as they would have if you had never left. An older conversation is shown to you and not sent.

The AI can be wrong

Three things in Sommly come from three different places, and each can be wrong. Google’s Gemini AI reads your photos: the wines, producers, vintages and prices taken from a wine list or a label are its reading of the picture. The sommelier chat’s replies are written by Gemini, from what this section says it is sent. The picks on a scanned list are not written by an AI model: your phone ranks the wines on that list by fixed rules, from your taste profile, your own ratings and anything you add, such as a dish or a budget, and writes each pick’s one-line reason the same way. All of it, including the tasting notes, price readings and identifications the app shows, is informational, can be inaccurate or incomplete, and is not professional advice of any kind. Check anything that matters, especially a price on a wine list, and especially any health-related question, which you should take to a doctor and not to a wine app.

6. Third-party websites

The app and this site may link elsewhere: a producer’s site, a source the assistant cites, our TestFlight page. We don’t control those sites and aren’t responsible for their privacy practices. When you leave Sommly, read the privacy notice of wherever you land.

7. Cookies and tracking technologies

In the app: none. Sommly’s iOS app uses no cookies, no advertising identifier, no tracking pixels, and no third-party analytics or attribution SDK. We do not present an App Tracking Transparency prompt because we do not track you across apps or websites.

On this website: also none. This site sets no cookies and uses no analytics or tracking scripts. It runs no JavaScript at all and loads no third-party resources. Every image, icon and font on the page is served from our own domain or is already on your device. That’s why you aren’t being asked to accept cookies: there are none to accept.

If we ever add analytics, we’ll name the tool here, say what it collects, and, for anything capable of building a cross-site profile, ask EEA and UK visitors for consent first.

The app’s local data is stored on your device, not in cookies, and is removed when you delete the app.

8. How do we handle Sign in with Apple?

Apple gives us a stable identifier for you, an email address (your own, or a private relay address if you chose Hide My Email), and, only on your very first sign-in, the name you agreed to share. We store the identifier and email with your account and copy the name into your profile so we can greet you. We never receive your Apple ID password, and we receive nothing else about you. Apple’s own privacy policy governs what Apple does.

9. Is your information transferred internationally?

Yes. We are based in the United States and our database is hosted in the United States (region us-west-1). Our providers (Supabase, Google, Sentry and Apple) are US companies and may process your information in the United States and other countries where they or their subcontractors operate.

If you are in the EEA, the UK or Switzerland, this means your personal information leaves your country for somewhere whose data-protection laws may be less protective.

We want to be precise about what protects that transfer, because this is a place where privacy policies routinely overclaim. Supabase, Google and Sentry each publish a data processing addendum that incorporates the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and those published terms apply to the services we use. We rely on our providers’ standard terms. We have not negotiated bespoke transfer agreements with any of them, and we are not claiming to have.

An EEA and UK representative (GDPR Art. 27). We have not yet appointed a representative in the EEA or the UK. Until we do, direct any request to hello@sommly.app and we will handle it directly.

10. How long do we keep your information?

We keep your information for as long as it is needed for the purposes set out in this notice, and for as long as we have a legal, accounting or legitimate business reason to keep it. In practice that means your account data stays for as long as your account exists: we don’t currently run an automatic deletion schedule, and your wines, ratings, notes and journal stay with you until you delete them or delete your account, because that history is the point of the product.

• Photos you scan are not retained at all (section 5).
• Chat messages are kept until you clear them (Profile, then Clear chat history) or delete your account (section 5). We do not run an automatic deletion schedule for them today.
• Crash reports are retained by our monitoring provider under its own window, typically 90 days. We do not register you with it: it holds no user record for you, no email address and no IP address. One correction we would rather state than leave out: until August 2026 your account identifier could travel to it inside the web addresses recorded alongside an error. That was not intended, it is now stripped on your device before anything is sent, and the reports that carried it age out under the window above.
• Onboarding analytics events are retained while your account exists. When your account is deleted, these events are deleted outright along with it, not merely de-linked.
• App-usage events (section 1) are retained while your account exists. They go when your login does: the database removes them automatically with it, at the last step of the deletion routine. If that last step fails, the app tells you so rather than pretending otherwise, and we finish it by hand (section 13).
• Our AI cost ledger. Every call we make to our AI provider is metered in a private record: which of our server functions called, what kind of call it was, which model answered, how many tokens it used, how long it took, whether it succeeded, an error code if it did not, and the account identifier that triggered it. It holds no prompt, no reply, no wine name and nothing you wrote, and no app or client can read it: the table is readable only by our own server key. We keep this record after an account is deleted, because it is the accounting trail for money already spent and a deletion should not rewrite what last quarter cost. What survives is a row saying a call happened and how large it was, carrying an identifier that no longer belongs to any account.
• Your Reserve membership record (section 1): Apple’s identifier for the subscription, the plan, its status, when it renews or ended, whether it was a test purchase, when Apple last confirmed it, and the account it belongs to. We keep it for as long as the subscription exists and after it ends, because Apple keeps telling us about that subscription until it is over, and a new subscription on the same Apple Account picks up the same record. When you delete your account, the link to your account is removed and the record stays, attached to no account (section 13). We also keep a log of the updates Apple sends: each update’s own identifier, its type and date, and which subscription it was about, with no account and no payment details. We do not run an automatic deletion schedule for either today.
• Email you send us. When you write to us, we keep your message so that we can answer it: your address, the recipient, the subject, the text and HTML of what you wrote, and the delivery details our mail system records, which include the message headers and a description of any attachment (its name, type and size), though not the attachment’s contents. It is filed by the address it came from rather than against your account, which means deleting your account does not reach it. If you want your correspondence deleted too, ask at hello@sommly.app and we will delete it by hand.
• Anonymized or aggregated information that can no longer identify you may be kept indefinitely.

We deliberately don’t publish a fixed retention window, such as “analytics deleted after 24 months”, because no automated job enforces one today, and a retention promise nobody keeps is worse than no promise. What we offer instead is the control that actually matters: delete your account and your own data goes at once, on demand, from inside the app (section 13), with the narrow exceptions named above and listed again in section 13.

11. How do we keep your information safe?

• Encryption in transit. All communication between the app and our servers, and all calls to our AI provider, use HTTPS/TLS.
• Encryption at rest. Our database and file storage are encrypted at rest by our hosting provider.
• Row-level security. Every table holding your data has database-enforced policies so your rows can only be read or written by your own authenticated session, enforced by the database itself, not just by app code.
• Least privilege. Our AI keys live only on the server and are never shipped inside the app.
• Password handling. Passwords are hashed by our authentication provider. We never store or log a plaintext password.
• Minimized crash reports. Error monitoring is explicitly configured not to attach personal identifiers.

No system is perfectly secure and no internet transmission can be guaranteed. Please use a strong, unique password, and tell us at hello@sommly.app if you believe your account has been compromised. We read security reports first and we won’t be annoyed that you wrote.

If there is a breach. If a security incident affects your personal information, we will notify you and the relevant regulators within the deadlines the law sets: GDPR Art. 33 and 34 in the EEA and UK, and the US state breach-notification laws that apply to you. We state that here rather than leaving you to look it up.

12. Do we collect information from minors?

Sommly is for adults of legal drinking age and is not directed to children.

The app is about wine. It contains frequent references to alcohol, discusses alcoholic products in detail, and is rated accordingly on the App Store. You may use Sommly only if you are at least 21 years old, or the legal drinking age where you live, whichever is higher. See the Terms of Service.

We do not knowingly collect personal information from anyone under the legal drinking age, and never from a child under 13, and we do not knowingly permit anyone under the legal drinking age to use the service. We do not have age-verification technology and we do not ask for a date of birth.

13. What are your privacy rights?

Which of these rights you have depends on the law where you live. They’re all described here so you can see the whole set, and we honor each of them where the law that applies to you provides it. In practice we don’t ask people to prove their jurisdiction before we act on a request, and we would rather help than argue about it, but nothing in this notice grants you a right the law where you live does not.

• Know / access. Ask what personal information we hold about you and get a copy.
• Portability. Get your data in a portable, machine-readable format.
• Correct. Fix anything inaccurate. Your name, taste profile, ratings and journal entries are directly editable in the app.
• Delete. Delete your account and your own data yourself, from the Profile tab. You don’t have to ask us. See “Deleting your account” below, including the things that stay.
• Opt out of sale or sharing. There is nothing to opt out of: we don’t sell your personal information and we don’t share it for cross-context behavioral advertising.
• Limit use of sensitive information. We don’t collect sensitive personal information for the purposes that trigger this right.
• Object / restrict. (EEA, UK) Object to processing based on legitimate interests, or ask us to restrict processing.
• Withdraw consent. Where we rely on consent, meaning notifications and the nearby-restaurant lookup, withdraw it any time in iOS Settings. Withdrawal doesn’t affect processing that already happened.
• Non-discrimination. We won’t degrade your service, charge you more, or treat you differently for exercising any of these rights.
• Appeal. If we refuse a request you may appeal by replying to our decision; we’ll respond in writing with our reasoning.
• Complain to a regulator. EEA/UK users may complain to their local supervisory authority. California residents may contact the California Privacy Protection Agency or the Attorney General.

How to exercise them

Email hello@sommly.app from the address on your account and tell us what you want. We’ll verify it’s really you, usually by confirming you control the account email, and respond within 45 days for US state-law requests (extendable once by 45 more days if we tell you why) and within one month for GDPR requests (extendable by two more months for complex requests). An authorized agent may act for you with written proof of authorization.

You can also do a lot of this yourself in the app: edit your name in the Profile tab, retake the taste quiz to replace your profile, and delete individual ratings and journal entries.

Deleting your account

You can delete your account and your own data from inside the app. Open the Profile tab and choose Delete Account. You’ll be asked to type DELETE to confirm, because this cannot be undone.

When you confirm, a server-side routine removes:

• your scans and the wines each scan found;
• your journal entries, including restaurant names and venue map points;
• your ratings and tasting notes;
• your Wine Passport stamps;
• your favorite wines;
• your conversations with the AI sommelier;
• your onboarding analytics events;
• your app-usage events;
• your taste profile;
• your profile record, including your display name;
• anything in your private scan-image folder;
• and finally your login itself.

Your device’s local copies (cached taste signals and app preferences) are cleared in the same pass. There is no grace period and no recovery: when it’s done, it’s done. There is no export button. If you want a copy of your data, email hello@sommly.app from your account’s address before you delete, and we’ll send it.

If deletion fails part-way, the app tells you so plainly rather than pretending it worked. If that happens, email hello@sommly.app and we’ll finish it by hand and confirm when it’s done.

14. Do-Not-Track and universal opt-out signals

Do-Not-Track. Most browsers offer a “Do-Not-Track” setting. No common standard for honoring it has been finalized, so this website does not currently respond to DNT signals. If a standard is adopted, we’ll update this notice.

Universal opt-out mechanisms (Global Privacy Control). Several US state laws in California, Colorado, Connecticut, Texas and others require businesses to honor an opt-out preference signal such as GPC for the sale or sharing of personal information. Sommly doesn’t sell or share personal information for advertising, so there is nothing for a GPC signal to turn off. If that ever changes, we’ll honor GPC signals on this website and we’ll say so here first.

15. California residents (CCPA/CPRA)

If you’re a California resident, the CCPA as amended by the CPRA gives you specific rights.

Sources: you, directly; your device, automatically; and Apple, if you use Sign in with Apple or subscribe to Reserve. Business purposes: as described in section 2. Disclosures: to the service providers named in section 4, each contractually limited to processing it for us.

Sale and sharing. We have not sold personal information, and have not shared personal information for cross-context behavioral advertising, in the preceding twelve months. We don’t do so now and we don’t sell or share the personal information of anyone, including minors under 16.

Your California rights: know, delete, correct, opt out of sale/sharing (nothing to opt out of), limit use of sensitive personal information (none collected), and non-discrimination. Email hello@sommly.app. We verify identity via your account email; an authorized agent may act for you with written permission.

Shine the Light (Cal. Civ. Code §1798.83): we don’t disclose personal information to third parties for their own direct-marketing purposes.

16. Other US state privacy rights

Comprehensive privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states give residents rights to confirm, access, correct, delete and port their personal data, and to opt out of targeted advertising, sale, and certain profiling.

We don’t try to work out which state you’re in before we answer a request, so in practice the process in section 13 is the same for everyone; which rights you actually have is a question of the law of your own state, and this notice does not add to it. Email hello@sommly.app and we’ll respond within your state’s deadline (45 days in most states). If we deny a request you may appeal by replying to our decision; we’ll respond within 60 days and, if we still deny it, tell you how to complain to your state Attorney General.

Targeted advertising, sale, and profiling: we do none of these. We don’t use your data for targeted advertising, we don’t sell it, and we don’t use automated profiling to make decisions with legal or similarly significant effects about you. Ranking wine recommendations by your stated taste is the only profiling we do, and its worst-case consequence is a wine you don’t love.

Nevada residents: we don’t sell personally identifiable information as defined by Nevada law.

17. Do we make updates to this notice?

Yes. We update this notice when the app’s data practices change, and we review it at least once a year. The “Effective” date at the top always reflects the current version.

If we make a material change, such as a new category of data, a new provider or a new purpose, we’ll take reasonable steps to tell you, in the app or by email, and we’ll give advance notice or ask for your consent where the law requires it. The current version is the one published at sommly.app/privacy.html. We won’t retroactively apply a weaker policy to information we already collected under a stronger one.

18. Contact, review, update, or delete your data

Data controller: Ashwood Data LLC, a California limited liability company.

Privacy contact: hello@sommly.app, the same address for privacy requests, security reports and support.

Postal address: Ashwood Data LLC, 11420 Santa Monica Blvd, Unit 252091, Los Angeles, CA 90025.

To review, update or delete your data:

• Update: edit your name, retake the taste quiz, and edit or delete individual ratings and journal entries directly in the app.
• Delete your account: do it yourself in the app, under Profile, then Delete Account (section 13). You don’t need to ask us, and you don’t need a reason.
• Access or export: email hello@sommly.app from the address on your account and we’ll send you a copy of your data.

Governing law: set out in section 17 of our Terms of Service, and the same choice governs this policy.