What we hold, and what we don’t

What VINTORY stores

Your collection: the bottles you add and the details attached to them — producer, wine, vintage, region, quantity, what you paid if you entered it, your notes, and the moments you record on a bottle’s timeline. That is the substance of the app, and it exists because you put it there.

An account layer built on Supabase is being introduced so that a collection can belong to a person and follow them between devices. Where it is enabled, sign-in is by emailed magic link, which means we store your email address and Supabase stores the session that keeps you signed in. Each collection is readable only by the account that owns it. Where the account layer is not enabled, the app runs in demo mode and your collection stays in your browser.

Photographs of labels

When you photograph a label to add a bottle, that image is sent to Anthropic’s API so the label can be read and turned into producer, wine, vintage and region. We do not retain the image afterwards, and we do not use it to train anything. Anthropic handles it under their own terms and privacy policy, which you should read if this matters to you.

The same applies to questions you ask the sommelier: the question, and enough context about where you are standing and what your collection holds to answer it, are sent to Anthropic’s API and answered back.

Weather

The live conditions over a wine region come from Open-Meteo, a public forecast service. We send it the coordinates of the wine region you are looking at. We do not send it your location or anything about you.

What we never do

• No advertising, anywhere in the app.
• No selling, renting or brokering of your data.
• No third-party advertising or tracking pixels.
• No building of a profile about you for anyone else’s purposes.

Your collection is yours

You can correct anything the app identified wrongly, delete any bottle, and ask for your account and everything in it to be removed. Write to [owner to confirm — contact email] and we will do it.

The parts we cannot write yet

The legally required details — the company or individual acting as data controller, the registered address, the governing jurisdiction, and the specific retention periods — are left blank on purpose rather than invented:

• Data controller: [owner to confirm]
• Registered address: [owner to confirm]
• Governing jurisdiction: [owner to confirm]
• Retention period after account deletion: [owner to confirm]
• Privacy contact: [owner to confirm]

If we change how any of this works, this page changes with it. Last updated: [owner to confirm — publication date].