Privacy policy

Last updated: 2026-05-30

The short version

WineTone is a research demonstration run by an individual. It collects the bare minimum data needed to operate, never sells it, and pseudonymizes everything that doesn't strictly need an identifier. Your sign-in identity is decoupled from your labels at the database level: when you delete your account, every backup of your labels ever taken becomes a permanent orphan with no link back to you.

• Your username is visible to signed-in members only — not to anonymous visitors, search engines, or social-media unfurls.
• The wines you label are public (the wine itself, not the attribution).
• Your label descriptions are public, shown without your username to anonymous visitors.
• Who you follow is visible to signed-in members only.
• Your fitted personal projection is queryable indirectly by anyone who searches the corpus, but is not attributed to your username for anonymous visitors.

Please use a pseudonym and don't enter anything you wouldn't post publicly elsewhere — a signed-in adversary is still an adversary.

Your rights

These rights apply to you regardless of where you live; we extend GDPR-level rights worldwide as a matter of policy, not just to EU/UK/EEA residents. Where a specific regulation grants additional rights, those are noted inline.

• Right to access (GDPR Art 15, CCPA §1798.110) — see everything we have on you via /me/export while signed in. Returns a JSON file with your account record, labels, projections, follow graph, and audit history.
• Right to data portability (GDPR Art 20, CPRA §1798.130) — the export above is in a portable, machine-readable format you can re-import elsewhere or destroy at will.
• Right to rectification (GDPR Art 16) — edit your username via the ✎ button on your profile; edit individual labels via the in-place editor on each wine page; change your email via the Clerk user button (top-right when signed in).
• Right to erasure / "right to be forgotten" (GDPR Art 17, CCPA §1798.105) — see Deletion below.
• Right to restriction of processing (GDPR Art 18) — email privacy@tone.wine if you want your account preserved but excluded from future model training. We honor this manually since there's no UI flag yet.
• Right to object (GDPR Art 21) — also via the privacy contact email.
• Right not to be subject to solely-automated decision making (GDPR Art 22, CPRA §1798.185) — see Automated decisions below. WineTone generates recommendations algorithmically; you can disregard them.
• Right to withdraw consent (GDPR Art 7(3)) — withdraw at any time by deleting your account.
• Right to lodge a complaint with a supervisory authority (GDPR Art 77) — your national DPA, e.g., the UK ICO, the California Attorney General, the LGPD's ANPD in Brazil, etc.
• Right not to be discriminated against for exercising your CCPA rights (§1798.125).

"Do not sell or share my personal information"

We do not sell your personal information for monetary or other valuable consideration. We do not share it with third parties for cross-context behavioral advertising. There is no opt-out necessary because there is nothing to opt out of. This statement is provided under California Civil Code §1798.135 and equivalent state laws (Colorado CPA, Virginia VCDPA, Connecticut CTDPA, Utah UCPA, etc.). If at some future point we ever begin selling or sharing, we will publish a clear opt-out before doing so.

Lawful bases for processing (GDPR Art 6)

We do not rely on consent (Art 6(1)(a)) as a primary legal basis for any processing because consent is brittle — every change to processing would re-prompt every user. The activities above are either necessary to provide the service (contract) or balanced against a clear and disclosed legitimate interest. You can still withdraw your overall agreement by deleting your account.

What we collect

• Authentication data via Clerk. Your email address, sign-in method (email / Google / GitHub), and the session JWT that authorizes your requests. Clerk's privacy policy governs how they handle this: clerk.com/privacy.
• Your application data. Username (display_name), wine labels, label descriptions, sentiment markers (positive / negative), fitted projection matrices (linear + MLP), follow relationships, and any wines you submit to the catalog via "Add a wine."
• Server logs. HTTP request URLs, timestamps, response codes, and the IP address your request originated from. Hosted by Hugging Face Spaces; HF's retention applies.
• Audit log. A timestamped record of changes to your account row (rename events, etc.) so we can answer "why did this change" investigations. Live audit log retains old/new values during your account's life; on deletion those values are scrubbed.
• Analytics (if enabled). Visit counts and browser-language summaries via cookieless web analytics (Cloudflare). No identifiers, no fingerprinting.
• Error reports (if enabled). Stack traces of server-side exceptions via Sentry, with send_default_pii=False enforced so request URLs and POST bodies are scrubbed.
• Photos you upload to scan a wine label. The bytes are sent to Anthropic Claude for OCR, then released by our process immediately. We do not persist photos to disk or database. We do not retain them beyond the lifetime of the single request. Photos may incidentally contain things in the background (faces, addresses); only upload photos whose content you're comfortable transmitting to Anthropic's vision API. See Anthropic's privacy policy for their handling.
• Client-side storage. We set one cookie (__session, by Clerk) and use the browser's localStorage for a single non-identifying flag (winetone-disclaimer-seen) so we don't reshow the privacy banner. No identifiers persisted on your device.

Pseudonymization (the GDPR mechanism we rely on)

Internally we generate a random UUID called masked_id for every user at sign-up. Every table that references you (labels, projections, follows, audit log, wine submissions) stores only the masked_id, never the PII-bearing fields. The users table — the single place that maps masked_id → display_name / email / clerk_user_id — is the only join point.

When you delete your account, your users row is removed. Every other row keyed by your masked_id immediately becomes a permanent orphan: no path back to your real identity, ever. This is what makes our backups GDPR-honest: they never carry the user_id or any PII, only the masked_id. The day you delete is the day the link is severed in every snapshot we've ever taken.

Sub-processors

We use the following third-party services to operate WineTone. Each is governed by its own privacy policy; clicking their name takes you to the relevant document.

Cross-border data transfers

All of the sub-processors above are US-based or USA-headquartered with global infrastructure. If you're accessing WineTone from the EU/EEA, UK, Switzerland, Brazil, or another jurisdiction with restrictions on transfers to the US, your data crosses borders.

We rely on the following safeguards as documented by the sub-processors themselves:

• EU/UK Standard Contractual Clauses (SCCs) — published by Clerk, Hugging Face, Neon, Cloudflare, Sentry, Anthropic, and GitHub as part of their respective customer agreements.
• EU-U.S. Data Privacy Framework — where applicable, sub-processors that have self-certified.
• Minimization on our side. The pseudonym design above is itself a transfer-restriction-style mitigation: even if data is exposed in a US-based store and that store is breached, only the users table contains PII; everything else is masked-id-keyed.

Retention

• Application data (labels, projections, follows, etc.): retained for the life of your account. On deletion, removed from the live database via cascading DELETEs.
• Backups (pseudonymized, on a private GitHub repo): retained indefinitely. After your account is deleted these rows survive in snapshots but are permanent orphans — no path back to your identity since the mapping was only in the users table.
• Audit log: rows persist after deletion (we want the audit trail) but PII fields (old display_name, etc.) are nulled out immediately on user delete; only timestamps + event type + the masked pseudonym remain.
• Server logs: retained per Hugging Face's retention policy (currently a small number of days).
• Sentry error traces: retained per the Sentry free-tier retention (30 days at time of writing).
• Photos uploaded to /wines/scan: not retained — discarded after the OCR response.

Automated decision-making (GDPR Art 22 / CPRA opt-out)

WineTone's recommendation engine is, by definition, automated: we encode your query, project it through your fitted personalization, and rank wines by similarity. None of these "decisions" produces legally-binding or similarly-significant effects on you (we suggest wines; we do not make hiring, insurance, credit, or housing decisions). Under GDPR Art 22, only the latter category requires special opt-outs.

Even so, you may opt out of having your labels used to train future shared model versions (i.e., the model is calibrated to you, but your labels don't feed back into the global encoder when it retrains) by emailing privacy@tone.wine. We will tag your account accordingly and the next retrain will exclude your labels from the training set.

Deletion (right to be forgotten)

Sign in, go to your dashboard, scroll to the bottom, click Delete my account permanently. We will:

• Scrub PII fields in your historical audit log entries (old_value / new_value set to NULL) so prior display_name values cannot be reconstructed.
• Delete the row in users that identifies you. Cascade-delete your wine labels, label embeddings, fitted projections (linear + MLP), calibration history, and follow relationships (in both directions — you stop following and stop being followed).
• Call Clerk's Backend API to delete your authentication record so you can re-sign-up cleanly with the same email.
• Log a final "deleted" event for compliance evidence — with your clerk_user_id but NOT your display_name.

Wine entries you submitted to the catalog via "Add a wine" remain in the catalog after your account deletion — they become attribution-less catalog entries indistinguishable from pipeline-imported wines. This is intentional: deleting the wine would break recommendations for everyone calibrated against it. To request removal of a specific wine, email the privacy contact.

Server logs, analytics aggregates, and error traces are not individually keyed to your username so are not deletable. They contain no personal data beyond the IP from which a request originated, which the hosting providers age out per their own policies.

Breach notification

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (under GDPR, this is within 72 hours of becoming aware) where required by law.
• Notify affected users directly via the email address on file with Clerk, without undue delay, where the breach is high-risk.
• Publish a post-mortem at tone.wine/breach summarizing what happened, what was accessed, and what we did about it.

Children

WineTone is about wine. Don't use it if you're under the legal drinking age in your jurisdiction. We do not verify ages and do not knowingly collect data from minors. We are not directed at children under 13 (COPPA), under 16 (GDPR-K), or any other statutory child-protection threshold. If you believe a minor has provided data to us, email the privacy contact and we will investigate and delete.

Cookies (one and only one)

We set one cookie: __session, by Clerk on sign-in. It's Secure, SameSite-Lax, and contains a short-lived signed JWT that proves you're signed in. Deleting your account removes it; signing out clears it.

Under the EU ePrivacy Directive (and equivalent rules in the UK, California, etc.), consent is required only for cookies that are not strictly necessary for the service the user is requesting. The __session cookie is the mechanism by which we know you're signed in — without it, you couldn't add labels because we'd have no way to know it's you. Under established EU guidance that qualifies as strictly necessary and is exempt from the consent requirement.

We do not use:

• Tracking cookies — no Google Analytics, no Facebook Pixel, no advertising identifiers.
• Persistent profiling cookies beyond the session JWT.
• Third-party cookies set by anyone other than Clerk for the sign-in flow itself.

Cloudflare Web Analytics (when enabled) uses cookieless beacons — no identifier persisted, no fingerprinting.

Changes to this policy

When this policy changes, the date at the top updates. There is no separate notification — this site is small enough that an email list would itself be PII collection.

Privacy contact

For any privacy request (access, deletion, restriction, portability, objection, complaint, or otherwise): privacy@tone.wine.

WineTone is a small research project; there is no formal Data Protection Officer because we do not meet the GDPR Art 37 thresholds for designation (we are not a public authority, we do not engage in large-scale systematic monitoring of individuals, and we do not process special categories of data at scale). The privacy contact above is the single point of contact for all data-subject requests and responds within 30 days.