Last updated: 10 November, 2026
Wine Hero keeps your taste profile on a server we operate, so it follows you between devices and so friends can see what you like. You need an account for that, created with Sign in with Apple or Google.
The wines you rate stay on your device, and in your own iCloud. The server holds the profile your ratings produce — not the ratings, and not the bottles.
Photographs of wine lists never leave your phone. They are read on the device and discarded. That has always been true and it has not changed.
A group you share is the one place your taste reaches people you did not each add individually. Joining one is a deliberate act, it holds only Wine Hero account holders, and the people in it see each other's taste profile. The app calls a group a bunch, and marks a shared one Shared — so where this policy says "shared group", your phone says a bunch labelled Shared.
Nothing about you is sold, and nothing is shared with anyone outside the people you choose to connect with in the app. We do not use analytics, advertising or tracking of any kind.
An account is created when you sign in with Apple or Google. We ask for one thing: an email address. We do not ask either provider for your name, your contacts, or anything else.
The name Wine Hero shows is the one you type when you first open the app. It comes from you, not from Apple or Google.
If you sign in with Apple and choose to hide your email, Apple gives us a relay address instead of your real one — and that is all we ever see.
This is a complete list. If something you put into the app is not on it, it is on your device and in your own iCloud, and we do not have it.
All of those live on your device and in your own iCloud account, which Apple gives us no access to. Two of them reach our server indirectly and in a form that is not about you — see "The camera" and "Looking up a wine" — and nothing reaches it as a record of what you drank.
The wine catalogue on our server is shared between everyone, holds only licensed wine details, and has no link to any account, so it cannot say who added or drank what.
This is the part most worth reading carefully, because "we store it" and "only you can see it" are different things.
Only you can see your wines and ratings, your scans, your guests and the groups you keep to yourself — because they never leave your device and your iCloud in the first place.
A group you share is the exception, and it is the only one: what you drink with that group is seen by its members. The section below says exactly what.
They can see your handle, your display name and your taste profile — both the numbers you started with and the ones your ratings have moved, with the six evidence counts behind them — whether or not you have published your profile. Accepting somebody is the permission; the publish switch is a separate one and does not govern this.
They cannot see the wines you have rated, your scans, your guests or the groups you keep to yourself. Those stay on your device. A friend who is also in a shared group with you sees that group's own history, which is a separate thing you joined — not your ratings. An earlier version of this policy said a mutual friend could read your ratings, your predictions and your palate-game answers; that was wrong, and nothing sends them anywhere.
Mutual means both of you have connected to each other. We do not notify anybody about anything: a request that is declined, withdrawn or ended simply stops being there, and neither side is told.
Everyone signed in to Wine Hero can see your handle, your display name and your taste profile — if you publish it. Publishing is a deliberate choice, off unless you turn it on, and the screen that offers it names those three things. Nothing else — not your wines, your ratings, your scans or the people at your table.
Publishing also means your handle and display name can be found by somebody typing three or more characters of either into the app's search. The search returns those two things and nothing else: never your taste profile, never your account's internal id.
Everybody in a shared group can see every other member's handle, display name and taste profile — the same three things a friend sees, and whether or not either of you has published, and whether or not you are friends. Joining the group is the permission.
The group's page shows its history to every member: each evening somebody recorded, the wines, and each member's score for each wine, under the name that member went by that night. Joining the group is the permission for that too.
Two things follow that are worth stating plainly rather than leaving you to work out:
Your wine lookups are not linked to any account at all. There is no column in those records that says who asked. They are readable only by the server itself, never by any signed-in user — see "Looking up a wine".
The moderation word lists your handle and display name are checked against are readable by nobody at all, including you. A list you can read is a list you can work around.
Reports are readable by nobody through the app, including whoever filed one — see "Reporting someone".
In two places, and which one holds what is the whole of this policy.
Your device, and your own iCloud account. Your wines and ratings, your scans, your guests, the groups you keep to yourself, and an evening recorded to a shared group that has not reached us yet live here. Everything on this list but the last lives here and only here; the last is waiting to be sent, and is removed from the device once the group has it. iOS mirrors them to your private iCloud database so the app works offline and so they follow you to your other devices. Apple gives us no access to it — a developer cannot read a user's private iCloud data, which is why that half of this policy is short.
A server we operate, hosted on Supabase in Sydney, Australia. Your profile, your friendships and the handful of other things listed above live here, so they survive a new phone and so another person can see what you have chosen to show them.
An earlier version of this policy had that the wrong way round — it called the device copy "a convenience, not a second place your data lives" and the server "the authoritative one". For your ratings it is the reverse: the device is the only place they are.
When you photograph a wine list, the photo is read on your device using Apple's Vision text recognition, which is built into iOS and runs offline. The app extracts the text and matches it against its library of wine styles.
The photo is never uploaded and never saved. It exists in the app's memory for as long as it takes to read the text, and is then discarded.
There is nowhere for it to go even if that changed. Our database has no binary column of any kind, and we have no file storage configured at all — no buckets, no stored files, nothing. Images are not something we have switched off; they are something we have never built a place for.
If you pick a photo from your library instead of taking one, the same applies.
The camera has a second purpose now: reading a friend's QR code. That is also done entirely on the device, by iOS, and the only thing that leaves the camera is the code itself. No image is uploaded or saved, exactly as above.
When the app needs details about a wine it doesn't recognise, it asks a wine database provider (grapeminds) through our server. None of these records have any link to you or your account — there is no column in them that says who asked, so we cannot tell afterwards whose lookups they were.
Two things are kept, with different lifetimes, and the second is the one worth reading.
Erased after 90 days, automatically, whether or not anyone asks: the search text of each individual lookup — the words we derived from one line of one wine list on one occasion.
Kept indefinitely, as one row per WINE rather than one per lookup:
So the 90-day promise covers the per-lookup text and not this row. We would rather widen the sentence than let you read "90 days" and conclude that nothing survives. What survives is a list of wines a venue prints, not a list of people: the text is a restaurant's own published words, the row says nothing about who photographed it, and the identical row would exist if a hundred different people had scanned the same list.
These records are how we tell whether the matching is any good and what the provider is costing us. They are readable only by the server itself.
If you add a guest — a friend whose taste you capture by handing them your phone for the quiz — the name you type and their resulting taste profile are stored on your device and in your own iCloud, and never sent to us. No contact details and no copy on our server for anybody to read.
You can tell the app that a guest is one of your Wine Hero friends. If that person later gets an account, you can link the two, so they come to your table with the palate their own app keeps instead of the quiz you took on their behalf. The link is a note on your device — the friend's account identifier, stored beside the guest, in your device's own data and your own iCloud. It is never sent to us, and the friend is never told. You make it yourself and you can undo it; the app will not link two people because their names happen to match. While the link is in use the wines you recorded for them stay on your phone, shown under their name, and are still never sent to us — nothing about the link puts a guest's name or a guest's score into a shared group. If you stop being friends, the guest simply comes back.
Please only add someone if they're happy for you to. They are not a Wine Hero user, they have not agreed to anything, and the record exists because you made it.
A shared group is people, so most of this section is about somebody else's data as much as your own. In the app a group is a "bunch"; a bunch you share with other account holders carries the label Shared, and one you keep to yourself carries no label and never leaves your phone.
This is not the same as reporting somebody to us, which is in "Reporting someone" below. This one goes to whoever created the group, because they are the person who can act: they can remove the member.
Showing somebody a code is how you become friends in person. While the code is on your screen we store one short-lived code tied to your account, and nothing else.
Blocking is immediate and silent. The person is not told, and your block list is readable only by you — never by them. The effect runs both ways: after a block neither of you can find the other.
There is one exception, and it is deliberate: a shared group you are both in. Blocking somebody does not take either of you out of it. You remain members, you can each still see the other's handle, display name and taste profile there, and the group's history still holds both your scores.
The alternative was to remove one of you, and that would hand the person who blocks the power to eject somebody from a group neither of them owns. What you can do instead is report them to whoever created the group — see "Shared groups" — and you can leave it. An earlier version of this policy said a block meant neither of you could find the other anywhere, with no exception; that was written before shared groups existed and it is corrected here.
A block also removes any friendship between you, in both directions. Unblocking does not bring it back; becoming friends again is a fresh decision by both of you.
This is the report that comes to us. Reporting a member of a shared group is a different thing, goes to that group's creator and not to us, and is described above.
A report records who you reported, why, anything you typed, and when.
Your handle and display name are checked on our server, against word lists of abusive terms, before they are stored — so a name nobody else chose cannot be shown to them. The lists are readable by nobody, including you. If a name is refused, the app says so and does not tell you which part matched.
Nothing else you type is screened, because nothing else you type reaches us.
Most of what you put into Wine Hero is on your device, so deleting it there is the whole of it:
Your account on our server: Settings → Delete account. It is immediate and cannot be undone. If you no longer have the app, you can ask for the same thing by email — how to delete your account sets out both routes, including the one that needs no app installed. It removes your profile — name, handle, taste profile and evidence counts — your friendships in both directions, any live invite code, your blocks, your terms agreement, your membership of every shared group and every score you ever recorded in one, and the reports other people have filed about you. Each of those is attached to your account and goes when it goes.
Leaving a shared group and deleting your account are different, and the difference is the point.
If you signed in with Apple, deleting your account also tells Apple to revoke that sign-in. We send that request as part of the deletion. Apple's service accepts it without reporting back what it did, so we can tell you we asked — we cannot promise you what happened at their end.
Two things survive, and neither is about you:
And one thing that is about somebody else: reports you filed about other people are not withdrawn when you delete your account, because they are a record of something you said about them rather than content of your own.
Deleting the app without deleting your account leaves your account and its data on the server.
Wine Hero includes two outside components: supabase-swift, which talks to our server, and Google Sign-In, which handles signing in with Google. Neither is used for analytics or advertising.
Our server stores data with Supabase (Sydney, Australia) and looks wine details up from grapeminds.
Two more are involved only when a report is sent to us, and it is worth naming them because a report is about a named person:
Nothing else is emailed about anybody. The only other message our server sends is a weekly summary of wine lookups, and that carries no handle, no name and no account — the records it is built from have no column identifying anyone, which is the same fact as under "Looking up a wine".
Wine Hero is an app about wine and is not intended for children. It is rated for 18+ on the App Store.
Using Wine Hero also means agreeing to its terms of use, which cover what the app is for, what is not allowed in a name or a profile, and what happens when somebody is reported. You are asked to agree before you claim a handle — the first moment anything of yours can be seen by another person. We record which version you agreed to, and when, so a new version is a new question rather than a silent change.
If the app changes in a way that affects any of this, this policy will be updated before that version is released, and the date at the top will change.
Questions about this policy or about your data — including asking for a copy of it, or asking us to correct or delete it:
Mark Plavina privacy@winehero.app