Legal

Privacy Policy

Last updated: August 3, 2026 · Version: 2026-08-03

1. Who Processes the Data

The Data Controller is Individual Entrepreneur MAKSIM GUSEV (Tax ID 304665609), registered at: Georgia, Tbilisi, Krtsanisi district, Ponichala settlement 3, building 5, entrance 2, floor 4. Inquiries regarding any data-related matters are accepted via email at: [email protected]. Data processing is conducted in accordance with the legislation of Georgia.

The legal basis for processing is the performance of the contract you enter into by accepting the Terms of Service, and your consent, recorded during registration along with the date and document version. Consent can be withdrawn by deleting your account.

2. What Data is Collected

• Account data: email address, password hash (argon2id algorithm — the password itself is not stored and cannot be recovered), name (if you provided one), and date of birth. The date of birth is requested to confirm your legal drinking age in accordance with the service rules and is not visible to anyone but you.
• Settings: interface language, theme, timezone, default currency, and the toggle for displaying expenses.
• Diary content: tasting entries including date, volume, rating, taste characteristics, aromas, and notes; wine cards; price, currency, country of purchase, and selected store; photos of the bottle and label.
• Technical session data: IP address and browser string (User-Agent) at the time of login. These are necessary to distinguish devices, revoke sessions, and rate-limit requests during password entry attempts.

The service does not collect data about your health, does not build advertising profiles, and does not enrich your profile with data from external sources.

3. Photos

Before saving, the server strips all metadata from the image, including GPS shooting coordinates; only the image orientation is retained. Files are stored in a private storage bucket and are served via signed URLs with a 5-minute lifespan — unauthorized persons cannot access anything via a direct file link.

4. Who Can See Your Entries

• By default — only you. There is no global feed, subscriptions, comments, or access for other users to view someone else's diaries within the service.
• A single entry can be published via a shared link. The publication includes photos, the wine and its characteristics, rating, taste category, impressions, and notes; your name is included only if you have enabled the corresponding toggle. Price, store, email address, and your other entries are not included. The link can be revoked in one click.
• Store names form a shared directory available to all users when selecting a store. Information about who added the name is not displayed in the interface, and when an account is deleted, this link is also erased from the database.

5. Cookies and Browser Storage

The service uses one technical cookie — between_bubbles_refresh. It is httpOnly (inaccessible to page scripts), transmitted exclusively over HTTPS, restricted to the /api/auth path, and lives for 30 days; it contains the session extension token. Login is impossible without it, therefore no cookie consent banner is required.

In the browser's local storage, the service keeps only internal login and logout flags to synchronize open tabs. There are no analytical, advertising, or tracking scripts used in the service.

6. Where Data is Stored and Who Else Sees It

Data is hosted in a data center located in Frankfurt (Germany). Subcontractors:

• DigitalOcean — application servers, database, and storage for photos and backups.
• Resend — delivery of service emails: email address confirmation, password recovery, and notifications regarding changes in terms. Only the recipient's address and the email text are transmitted.
• Cloudflare — domain DNS. User traffic does not pass through Cloudflare.

Cross-Border Data Transfer. Because our servers are located in Frankfurt, Germany, your data is transferred to and stored within the European Union. Germany provides an adequate level of personal data protection in accordance with the GDPR and Georgian data protection laws. By agreeing to this Policy, you explicitly consent to such cross-border transfer, storage, and processing of your data.

Data is not transferred or sold to third parties. The only exception is a lawful request from an authorized state body, provided it is presented in the manner prescribed by law.

7. How Long Data is Stored

• Diary content — as long as the account exists.
• Deleted entries remain in the trash for 30 days, after which they are deleted automatically.
• After deletion, an account is kept for 30 days — this serves as a grace period for recovery upon request. After this period, entries, wines, photos (including files in storage), and personal data are permanently deleted without the possibility of recovery.
• Sessions live for up to 90 days, and information about completed sessions is deleted within 7 days after they end.
• Database backups are kept for up to 30 days; therefore, deleted data completely disappears from backups within this timeframe.

8. Your Rights

• View and correct. All data about you is visible in the application: profile, entries, and photos. They can be modified or deleted at any time.
• Export. Settings → export diary to CSV and JSON formats, without contacting support and without waiting.
• Delete. Settings → account deletion. No separate request to support is required.
• Contact. Questions, complaints, and requests regarding data processing should be directed to [email protected]. We will respond within 30 days.

9. Security

The connection to the service is secured via HTTPS. Passwords are stored exclusively as an argon2id hash, and email links as a token hash with a limited lifespan (one hour for password recovery, 24 hours for email confirmation). Changing the password and deleting the account will revoke all active sessions. The frequency of login attempts and file uploads is rate-limited. Photos reside in closed storage and are accessible only via short-lived signed links.

10. Children

The service is not intended for individuals under 18 years of age and does not intentionally collect their data. If such an account is discovered, it will be immediately deleted.

11. Policy Changes

New versions are published on this page with an updated date and version number. We will notify you of any significant changes via the email address provided during registration.