Your wine collection, tasting notes, and photographs are stored only on your device. There is no account, no server of ours and no cloud sync, and we never upload them to us — we cannot see, access, or recover them. The app can keep its own backup in your iCloud Drive or Google Drive, described below; that copy is yours, not ours. The only things that ever leave your device are anonymous crash diagnostics, anonymous usage analytics and, in the free version, the advertising data described below; none of it includes anything you have typed or photographed. Scanning a label to fill in a bottle is read on your device: the camera frame is never saved, and no image or text from it leaves your device.
When you export a backup or a spreadsheet, the file is handed to the app or destination you choose through your device's share sheet. Where that file goes — and who can read it — is entirely under your control. A spreadsheet you import is read on your device; nothing from it is uploaded.
Cellar Book backs up your cellar automatically to your own cloud storage, so a new or reset device can bring it back. On iPhone and iPad the backup goes to the app's own folder in your iCloud Drive; it is not shown in the Files app. On Android it goes to a hidden app folder in your Google Drive, after you choose Back up and allow it on Google's own screen (or, if you have already allowed it on another device, as soon as you sign in on this one with the same Google account); the app asks only for access to that hidden folder, which it alone can read, and never to your other files or to your Google account details. Each backup is a single file holding your whole cellar — your wines, bottles, tastings, notes, scores and prices — with its label photos. Each backup also carries a small summary — the date, the app version, your device's name, a random code that tells your devices apart, and how many wines, tastings and photos it holds — so the app can list your backups and show what is in them. The app keeps the three newest backups from each device and removes older ones. The backup travels from your device straight to Apple or Google; we never receive a copy, and it is stored under their privacy policies like your other files there. Restoring a backup replaces the cellar on that device with the one in the backup. You can turn automatic backup off in Settings, which stops new backups. To delete the backups themselves, use iOS Settings → your name → iCloud → Manage Storage → Cellar Book, or Google Drive → Settings → Manage apps → Cellar Book → Delete hidden app data. Deleting the app does not delete these backups. On Android, the system's own device backup holds only Cellar Book's database and its settings; your label photos travel only inside the cloud backup above.
Cellar Book uses Firebase Crashlytics to collect anonymous crash diagnostics (device model, OS version, and the technical state of the app at the moment of a crash). No personal information, wine data, notes, or photos are ever transmitted. Crash reports exist solely so we can fix defects.
Cellar Book uses Google Analytics for Firebase to understand which features are used, so we can improve the app. It records anonymous, pseudonymous signals only — which screens you open, how often core features are used, the app version, your device model, and your coarse region (country level). It never records anything you type or photograph: not a wine, a tasting note, a score, a price, or a label image. Analytics is never used for advertising: advertising-personalisation signals are switched off. Crash reporting, above, is separate and covered under our legitimate interest in keeping the app working.
From version 1.1.34, the free version shows a single banner advertisement. It appears above the tab bar on the cellar, Tonight and the Ledger, and on the wine and cellar pages you open from them, and never as a full-screen ad. Versions 1.1.25 to 1.1.33 show no advertisements and contain no advertising software. Versions 1.0.24 and earlier showed a banner served by Google AdMob, which may collect device identifiers to serve ads, after asking for consent where the law requires it. Ads are served through Appodeal, an advertising mediation platform, and the ad networks it works with (including AppLovin, BidMachine, Digital Turbine, InMobi, ironSource, Liftoff, Mintegral, myTarget and Unity Ads). To choose, show and measure ads, they may collect your device's advertising identifier, your coarse location (derived from your IP address), your device type and operating system, and which ads you see and tap. None of your wines, tasting notes, scores or photographs is ever shared with them. Before any ad is requested, you are asked for your consent choices where the law requires it (for example in the EEA, the UK and Switzerland). On iPhone and iPad, Apple's tracking prompt then asks whether ads may use your activity across other companies' apps and websites. If you decline either, ads are still shown, but they are not personalised. You can change your consent choices at any time from Settings → Manage Ad Consent, and your tracking choice in your device's Settings. Appodeal's own policy is at https://appodeal.com/privacy-policy. Premium — the one-time unlock or the monthly subscription — removes advertising entirely: the ad software is not started at all.
Cellar Book Premium — a one-time unlock or a monthly subscription — is processed by Google Play or the Apple App Store. We never see your payment details. A subscription is managed or cancelled from your Google Play or App Store account.
Questions about this policy are welcome at admin@eritech.studio.