In plain terms: to read a wine list or food menu, we send the photo to our server and to our AI provider (Anthropic) — that's real off-device processing, not a "no data collected" app. We keep the photo only for the moment it takes to read it, then discard it. Your saved records live in your own private iCloud, not on our servers. We don't run ads, we don't use analytics trackers, and we never sell your data.
1. Wine-list or food-menu photos & AI processing
When you read a wine list or food menu, the photo you capture or choose is sent from the app to our server (the "proxy"), and from there to Anthropic, our AI provider, so it can read the printed wines or dishes and suggest likely pairings. This is necessary for the scan to work — Sommelier Diary does not run the vision model on your device.
- What is sent: a photo of the wine list or food menu, your device's locale (for language), an anonymous metering token, and — only if you have set them in Settings — your scan preferences: the spoken line's tone, your price range with its currency, and, once your diary holds enough scored bottles, a compact palate summary (three 1–5 taste averages, the axis they were measured on, up to three style words, and how many nights they average — never a venue, a price you paid, a date, or any note text). Never your name, contacts, precise location, or account details.
- Retention: our proxy processes the photo and does not store it after the request completes. We do not keep a copy of your photos, and they are never added to a photo library or profile we control.
- Food menus: a menu reading also sends the already-read wine rows, the wine reading’s ID, your maximum and currency, and tastes to avoid. One successful menu read is included per wine reading, without using a monthly reading. The photo and parsed dishes and pairings are not kept. Only a used-marker linked to your entitlement identity and reading ID is kept for 7 days to record that the free menu read was used. A daily attempt counter expires after 24 hours and limits menu reads to 12 per day. A retry can receive a result only while the same request lease is still live, never from stored menu content. In the app, food matching is held only for the current reading. Food matching makes no allergy-safety claims.
- Caching: to keep the app fast and affordable, our server may cache facts we've already looked up about a specific wine (producer, name, vintage) — never the photo itself, and never anything that identifies you.
- Anthropic's role: the photo is submitted to Anthropic for inference only, under Anthropic's commercial API terms, which means it is not used to train Anthropic's models.
Before a wine list or food menu is first sent, the app shows a plain-language disclosure explaining that the photo leaves your device — you see this before anything is sent.
2. Wine-name searches for price & rating enrichment
For a handful of the most relevant wines on a scanned list, the app looks up current reference prices and ratings using a web search performed by our AI provider. Only short wine-name query strings (producer, cuvée, vintage) are sent for this — never the photo and never anything that identifies you. Where a price or rating comes from a web source, we show you the source link so you can check it yourself.
3. Your records & journal — stored in your own iCloud
Wines you save, notes you write, and your tasting history are stored using Apple's CloudKit, in your own private iCloud account. This data is never sent to our servers and we cannot see it, read it, or store a copy of it. It stays under your Apple ID, and you control it the same way you control any other iCloud data on your device — including deleting it.
4. Subscription & usage metering
Sommelier Diary is a subscription app. Your purchase is handled entirely by Apple — we never see your payment details, card number, or billing information. To enforce the monthly scan limit included in your plan, our server checks an anonymized entitlement token derived from your App Store subscription. This token confirms you have an active subscription and tracks how many scans you've used this period; it is not tied to your name, email, or Apple ID in any way we can read.
5. What we don't do
- No advertising, and no third-party ad networks.
- No analytics or tracking SDKs of any kind.
- We never sell, rent, or share your personal data with third parties for their own purposes.
- No cross-app or cross-site tracking. We don't build an advertising profile of you.
The only off-device processing we do is the AI reading of a wine-list or food-menu photo you actively choose to read (Sections 1–2) — together with the scan preferences described in Section 1, processed and discarded the same way — and the metering described in Sections 4 and 6. Your saved records, your tasting history, and your palate report are computed and stored on your device or in your own private iCloud; what a scan carries is only the compact palate summary above, never the report, the records, or the notes behind it.
6. Data retention & your choices
- Scanned photos: not retained after the scan completes.
- Anonymous menu statistics: after a successful reading, we retain what the wine list itself contained — wine names, vintages, printed prices, the list's currency, and the venue name if the list printed one — together with the city-level region the request came from (derived from our hosting provider's coarse network headers; the network address itself is never stored) and the calendar day. These records carry no device identifier, no account, no token, and no precise location, and cannot be linked back to you or your scan. We never ask for or use GPS.
- Anonymous selection counts: the app reports which recommendations are shown and followed (for example, "this wine was ordered") as bare counts with the same city-level region — never tied to a device, account, or scan.
- Cached wine facts (producer/name/vintage only): retained temporarily to keep future scans fast, then refreshed periodically.
- Your records and journal: retained in your iCloud for as long as you keep them; delete them any time from within the app or by managing iCloud storage on your device.
- Food menus: no photo, parsed dishes or pairings are retained. A used-marker lasts 7 days; the daily attempt counter lasts 24 hours (Section 1).
- Metering token: retained only to track your current billing period's scan count; it resets each period.
- Records that earn scans back: when the anonymous-statistics switch is ON, each choice you record sends its random record ID (an opaque identifier whose format cannot contain a wine name) with your subscription token, so we can credit half a scan back (at most three per month) and never credit the same record twice. We retain only that opaque ID and the count — no wine, no venue, no price — and it can never be joined to the anonymous menu statistics, which carry no identity at all.
- Withdrawing your choices: turn the anonymous-statistics switch off in Settings at any time — from that moment the app sends no menu statistics, no selection counts, and no record-credit requests. Clear your price range, tone, or scored bottles and those preferences stop accompanying your scans immediately. Scanning itself is always your explicit act. With that switch off, nothing is sent to us between scans, and your diary syncs only through your own private iCloud account — never to our servers.
7. Children's privacy
Sommelier Diary is not directed at children and is not intended for use by anyone under the legal drinking age in their jurisdiction. We do not knowingly collect data from children.
8. Changes to this policy
If we change what data the app sends off-device or how it's handled, we'll update this page and change the "Last updated" date above. Material changes that affect what leaves your device will also be reflected in the in-app disclosure you see before scanning.