Privacy

Olivier Bouchard runs La Cave and is the person responsible for the personal information in it, as Québec’s Law 25 requires. Anything about your own data — a question, a copy of it, a correction, or a request to delete it — reaches a real person at privacy@ourcave.wine.

• Your account. An email address, and a password that is stored only as a hash — nobody, including Olivier Bouchard, can read it back.
• Your name in the app. The display name and accent colour you chose.
• Your cellar. The wines, bottles, prices, locations and dates you enter, and the name you gave the cellar.
• Your ratings and tasting notes. Yours are yours; your partner sees them, because that is the point of a shared cellar.
• Label photos, if you take them. They are stored in a private bucket that only your cellar can read — unless you share that bottle, which copies the one photo somewhere public, or share what you open with cellar friends, who can then see that bottle’s label. See below.
• A record of each AI request — which feature, when, and roughly what it cost — so the running total on the Settings screen is honest. It holds no wine data and no text.

There is no tracking of any kind: no analytics, no advertising identifiers, no third-party cookies. The only cookie La Cave sets is the one that keeps you signed in.

In a Supabase Postgres database in Montréal, Canada (ca-central-1), so your cellar stays in Canada. The app itself runs on Cloudflare’s network, which serves the pages and screens sign-in attempts for bots; Cloudflare sees the requests, not the contents of your cellar.

• Anthropic, and only when you ask for something. Scanning a label sends that photo — both, if you photograph the back. Filling in a wine’s details sends the name, producer, vintage and region you typed. Asking what to open for dinner sends what you wrote about the meal and a list of the bottles you have — with your rating numbers, so the advice can prefer what you liked, and without your tasting notes. Under Anthropic’s commercial API terms this is not used to train their models. If you never use those three features, nothing is ever sent.
• A web search, and only if you tap Look it up online on a wine the model does not recognise. The wine’s name and producer go to a search that Anthropic runs on your behalf; the pages it reads are not stored, and the app keeps only the answer and the names of the sites it came from. This is off for every cellar until somebody switches it on, and nothing is ever looked up without that tap.
• Supabase and Cloudflare as the hosts described above. Cloudflare also delivers the emails this app sends — an invitation link, and the link to reset a forgotten password — so your address passes through it on the way to you.

That is the whole list of companies. Nobody else, and nothing is ever sold. The only other ways anything here reaches anyone are if you choose to share a bottle, or to share what you open with cellar friends — the next two sections.

The journal can turn one opened bottle into a card at a web address you send to somebody. It is off unless you do it, it is one bottle at a time, and the app lists exactly what will be visible before it makes the link.

• What goes on the card: the wine’s name, producer, vintage and where it is from; the first names and ratings of whoever rated it; the tasting notes only if you tick the box; and the label photo, copied to an address anyone with the link can open. Nothing else — not your email, not the rest of your cellar, not what a bottle cost.
• Who can read it: anyone holding the link. It is a long random address rather than a guessable one and it is not put in front of search engines, but a link is a link — treat sending one like showing someone a photograph.
• It is a copy, taken when you shared it. Editing the wine or changing your rating afterwards does not change a card already sent. That is deliberate: the honest thing to say about something already in somebody’s messages is that you cannot reach into it.
• Stopping is immediate. Journal → the bottle → Stop sharing. The link stops working and the copied photo is deleted.

Two cellars become friends when one types the other’s friend code and the other says yes. There is no directory and no search: nobody can find your cellar without a code you gave them. A request shows them your cellar’s name and your first names; until you say yes, they learn nothing about you but the name of the cellar whose code they typed.

• Being friends shares nothing on its own. Settings → Cellar friends → Share the bottles we open is off for every cellar. Only once one of you turns it on does a bottle you open from then appear for your friends.
• What they see: your cellar’s name, the wine’s name, producer, vintage and where it is from, the day you opened it, the first names and ratings of whoever rated it, and its label photo. Never your tasting notes, what it cost, or anything else in your cellar.
• Santé. A friend can say Santé to a bottle you shared. You see their first name; nobody else does.
• Stopping is immediate. Turning sharing off hides everything you shared, and a bottle opened while it is off is never shown, even if you turn it back on. Unfriending hides each cellar from the other at once. Putting a bottle back in the cellar takes it out of the feed.

Until you delete it. There is no automatic expiry, because a cellar is a record you keep — a bottle you drank in 2019 is the point, not clutter.

When you delete it, it goes from the live database immediately. Backups are kept for a short rolling window and age out on their own, so a deletion disappears from those as they roll over.

Settings → Leaving, in the app. No email, no waiting, no asking anyone.

• If your partner is still in the cellar, leaving deletes your account, your ratings and your tasting notes, and takes your name off the wines you added. The cellar and its wines stay with them — they are as much theirs as yours.
• If nobody else is in it, the whole cellar goes: every wine, bottle, rating, note and label photo, along with your account.

Any bottle you had shared stops being shared, and its copied photo is deleted, whichever of those two happens. Leaving takes your ratings and your Santés off what friends see; deleting the cellar ends its friendships and takes everything it shared with them. Either way your address comes off the invitation list too, so coming back would need a fresh invitation. Take a copy first if you want one — Settings → Your data hands the whole cellar back as a file, any time, with no strings on it.

Under Law 25 and PIPEDA you can ask to see everything held about you, have it corrected, have it deleted, and have a copy in a portable format. The app does the last two on its own — deletion and export are both buttons in Settings — and privacy@ourcave.wine covers the rest. A reply comes within 30 days, which is the deadline the law sets.

If an answer here is unsatisfying, the Commission d’accès à l’information du Québec takes complaints about how personal information is handled.

If personal information here is ever exposed in a way that could cause you harm, you will be told what happened, what was involved and what to do about it — and so will the Commission d’accès à l’information, as the law requires. Not quietly, and not late.

La Cave is about wine, and it is not intended for anyone under the legal drinking age where they live.

The date at the bottom of this page moves when the text does, and anything that changes what is collected or who touches it will be said in the app before it takes effect — not buried in a revision.

The terms say what the app promises, which is deliberately very little.