Privacy Policy

Who we are

Whiff is an app that teaches you to taste wine. It’s made by Mees van Lier in the Netherlands. There’s no company behind it yet, so as its maker I’m personally responsible for what happens to your data.

Questions about your privacy? Email hello@whiffapp.com and you’ll hear back within a month.

What the app keeps

Everything the app records about you is listed below, along with why we keep it and the legal basis for doing so.

Your account

The first time you taste, the app creates an anonymous account: a random number with no name, email address or phone number. Your tastings hang off that number, and so does your subscription if you get Pro. Legal basis: we need it to provide the app (performance of a contract).

Your tastings and notes

What you enter for each bottle: your answers, how sure you were, your scores and how they change over time, plus anything you write about a wine. It’s stored on your phone and, under your account number, in our database. Without that history there’s nothing to learn from or look back on. Legal basis: performance of a contract.

What you scan

When you scan a bottle’s barcode, we keep the code, whether the app knew the bottle and how it found it. That shows us which bottles are still missing. Legal basis: performance of a contract.

Your taste profile

On your phone, the app works out what you like from your answers. The law calls that profiling, hence this section. The profile is only used to give you better tastings and explanations. No decisions with legal or similarly significant effects are made about you.

Pro

If you get Whiff Pro, Apple handles the payment. Apple sends us a purchase number, which plan it is and when it runs out. We never see your name or payment details. Legal basis: performance of a contract.

The free trial month is once per device. To check that, the app asks Apple’s DeviceCheck for a code when you buy. The code only says whether this device has had the trial, not who you are. Legal basis: legitimate interest, namely stopping the trial from being misused.

Reporting a bottle

If something about a bottle is wrong and you report it, we keep your report and anything you wrote with it. Legal basis: legitimate interest, namely a catalog that’s correct.

Group numbers

The app may show how other tasters found the same wine, such as how many also picked up citrus. To do that we add answers up into numbers where nobody can be singled out. Legal basis: legitimate interest. Whether your answers ever count towards numbers we share with winemakers, importers, shops or researchers is something we’ll ask you about separately first.

Where an AI is involved

Two parts of the app use an AI model. Both only run when you ask, and neither sends your name or email address.

Malo

Malo is the guide inside the app. When you ask Malo something, your question goes to Google Cloud in the EU, where Anthropic’s Claude model and a Google search model run. To give you a good answer, Malo also gets what it needs to know about your tastings, such as your sessions and notes. Under Google Cloud’s terms, this data isn’t used to train AI models.

The text of a conversation is deleted after 30 days. What stays is a two-sentence summary, so Malo remembers what you talked about before. That summary goes when your account does. Legal basis: performance of a contract. Malo can get things wrong, which is why every answer says it comes from an AI.

Reading a label

If the app doesn’t know a bottle, you can take a photo of the label. The photo goes to Anthropic in the United States, where an AI model reads it. That only happens after the screen before it has told you the photo goes to Anthropic and you’ve tapped to continue. Legal basis: your consent.

Before sending, the app strips anything the photo doesn’t need, such as where you took it. We keep the full photo with your request for 30 days so we can add the bottle to the catalog. After that it’s deleted automatically. Transfers to the United States are covered by the European Commission’s standard contractual clauses, which are part of Anthropic’s terms. Under those terms, Anthropic doesn’t use these photos to train its models.

Our collection of labels

From the photo, the app crops out just the label. Once you confirm it’s the right bottle, that crop joins our collection of labels, separate from your account. All it carries is which bottle and which vintage it is. The collection is how the app will learn to recognize labels from a picture. Legal basis: legitimate interest, namely recognition that keeps getting better.

Because nothing in it points to you after that, we can’t later find a crop as yours. We never show a photo or a crop to other users.

What keeps the app running

Crash reports

If the app crashes or something breaks, an error report goes to Sentry, stored in the EU. It says what went wrong, on which screen, on which device and iOS version, and how fast the app was. No name, no email address, no screenshot and nothing you typed. At most your anonymous account number, so we can tell when two reports come from the same account. Legal basis: legitimate interest, namely an app that works.

Protection against abuse

To protect the server, we count incoming requests per account and per internet address. We don’t store the address itself, only a scrambled form that can’t be turned back, and those counters disappear after a day. We also count how much you use the AI, so nobody can run up the bill. Legal basis: legitimate interest.

The admin log

Anything done in running the app, by me or by a scheduled job, goes into a log: who, what, when and why. Approving a bottle or clearing out an account, for example. There’s no name, no email address and nothing you wrote in it, at most an account number. It means I can always show what happened to your account. We keep this log for 24 months. Legal basis: legitimate interest.

What we don’t do

There are no ads in the app. We don’t sell data and we don’t track you across other apps or websites.

The app doesn’t record how often or how much you drink. It counts tastings and how well you taste, not glasses.

A bottle may list shops that sell it. Tap one and the shop’s website opens. The link only says you came from Whiff, nothing about you.

Who helps us

These services do part of the work for Whiff. They act on our instructions and don’t use your data for themselves.

• Supabase: our database and file storage, in Frankfurt (EU).
• Google Cloud: Malo and searching what Malo knows, in the EU.
• Anthropic: reading a label photo, in the United States.
• Sentry: crash reports, stored in Frankfurt (EU).
• GitHub: a backup of the database, in the United States. It’s encrypted with a key only I hold, so GitHub can’t open it.

Apple handles payment for Pro and the DeviceCheck code. It does so under its own privacy policy, as an independent party.

How long we keep things

For as long as your account exists. If you don’t use the app for 24 months, we delete your account. An account that never had a tasting in it may go sooner; you lose nothing by that.

When you delete your account, everything that belongs to it is erased straight away: your tastings, notes, scans and profile. A label photo you had read is gone within a day. Your Apple subscription keeps running until you cancel it with Apple.

A few things stay, but no longer point to you:

• the record of a purchase with Apple, so you can restore it later;
• a confirmed label crop, in the collection, without an account;
• a report about a bottle, without a sender;
• the count of AI use, without an account;
• proof that you once gave consent. We have to be able to show that, so we keep it for five years, only as a scrambled code.

Crash reports at Sentry and server logs are gone within 90 days. Every week we make an encrypted backup of the database, which is deleted after 90 days. So a deleted account can still sit in one of those backups for a while. We only open one after a disaster.

Your rights

You can see your data, have it corrected or erased, and take it with you to another service. You can ask us to restrict how it’s used and object to anything based on legitimate interest. You can withdraw consent at any time, just as easily as you gave it.

Most of this works inside the app, under Profile and then Settings: that’s where you download everything about you and delete your account. For anything else, email hello@whiffapp.com.

If you’re unhappy with how I handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Age

Whiff is about wine and is for adults: you need to be 18 or older. On the App Store it’s rated 18+.

When this policy changes

If something important changes, you’ll see it in the app before it takes effect. The version and the date of the last update are always at the top.

This website

whiffapp.com has no cookies and no trackers. It’s hosted by Cloudflare, which sees your internet address so it can send you the page.