Cellarune Privacy Notice

1. What Cellarune processes and why

Data / provider	Purpose and basis	Choice	Retention
Cellar Data on device and Apple iCloud/CloudKit	Store and sync the cellar; provide your requested feature	Local storage is required; iCloud sync is optional	Until you delete records or local data; iCloud copies and backups follow Apple settings and retention
Sign in with Apple and Firebase Authentication identifiers, Apple-supplied email, security/device data, and IP address	Cellarune Account, managed AI, deletion, security, and abuse prevention	Optional for cellar management and Store Subscription features; required for managed AI and account deletion	Until account deletion; provider backups or legally required records may take longer
Apple purchase history and RevenueCat subscription, installation, technical, and linked Firebase user ID data	Process purchases, validate Premium, restore access, and meet billing obligations	Optional unless you purchase Premium	Under Apple/RevenueCat terms and legal duties; Cellarune requests RevenueCat deletion with account deletion
Label Photos and bottle format via authenticated Firebase Functions to Google Gemini	Smart Scan and Initial Drinking Window Estimate; your Third-Party AI Permission and requested feature	Optional; refusal cancels before the network request and uses no AI allowance	Not intentionally stored in Firestore or Cellarune logs; Google's paid-service security, abuse, and legal controls apply
Wine Name, Producer, vintage, origin, varietals, wine type, and format via Firebase to Gemini	Drinking Window Update; your Third-Party AI Permission and requested feature	Optional; refusal cancels before the network request	Not intentionally stored in Firestore or Cellarune logs; Google's paid-service controls apply
Firestore quotas, Premium state, bans, expiry metadata, and deletion cooldown marker	Allowances, security, and fraud prevention	Required for managed AI	Account records until deletion; daily counters about 30 days, monthly about 93 days, cooldown 30 days
Google Cloud operational metadata: request ID, operation, status, latency, usage, token/image counts, and error category	Reliability, support, security, and cost control; legitimate interests	Required for managed AI	Production Cloud Logging default bucket: 30 days
Firebase Analytics app-instance, app/device, coarse product-use, lifecycle, and approximate-location data	Product measurement; consent	Optional and off by default	Two months; disabling resets Cellarune analytics state and stops future collection
Website IP, browser/device, page request, and security data processed by Microsoft Azure	Deliver and secure this website; legitimate interests	Required to load the site; email is an alternative	Azure operational/security settings and Microsoft terms; no Cellarune advertising profile

“Cellar Data” includes your cellars, shelves, slots, bottles, Label Photos, tasting notes, wishlist, and bottle events. Cellarune's Firebase backend does not own or store your cellar as a collection. Cellarune does not sell personal data, show third-party advertising, or track you across other companies' apps.

2. Third-Party AI Permission and Gemini

Before the first Smart Scan or Drinking Window Update on a device, Cellarune names Google Gemini, describes the data categories above, and asks you to choose Continue or Not now. This versioned, device-local permission is separate from camera/photo access and Product Analytics consent. Not now cancels before the network operation and does not consume an AI allowance.

You can withdraw permission in Settings. Withdrawal affects future requests; Cellarune asks again before sending new data. A material recipient, purpose, or data-category change also requires a new permission version.

The production Gemini project had Cloud Billing enabled when this notice was updated. The backend does not include your Firebase or Cellarune Account ID in the Gemini request. Cellarune does not claim Zero Data Retention; Google's paid-service security, abuse-prevention, and legal processing may apply.

3. Accounts, purchases, quotas, and security

Cellarune Account is separate from Cellar Data. Apple processes App Store purchases and RevenueCat validates the premium entitlement; Cellarune does not receive payment-card details. Purchase, Restore Purchases, unlimited bottle storage, and Premium import do not require a Cellarune Account. Sign in is required only when you invoke managed AI or delete an account.

Free users receive ten lifetime Smart Scan Attempts. Premium includes 50 AI attempts per UTC day and 100 per UTC month, shared by Smart Scan and Drinking Window Update. An admitted request consumes one attempt even after a partial result or later provider failure.

Cellarune uses App Check, App Attest replay protection, authentication, server-side entitlement checks, transactional quotas, TLS, Keychain, Apple Data Protection, and allowlisted logs. No system is completely secure.

Account deletion keeps only a pseudonymous HMAC deletion-cooldown marker and dates for 30 days. It contains no Apple identifier, email, Firebase user ID, Cellar Data, purchase history, or prior quota counters.

4. Providers, overseas processing, and protection

Providers are Apple (iCloud/CloudKit, Sign in with Apple, App Attest, App Store), Google (Firebase Authentication, Functions, Firestore, Logging, optional Analytics, Gemini), RevenueCat (subscription validation), and Microsoft Azure (website hosting).

They may process data outside Thailand. Cellarune limits sharing to stated purposes and uses authentication, encryption in transit, access controls, and provider contractual/data-protection terms. Provider terms, legal requests, sub-processors, and overseas laws may still apply; identical legal remedies cannot be guaranteed in every location. Contact Cellarune for information about the provider or transfer applicable to a request.

5. Your choices and rights

Depending on applicable law, you may ask to:

access or receive a copy of personal data;
correct inaccurate data;
receive portable data where applicable;
object to or restrict processing;
delete personal data;
withdraw consent or Third-Party AI Permission without affecting earlier lawful processing; or
complain to Thailand's Personal Data Protection Committee (PDPC).

Email [email protected] with the right requested and enough information to locate the relevant account. Do not email passwords, API keys, Label Photos, or Cellar Data. Identity verification or a legal exception may apply.

In-app controls include record deletion, cellar export, AI-permission withdrawal, Analytics opt-out, Apple subscription management, and Cellarune Account deletion. Account deletion does not delete private iCloud Cellar Data or cancel an App Store subscription. Cellarune v1 does not claim it can delete Apple's native private CloudKit zone.

6. Changes

Material changes will be communicated through an appropriate app or store notice. This notice describes Cellarune's practices but does not claim that an email-only contact resolves every controller-address requirement.