Privacy Policy

Sebastian Auer
Backumer Str. 447
45701 Herten, Germany
Email: kontakt@gustofolio.com

A data protection officer has not been appointed; the requirements for this are not met.

Gustofolio collects data in two ways: you enter it yourself, or it's generated as you use the app. Self-entered data includes your login details — email address and password, or your Google account —, your display name, a profile photo, and everything that makes up your collection: winery, name, vintage, grape variety, origin, storage location, quantity, purchase price, retailer, gift-giver, tasting notes, ratings, and photos of bottle labels.

Using the app generates further data: which bottles you save, store, open or remove, which recommendation you tapped or dismissed, which wine list you photographed and what you chose from it, your posts and comments in the community, a device token if you enable notifications, and temperature readings if you connect a sensor. In addition, every visit to the website generates the usual server logs with IP address, requested address, timestamp and browser identifier.

This data is used to provide you with the app: to manage your account, maintain your collection, automatically read labels and wine lists, suggest bottles and food pairings, deliver reminders, run the community, and prevent abuse. From your ratings and the actions listed above, we calculate a taste profile and derive your recommendations from it; to do this, we compare your profile with those of other accounts. We don't use this data for any other purpose — in particular, not for advertising and not for sale.

The table below lists these same processes individually, each with purpose, legal basis and retention period. Without an account, we only process server logs.

What you can turn off. Under More → Account → Privacy you can opt out of food pairing and learning from your actions, and change your visibility settings. The related feature will then no longer be available to you: without processing, there's no suggestion and no recommendation.

Objecting to food-pairing suggestions also affects Noir: afterward, it can no longer see your inventory and won't be able to mention bottles from your cellar or suggestions from the recommendation engine. It will still answer questions about wine, whisky, food, and products in the Kontor — that doesn't require data from your collection.

We don't make automated decisions within the meaning of Art. 22 GDPR. Recommendations are suggestions with no legal effect. The data comes from you; you're not obligated by law or contract to provide it, but the app won't work without it.

If you sign in with Google, we receive your Google account ID, email address, name, and possibly your profile picture. We only request the openid, email, and profile permissions — no access to contacts, calendar, files, Gmail, or location.

We use this data solely to sign you in and manage your profile. It's stored with Firebase Authentication and in our database under europe-west3. We only share it with the processors listed below — never for advertising, never with data brokers, never with the AI services. It's deleted along with your account (More → Account → Privacy). You can also revoke access from your Google account.

Transmission between your device and our servers is encrypted end-to-end with TLS, and storage at Google is additionally encrypted at rest. Access is restricted to your account by server-side rules, not just by the interface. We never receive a password when you sign in with Google.

What we explicitly don't use Google user data for: advertising or targeted ads, selling or sharing with data brokers, training AI models — ours or anyone else's — or assessing creditworthiness. Use is limited to the purposes stated above: providing and improving Gustofolio's features.

Retention and deletion. We keep this data as long as your account exists. If you delete your account under More → Account → Privacy, your Google account ID, email address, name, and profile picture will be deleted. If you revoke Gustofolio's access in your Google account, sign-in via Google will no longer be possible; your Gustofolio account remains until you delete it.

Legal basis: Art. 6(1)(b) GDPR.

For friends, nothing is shared by default; you can unlock five categories yourself: favorite bottles, ratings, tasting comments, recommendations, wish list. Storage locations, stock, purchase prices, and gift givers are never shared with friends. For "tasting comments," your note is shared word for word.

In the Community, the following are visible by default: your ratings to all signed-in users, and your taste affinity with other accounts. Gustofolio also automatically creates a post in your name on certain occasions. You can turn both off under More → Account → Privacy. Your display name is visible to every signed-in person as soon as you appear in the Community.

Starting October 1, 2026, anyone signed in who can see a post will also see who raised a glass to it — this also applies to cheers you've given before. When you raise a glass, comment, reply to a comment, or follow someone, this shows up with your name in that person's activity. Only your ID is stored there, never your name or text; the app displays the name when shown, and these entries disappear along with your account.

If you vote in a poll, we save your vote (chosen answer and time) under your account. Others only see the totals, not who voted how. Whoever created the poll gets a notification about new votes at most once an hour. You can change or withdraw your vote at any time; it's part of your data export and gets deleted with your account.

Under "Drinks Like You", we suggest people in the community whose taste resembles yours. To do this, we show other signed-in people your display name, how similar your drinking is (as a percentage), and how many drinks you've both rated — never your individual ratings or your collection. This only happens as long as neither of you has opted out of taste matching (More → Account → Privacy), and never for blocked people. The community search only searches bottles, wineries and distilleries, grape varieties, regions, dishes, and list titles of shared posts — you can't search for people.

Your profile shows signed-in people your name, the number of your posts, followers and accounts you follow, your shared posts, and — if you show your ratings — how many bottles per drink you've rated. It only shows a sentence about your taste if you write it yourself.

In a shared cellar, every member sees everything stored there — including storage locations, purchase prices, and notes.

A host link that you create yourself can be viewed without an account. It only shows what you've put together for the evening, and expires after 1 to 30 days (default 14 days); the addresses of the displayed label photos don't expire along with it. Guests can leave a name, RSVP, headcount, and a message; this information is deleted along with the listing.

You can rate cocktail recipes in the encyclopedia without an account. We store the stars (1 to 5), the timestamp, and, if you fill them in, your comment and first name. Stars, comment, and first name are then visible to everyone who visits the recipe page; we use the stars to calculate an average, which search engines can also display. So please don't write anything in the comment that you wouldn't want made public.

So that each person only counts once per recipe, your browser stores a random device ID and your star rating in local storage when you submit. We only keep a checksum calculated from that, together with the stars — not the ID itself. To guard against mass submissions, we count ratings per internet connection and hour; for this we store a checksum of your IP address, which is automatically deleted after about a day at the latest. We don't accept links in comments.

If you'd like your comment deleted, write to kontakt@gustofolio.com and give the recipe and date. Legal basis: your decision to publish the rating (Art. 6(1)(a) GDPR); for protection against misuse, our legitimate interest (Art. 6(1)(f) GDPR). Data is stored in our database in europe-west3.

All recipients are processors acting on our instructions, not for their own purposes — with one exception: Google Analytics also processes measurement data for its own purposes, and it only runs with your consent (see "Audience Measurement"). Aside from what's listed here, we do not embed any other third-party components — in particular no crash-reporting tool (such as Firebase Crashlytics or Sentry), no ad network with its own code on this page (such as Google AdMob), and no payment service (such as Stripe or PayPal). Fonts are hosted on our own server; no third-party font library is loaded. One exception is the affiliate links in the Kontor section — see the "Affiliate Links in the Kontor" section below.

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Secret Manager, and the daily backup (all europe-west3, Frankfurt), Firebase App Hosting as web server (europe-west4), Firebase Cloud Messaging, App Check with reCAPTCHA Enterprise, and — only with your consent — Google Analytics 4. This is based on Google's Cloud Data Processing Addendum. Google's privacy policy: policies.google.com/privacy .
• Anthropic, PBC, San Francisco, USA — recognition of labels and wine lists, the corresponding food pairing suggestions, sorting feedback from the beta button, and the responses of Noir, the AI sommelier. When you ask Noir a question, your question is sent verbatim; if you ask about your own collection, the name, producer, vintage, type, origin, and grape varieties of the bottles involved are also sent. Not transmitted: purchase prices, purchase dates, storage locations, your notes, your ratings, your name, and your email address. This is based on Anthropic's Data Processing Addendum; under its terms, the transmitted content is not used for training. Anthropic's privacy policy: anthropic.com/legal/privacy .
• Your own Home Assistant, if you connect one — only the access token you generate is sent there.

Processing by Google takes place within the EU — with one exception: for Google Analytics, a transfer to the USA cannot be ruled out. This only happens if you've consented to audience measurement, and it's safeguarded through the EU Standard Contractual Clauses as well as Google's certification under the EU-US Data Privacy Framework. AI requests are sent to Anthropic in the USA. This is safeguarded through the EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914, which are incorporated into Anthropic's Data Processing Addendum (Art. 46(2)(c) GDPR). For photos, your explicit consent is additionally required (Art. 49(1)(a) GDPR).

Gustofolio requests exactly one permission, and only when you use the corresponding feature:

• Camera — to photograph a bottle label, wine list, or barcode. The photo is sent for recognition (see table above) and saved with the bottle. Without a camera, you can enter all details by hand.
• Notifications — only if you allow them on your device. Then you'll get the reminders you turn on, plus community notifications (cheers, comments and replies on your posts, new votes in your polls — without revealing who voted —, questions about bottles you own, feedback with name, bottle, and star rating when someone rates a bottle you recommended to them, new messages — without their text). Community notifications are on by default until you turn them off in Settings under "Privacy" — except for the taste-twin alert: you'll only learn that a taste twin rated a bottle from your collection if you turn this on and you've both enabled taste match sharing. You can revoke the permission itself at any time in your device or browser settings.

Not requested and not processed: location and GPS, contacts, microphone, calendar, phone book, your device's photo gallery (you select individual images yourself; we don't see the rest), and advertising identifiers such as IDFA or AAID. The Android app, in fact, only requests permission to access the internet at all.

We do not generate or store a device identifier for recognition purposes. The only device-related identifier is the notification token, which you delete again by turning notifications off.

The connection between your device and our servers is fully TLS-encrypted, and unencrypted requests are rejected; the database and file storage at Google are additionally encrypted at rest.

We don't store your password ourselves — only as a hash value with Firebase Authentication, from which the password cannot be reverse-calculated. The access token for your Home Assistant isn't kept in the database, but in Google Secret Manager.

Who can read and write which data is defined server-side in access rules and checked with every request — not just in the interface. An abuse safeguard (App Check) rejects requests that don't come from a genuine instance of the app. Security-relevant events are logged so unauthorized access can be detected and investigated.

No cookie is set without your consent — neither by us nor by third parties. Only a single cookie could ever apply, and only if you agree to reach measurement; it would come from Google Analytics and is described in the next section. Independently of that, the app stores what's needed for it to run on your device (§ 25 (2) No. 2 TDDDG): your login session, an offline copy of your cellar data along with a queue for changes made without network access, drafts in progress, opened invite links, the notification token, and small UI states. None of this leaves your device and it disappears when you clear the website data or uninstall the app. App Check also accesses device storage within the logged-in area.

To see which areas are being used, we use Google Analytics 4 (Google Ireland Limited, measurement IDG-HVZ7YKRLBW). The script is only loaded after your consent: until then, no request is sent to Google, no cookie is created, and nothing is read from your device. If you decline, Gustofolio keeps working exactly the same — no feature requires consent.

The following will be processed: pages viewed, timestamps, referring address, a random browser ID, technical device info, and your truncated IP address. Content from your collection is not included — no bottles, no notes, no ratings, no photos. Advertising features are disabled (no Google signals, no personalized ads, no sharing with ad networks). Google deletes event data after 14 months.

Cookies: Once you consent, Google Analytics stores two cookies on your device — _ga and _ga_HVZ7YKRLBW. Both contain only a random identifier that recognizes your browser again, no name and no address. We've limited their lifespan to 13 months (instead of the default two years). Your own decision about measurement, however, isn't stored in a cookie but in your browser's local storage, and it never leaves your device.

A transfer to the USA cannot be ruled out in this process; it's safeguarded by the EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR — your consent. You can change or withdraw it at any time with a single tap: in the app under More → Account → Privacy, or on the public pages via "Cookie settings" in the footer. Withdrawal takes effect immediately — the script stops loading, and no further data is collected going forward. The lawfulness of processing up to that point remains unaffected.

The same applies to the installed app: on first launch, it asks for your consent with the same notice and only loads Google Analytics after you say yes. Events from the app are tagged as "App" so we can analyze website and app data separately.

In the Kontor section, Gustofolio shows offers for wine, spirits and accessories, linking to external providers through affiliate links: to Amazon, and — via the Awin affiliate network — to mySpirits. These sections are marked as advertising.

Two of the sections are tailored to you, the third isn't. Which bottles get recommended is calculated from your taste profile; which accessories, from your collection. The browsable range below, though, is the same for everyone — there, only your search and the chosen category matter, and for spirits like gin, rum, or liqueur, Gustofolio makes no statement about your taste at all. The calculation happens on our server, at the moment you open the Cellar Shop. Nothing goes to Amazon or Awin in the process — they learn neither your profile nor your collection, and they don't even learn that something was shown to you. Nothing is passed on; there's no profiling by third parties.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping our offerings useful rather than arbitrary and in financing our operations. You can object to this (Art. 21 GDPR): if you turn off learning from your actions under More → Account → Privacy, your actions will no longer be included (your ratings will still be). For a broader objection, an informal message to kontakt@gustofolio.com is enough.

Tapping such a link opens the provider's page in your own browser — you leave Gustofolio. The link carries an identifier marking the visit as coming from Gustofolio: an associate tag for Amazon, or a publisher and product ID for Awin. It doesn't contain any information about you personally, and Gustofolio doesn't make any server-side calls to Amazon or Awin.

On the provider's end, Amazon or Awin set their own cookie and attribute any resulting purchase to this link. This processing is handled by Amazon or Awin under their own privacy policies; Gustofolio has no influence over it and only receives aggregated billing data back (number and value of compensated purchases) — no personal data about the buyer.

Amazon's privacy policy: amazon.de/…/privacy-policy. Awin's privacy policy: awin.com/gb/privacy.

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17)
• Restriction (Art. 18), data portability (Art. 20)
• Objection to processing based on Art. 6(1)(f) (Art. 21)
• Withdrawal of given consent with effect for the future (Art. 7(3)), for photo recognition under More → Account → Privacy

You can exercise your rights to access, data portability and deletion yourself: under More → Account → Privacy you'll find data export and account deletion. For anything else, a short message to kontakt@gustofolio.com is enough; we'll reply within one month (Art. 12(3) GDPR).

Two things remain after deletion: the security log entries until their 400-day retention period expires (user ID only, no names), and — in other people's cellars — your inventory movements, tastings, and wishlist entries tagged with your ID, since they're part of the content of those other cellars. If you own a cellar with additional members, we can only delete your account once you've transferred it or removed the other members (Art. 17(3) GDPR).

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestraße 2–4, 40213 Düsseldorf
poststelle@ldi.nrw.de · https://www.ldi.nrw.de

You can also contact the authority in your place of residence or work.

If anything changes about the consent we ask for during registration, we'll increase the version number above and ask you again next time you open the app. The current version is always available at this address.