Privacy Policy

Last updated: 24 October 2026

Sip is a personal wine journal and taste profiling app created by Tristan Thomas. This policy explains what information the app processes and how it is used.

Information you provide in the app

Sip stores the wines, ratings, notes and other details you add to your journal, together with the taste profile it creates for you.

If you use the camera or photo library, Sip processes the bottle or wine-list images you choose so it can identify wines and fill in their details.

How your data is used

Sip uses your data to:

• Save and display your wine journal entries.
• Generate your taste profile and tasting summaries.
• Let you search across wines you have rated.
• Identify wines from barcodes, bottle photos and wine-list photos when you use those features.
• Look up wine information online when you use search, Predict and enrichment features.
• Test and improve Sip's bottle-photo and wine-list scanning.

Improving photo scanning

When you use AI Scan, scan a wine list or use Shelf Scan, Sip automatically keeps a copy of the photo after it has been prepared for scanning, together with the result produced at the time. This includes scans that succeed and scans that fail. The photos form a private quality benchmark used to review the result, establish the correct result, investigate failures and check whether changes to Sip's prompts, matching rules or scan models improve accuracy.

Sip removes hidden metadata from the source photo and stores the contribution under a random reference. The separate contribution upload may occur as soon as a network connection and an upload ticket are available. It does not include Sip's normal app session or an identifier for your installation. The stored contribution also does not include your name, email address, account details, device identifier, exact app build number or location.

The visible content of a photo may still identify someone or somewhere. For example, it could include people, reflections, handwriting, venue details or surroundings. Avoid including visible information that you do not want stored.

Contributed scan photos and their results are stored privately with Cloudflare and retained indefinitely for review, testing and improving Sip's scanning. They are not linked to your journal or ratings, sold, used for advertising or marketing, published as catalogue imagery, or used to train general-purpose AI models.

Reporting incorrect wine information

If you report incorrect wine information, Sip sends the wine details, your explanation, any source link and any photos you choose to attach so the report can be investigated and the catalogue corrected. Your journal notes and ratings are not included. To protect the reporting service from abuse, reports are associated with a protected identifier for your app installation.

Report details and photos are stored privately with Cloudflare. Photo location metadata is removed, and uploaded report photos are deleted after 90 days. These photos are not added to the public catalogue or used for scan benchmarks.

If sending fails, Sip keeps a protected retry draft on your device until the report is sent or you discard it.

Improving taste predictions

Sip sends your wine ratings, rating dates, the predictions shown at the time and useful wine details such as names, producers, vintages, regions, grapes and characteristics. This helps test and improve Sip's taste predictions.

Ratings are grouped using a separate identifier so they can be evaluated together. Sip does not attach your name, email, notes, photos, price or your location. Deleting a wine from your journal also tells the service to remove its contributed rating.

Contributed ratings are stored with Cloudflare. A contribution set is removed after two years without an update.

Online search and enrichment

When you use online search, prediction or enrichment, Sip sends only the query, barcode, wine details or image needed to provide that feature. Cloudflare and the relevant search or AI provider process the request and return the result.

Improving search quality

Sip automatically sends aggregated counters about wine lookups to its Cloudflare-hosted service. Each batch has a random reference and records the day, app version, part of the app used, catalogue revision, lookup outcome and count. These counters help assess catalogue coverage and search reliability.

Counter batches do not contain search text, wine names, journal notes, photos or ratings. The request is authenticated to protect the service from abuse.

Sharing your taste or a bottle

If you choose to share a Taste QR, the code contains derived taste preferences, including wine-type profiles, favourite grapes and aggregate counts. Someone with the code can read or compare that profile. It does not contain your individual journal entries, wine names or notes.

Sharing a bottle creates a Sip link containing its catalogue identifier and vintage when available. A recipient can open the bottle's details without receiving your ratings, notes or provider identifiers. If you send a QR or link through another app, the recipients and sharing service you choose receive that shared information.

Friends and invitation links

If you enable Friends, you choose a display name and may choose a profile photo. Sending or opening an invitation does not give anyone access to your ratings. Both people must agree to connect before Sip shares their wine ratings and taste profiles through private iCloud sharing. Journal notes, journal photos, prices and personal locations are not shared with friends.

To make invitation links short, Sip sends your chosen display name, an iCloud account reference and your private iCloud invitation URL to a Cloudflare-hosted link service. The service verifies that requests come from Sip and uses a Friends-specific reference that changes daily to limit abuse. This stored reference is different from the installation identifier used by other online features. A private management key held by your app controls renewal of each link. It stores these invitation details under a hard-to-guess link for up to 90 days after the link was last prepared. Expired details are removed within an additional hour. Someone who has the link can retrieve these invitation details and request to connect, but cannot use it to read your ratings without mutual approval. Your ratings and taste profiles are not stored by this link service.

Removing a friend revokes your sharing with that person. Turning Friends off revokes your iCloud sharing and clears Friends data on your device. A previously sent link may still show an invitation page, but cannot restore a revoked iCloud invitation or approve a new friendship. Recipients may already have viewed or saved information you shared.

Website and link previews

The website and invitation pages at sipwine.app are hosted by Cloudflare. Cloudflare processes ordinary request information, including IP addresses, to deliver the pages and limit abuse. Sip does not add advertising trackers or analytics cookies. Invitation previews use generic Sip artwork and do not include your name, profile photo, account reference or ratings. If you share a link through another service, that service and your chosen recipients receive the link.

Storage and syncing

Your journal is stored on your device. If iCloud syncing is available and enabled, it is also stored in your iCloud account so it stays in sync across your devices.

Accounts

Sip does not require you to create an account.

Data sharing

Sip does not sell your data. Its service providers process information needed to run online features, and Apple processes information when you use iCloud. If you use Friends, its invitation service processes the details described above. If you choose to share a Taste QR or bottle link, the information described above is also shared with your chosen recipients and sharing service.

Contact

If you have privacy questions about Sip, contact t@tristanthomas.me.