Privacy Policy

This policy explains what Bourbon Project ("we", "us") collects when you use the Bourbon Project app and the website at bourbonproject.com, why we collect it, who else sees it, and what you can do about it.

The short version

1. What we collect

Information you give us

• Profile. Username, display name, email address, a password stored only as a cryptographic hash, and optionally a profile photo, a short bio, a location you type in, and your favourite distillery and bourbon.
• Your collection. The bottles you add and everything you record about them: status, purchase date, what you paid, your notes, your own custom fields, your photographs, wishlist and favourites.
• Community activity. Discussions and replies you post, images you attach, likes, reports you file, and members you block.
• Reported prices. Prices you enter or flag, which are contributed to a shared price record.
• Support messages. What you send us and the address you send it from.

Information collected automatically

• Device and app data. Platform, operating system version, app version and device model, so we can support your device and diagnose faults.
• Server logs. IP address, timestamp and the request made, kept for security, abuse prevention and debugging.
• Product usage. Basic in app events, including which feature led you to a membership screen. This is our own data, used to decide what to build. It is not shared with advertisers.

What we do not collect

We do not collect precise device location, your contacts, your calendar, your health data, or advertising identifiers. The "location" on your profile is free text you choose to type. We do not use third party advertising or cross app tracking software.

Guest mode

If you use the app as a guest, you have no account with us. Preferences are held on your device, and our servers see only the ordinary request data described above.

2. Camera and photos

The app asks for camera access only when you scan a bottle, and for photo library access only when you attach an image. You can refuse either, and the rest of the app keeps working.

• Barcode scanning reads the code on your device and sends only the code to us so we can match a bottle.
• Label scanning sends the label image to a text recognition service so the text can be read back. The image is used to identify the bottle for you, is not published anywhere, and is not used to train anyone's models.
• Photos you attach to a collection entry or a post are stored with that entry or post. Photos on a public post are visible to other members.

3. Notifications

If you enable push notifications we store a push token for your device, along with your preferences for replies, mentions, likes and price alerts. The token is sent to the Expo push service, and from there to Apple or Google, in order to deliver the message. Turning notifications off in Settings, or in your operating system, stops this. Removing the app invalidates the token.

4. Purchases

Memberships are sold by the Apple App Store and Google Play. They take the payment, and we never see your card details. We use RevenueCat to confirm whether a subscription is active. RevenueCat receives an app user identifier and the receipt information needed to verify the purchase, and returns your entitlement status to the app. We store which tier you are on and when it expires.

5. How we use it

• To run the app: your shelf, your valuations, your alerts, your posts.
• To calculate collection value and price history from reported observations.
• To send notifications you have asked for.
• To keep the community usable: reviewing reports, enforcing blocks, removing abuse.
• To confirm membership status and apply the right limits.
• To fix faults, prevent fraud and abuse, and secure our systems.
• To answer your support requests.
• To comply with the law.

We do not sell or share personal information for cross context behavioural advertising, and we do not use your collection or your posts to sell you third party products.

6. Legal bases (for users in the UK and EEA)

• Contract. Providing the account, collection, valuation and community features you asked for.
• Consent. Camera access, photo access and push notifications. You can withdraw consent at any time in your device settings.
• Legitimate interests. Security, fraud and abuse prevention, moderation, debugging, and understanding which features are used.
• Legal obligation. Where we must keep or disclose records by law.

7. Who we share it with

We share personal information only with the following, and only for the stated purpose.

• Our hosting and database providers, which store the app's data on our behalf in the United States.
• Expo, and through it Apple and Google, to deliver push notifications.
• RevenueCat, Apple and Google, to process and verify purchases.
• A text recognition provider, currently Microsoft Azure AI Vision, to read the text on a label you choose to scan.
• Law enforcement or regulators, where we are legally required to respond, or where it is necessary to protect someone's safety or our rights.
• A successor, if the Service is ever sold or merged, in which case we will tell you before your information moves and this policy continues to apply to it.

Two features load content directly from other people's servers, which means those servers see your device's IP address in the same way any website you visit would. Cocktail recipes are requested from TheCocktailDB, and news article images and links come from the publishers themselves. We do not send them your identity.

8. What other members can see

Your username, display name, profile photo, bio, location text and favourites are visible to other members, along with anything you post in discussions. Your collection is private. Prices you report are used without your name attached. Assume anything posted in a public thread can be read by anyone using the app.

9. How long we keep it

• Account, profile and collection data: until you delete them or close your account.
• Discussion posts: until you delete them or close your account, subject to the moderation note below.
• Reported prices: retained as part of the shared, non identifying price record, because removing historic observations would corrupt every valuation built on them.
• Server logs: normally up to 90 days.
• Support email: up to 24 months.
• Records of enforcement action, such as a ban, and records we must keep by law: retained for as long as necessary for that purpose.
• Backups: overwritten on their normal cycle, usually within 35 days.

10. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, obtain a portable copy, object to or restrict some processing, and to be free from discrimination for exercising any of these rights.

In the app you can already:

• edit or correct your profile at any time;
• export your collection to a spreadsheet on Pro and Collector;
• turn any notification category on or off;
• block members and report content;
• delete your account and its contents.

For anything else, write to support@bourbonproject.com. We will verify that the request comes from you, and answer within 30 days, or 45 days where the law allows an extension and we tell you why. You may use an authorised agent where your local law provides for one. If you are in the UK or EEA you may also complain to your data protection authority.

We do not sell or share personal information as those terms are defined by California law, and we have not done so in the past 12 months.

11. Deleting your account

Open Settings, scroll to Account, and choose Delete my account. This removes your profile, your collection entries and your uploaded images, and removes your posts and replies from public view. Prices you reported stay in the shared price record without any link to you, and content preserved for a legal or safety reason is retained as described above. Backups age out on their normal cycle. If you cannot reach Settings, email us from your account address and we will do it for you.

12. Security

Traffic between the app and our servers is encrypted in transit. Passwords are stored as salted hashes and never in readable form. Access to production data is limited to people who need it. No system is perfectly secure, so please use a unique password and tell us at once if you think your account has been reached by someone else.

13. International transfers

We operate from the United States, and our servers and service providers are located there. If you use the app from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection rules from your own country. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

14. Age of users

The Service is intended for people of legal drinking age, which is 21 in the United States. It is not directed at children and we do not knowingly collect information from anyone under legal drinking age. If we learn we have, we delete the account and its data. Parents or guardians who believe a minor has created an account should contact us.

15. Changes to this policy

If we change this policy we will update the date at the top of the page, and where the change is material we will tell you in the app before it takes effect.

16. Contact

Privacy questions and requests go to support@bourbonproject.com, or through the support page. Please put "Privacy" in the subject line so it reaches the right person quickly.