Operator line: Amberstill is operated by Addletic, LLC, a New York limited liability company, 144 Village Landing #349, Fairport, New York 14450-1804.
Amberstill — Privacy Policy
Version 1.0 — Effective: October 28, 2026 Controller: Addletic, LLC , 144 Village Landing #349, Fairport, New York 14450-1804, United States. Privacy contact: support@amberstill.app.
1. What we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | email, username, avatar (profile photo) | you |
| Google sign-in (optional) | Google account ID, name, email, profile photo URL as Google provides them | |
| Age confirmation | for accounts created from October 28, 2026, your email-confirmation timestamp and the Terms version sent to you; once the age gate ships, a confirmed_21_at timestamp, an age_ok cookie/session flag, and a short-lived "failed" flag if you don't pass. We don't store your date of birth. |
you / automatic |
| Ratings & preferences | ratings (Like / Pass / Haven't tried) with timestamps, taste sliders, "where / who made it" tags, Cellar, private recipes, and ingredients of drinks saved from books or websites (e.g., Liquor.com), stored privately and used for similarity; only the drink's name and source are public | you |
| Menu captures | menu photos/text and the venue and time of capture. Drinks you save from a menu are always public, so others see the venue (name and city) and the dates it was seen on a menu. We don't show your username on menu drinks. Drinks saved from a menu can't be made private. To have one removed, email support@amberstill.app and we'll delete it within 30 days. Your device re-encodes menu photos before sending them, which removes location metadata (EXIF/GPS). Photos are sent only to Anthropic for reading, without your name, email, or user ID, and are never stored on our servers (your device keeps them in memory only, for "Try again"). The photo itself may contain personal data, such as names or faces in the picture. | you |
| Inferences | taste profile; similar-drink predictions (when released) | generated by our own taste model, trained on ratings and likes |
| Technical/AI logs | AI call logs (no content) tagged with a short one-way salted hash (HMAC) of your account ID, using one app-wide secret salt; AI usage records (account ID, feature, status, time) and daily usage counters, used for rate limits; IP and device info in hosting logs | automatic |
| Coarse location (later, opt-in only) | approximate area, used only to fetch weather, deleted within 24 hours | your device |
Avatars: during the pilot, avatar images are stored exactly as uploaded in a publicly readable location, and may retain embedded location data (EXIF/GPS). Each avatar you upload is kept as a separate file. Replacing your avatar does not delete earlier ones, and anyone with an earlier image's link can still view it. Please use a photo without location data (e.g., a screenshot, or location turned off). Fixes are planned to strip location data and to delete old avatar files on replace and on account deletion.
We don't collect payment info (the pilot is free) or reasons for passing on a drink. The pilot has no allergy, dietary, or health fields. Please don't put health information in free-text fields.
Sensitive information. We don't intend to collect sensitive personal information, and we don't use any to infer characteristics about you.
Pseudonymous data. Hashed AI logs are pseudonymous and are still personal information. The salt is rotated every 90 days.
2. How we use it
We use your information to run the App, read menus into drink lists, personalize suggestions, show your Taste Card when you choose to, send sign-in emails, prevent abuse, fix bugs, improve the App during the pilot, and comply with law. We don't advertise and don't do cross-context behavioral advertising. We use your ratings and likes to train our own taste model to personalize predictions. We never sell your data and don't use it to train third-party AI models. Sign-in and other emails don't include drink names or images.
3. No sale or sharing
We do not sell personal information or "share" it for cross-context behavioral advertising, and haven't in the past 12 months.
4. Service providers (processors)
| Provider | Purpose | Data |
|---|---|---|
| Supabase (West US — Oregon, AWS us-west-2), USA | database, auth, storage | all account data |
| Cloudflare | hosting, DNS, security, and page-load performance measurement (Cloudflare Web Analytics) | IP, request data, page-load timing |
| Anthropic (model: Claude Sonnet 4.6) | reading menu and book-page photos; classifying recipes (drink name + ingredients). Not used for predictions. | photos (location metadata removed) and recipe text; no name, email, or user ID. Anthropic does not use this data to train its models (we have not opted into any data-sharing program). Anthropic normally deletes inputs and outputs within 30 days. Inputs or outputs flagged by its trust and safety systems can be kept up to 2 years, and data may be kept longer where required by law. |
| Resend | sign-in/confirmation emails (via Supabase Auth) | email address |
| Our email provider (the mailbox behind support@amberstill.app; Google, which hosts the Gmail account) | receiving and answering your support and deletion requests | your email address and what you write to us |
| Google sign-in (optional) | sign-in identifiers | |
| Google Fonts | loading the App's fonts | your IP address and browser info |
| Google Maps / Places | restaurant search | your IP address and the place searches you type |
| Open-Meteo (later, not built) | weather | coarse coordinates only, no account info |
From Google Places we cache only venue IDs and venue coordinates (coordinates for 30 days at most). This applies to venue data, not your location.
We may also disclose information to comply with law, protect rights and safety, or in a business transfer (with notice).
5. What others see
Other users can see your username, display name, avatar, and drinks you make public. Drinks you create yourself are private unless you make them public. Signed-out visitors can search and read public drinks. Menu photos are never stored. Drinks you add from a menu are always public, so other users see the venue (name and city) and the dates it was seen on a menu. We don't show your username on menu drinks. Private drinks, recipes and ingredients (including from books and websites) are visible only to you. A Taste Card QR shows your taste summary to whoever scans it, so only show it to people you choose. Taste Card links contain only the taste info shown on the card, with no name, account ID, or private drinks. They can't be switched off individually: any link or QR you've shared keeps working, including after you delete your account, and shows only that taste info. Shared links can be forwarded, so only share with people 21+.
6. Retention
| Data | Kept |
|---|---|
| Account, ratings, Cellar, recipes, taste profile | until you delete your account, or 90 days after the pilot ends |
| Menu and book photos | never stored by us; Anthropic's retention applies (normally deleted within 30 days; inputs or outputs flagged by its safety systems can be kept up to 2 years, and data may be kept longer where required by law) |
| Avatars | until account deletion; earlier uploads currently aren't removed (fix pending) |
| Menu capture text/venue/time | as account data |
| Coarse location | under 24 hours |
| AI call logs (hashed) | kept up to 7 days; salt rotated every 90 days |
| AI usage records | up to 35 days for active users; older records are currently removed only when you next use an AI feature, so inactive users' records can last longer (scheduled cleanup pending) |
| Daily AI usage counters | currently kept until account deletion (retention limit pending) |
| Age-gate flags | session, or 30 days if you choose "remember me"; failed flag up to 24 hours |
| Hosting/security logs | kept up to 7 days |
| Backups | daily backups kept about 7 days; deleted data may persist in backups for up to about 7 days |
Pilot resets: because this is a pilot, we may reset or migrate data. We'll give notice where practical, and resets follow the deletion rules in §7.
7. Account deletion
During the pilot, in-app deletion isn't available yet. Email support@amberstill.app from your account's email address and we'll delete your account within 30 days. Tell us if you want us to "Also delete my public drinks". In-app deletion is planned. Then: - Deleted from our active systems: your account, email, username, all avatar files, ratings, taste profile, Cellar, private recipes, AI usage records and counters; menu captures and venues you added are disconnected from you. If you set a home bar, its name is deleted; if a public drink you chose to keep references it, it is shown only as "Home bar". - Taste Card links you shared keep working (they hold no account info and can't be revoked individually), showing only the taste info on the card. - Likes on others' drinks stay only as anonymous like counts, not linked to you. - Public drinks you created (unless you chose to delete them) stay in the App, de-identified and ownerless: your name and avatar are removed, and we commit not to try to re-identify you from them. Kept drinks from books or websites lose your private recipe and ingredient details and remain as name and source only. - Hashed AI call logs are not deleted individually. They expire within about 3–7 days, and the salt is rotated every 90 days. - Backups keep deleted data for about 7 days until they roll over. If we restore a backup, we re-apply deletions. - Processors delete per their own retention.
You can also request deletion by email.
8. Your rights (California and other U.S. states)
Depending on your state (e.g., California CCPA/CPRA, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Washington, and others), you may have the right to: - know or access your data, correct it, delete it, and take a copy with you - opt out of sale, sharing, targeted advertising, and profiling with significant effects (we do none of these) - limit use of sensitive information - not be discriminated against for exercising these rights
How to ask: email support@amberstill.app. We verify you through your account email. Authorized agents may submit requests with proof.
Timing: we confirm receipt within 10 business days and respond within 45 days. We may extend by another 45 days with notice.
Appeals: if we deny a request, you can appeal by replying to our decision. If we deny the appeal, you may contact your state attorney general.
Browser signals: we honor Global Privacy Control. Because there's no common standard for Do Not Track, we don't respond to DNT signals, but we don't track you across sites anyway.
9. Age
The App is only for people 21+. We do not knowingly collect data from anyone under 21 (and never from children under 13). If we learn we have, we delete it. Contact support@amberstill.app.
10. Security
We use encryption in transit, access controls, row-level security, pseudonymized AI logs, and EXIF removal for menu photos. We don't perform facial recognition. No system is perfectly secure. If a breach affects you, we'll notify you as the law requires.
11. Cookies & local storage
We use strictly necessary storage only: your sign-in session in local storage (and age-gate status once it ships). We also use Cloudflare Web Analytics, which measures how fast our pages load; according to Cloudflare, it collects timing metrics and does not track individual users across sites. We use no advertising pixels or session replay. Loading Google Fonts and Google Maps sends your IP address to Google (see §4).
12. Changes / contact
We'll notify you of material changes. Contact support@amberstill.app, 144 Village Landing #349, Fairport, New York 14450-1804, United States.