Privacy Policy

MyDrams (“we”, “us”, “our”) is a personal whisky tasting journal available at mydrams.app and on Android via Google Play. The data controller is the MyDrams service operator, contactable at whisky@mydrams.app.

• Email address — provided when you sign in. Used solely for passwordless authentication (magic-link email).
• Tasting records — bottle names, distilleries, scores, tasting notes, flavour tags, and dates you enter yourself.
• Bottle photos — label images you choose to upload.
• Collection data — ownership status, prices, volume remaining, and wishlist entries you record.
• Profile information — display name and username you set.
• Usage measurement — Vercel Web Analytics records page views along with coarse technical details (country, browser, operating system, device type). It is cookieless, sets no identifier that follows you between sites, and we use it only to see which parts of the app are used.

We do not collect location data or advertising identifiers. Photos you upload are stripped of embedded metadata, including any GPS coordinates your camera recorded, before they are stored. Apart from the usage measurement described above, nothing is collected from your device that you did not submit yourself.

• Contract (Art. 6(1)(b)) — processing your email and tasting data is necessary to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — cookieless usage measurement, to understand which parts of the app are used and keep the service stable and secure.
• Consent (Art. 6(1)(a)) — where we ask for your explicit permission, such as camera access for label scanning.

We share data only with the following processors, each bound by a Data Processing Agreement:

• Supabase Inc. (USA / EU regions) — database, authentication, and file storage. Your data is stored in the EU region. Privacy policy.
• Vercel Inc. (USA) — application hosting, edge delivery, and the cookieless Web Analytics described in Section 2. Privacy policy.
• Google LLC (USA) — the Gemini API identifies bottles from label photos. When you scan a bottle, that photo is sent to Google for recognition. Privacy policy.
• Anthropic PBC (USA) — the Claude API powers the optional AI features: drafting social posts from your tasting notes, summarising distillery visits, and matching a bottle you are adding against the catalogue. Only the text needed for the feature you invoked is sent. Privacy policy.
• Linkup (France) — web research used to enrich the shared bottle and distillery catalogue. Catalogue entries only; none of your personal data, tastings, or photos are sent. Privacy policy.
• Apple Inc. (USA) — iCloud Mail delivers service emails such as moderation notices. Your email address and the message are sent to deliver them. Privacy policy.

We do not sell or rent your data, and we do not share it with advertisers.

What the AI features send, and what they do not. Scanning a bottle sends that label photo to Google. Generating a social post sends the tasting note you are sharing to Anthropic. Both act as processors on our instructions under terms that do not permit them to train their models on data sent through their APIs, and neither receives your email address, your account identifier, or the rest of your journal. You can use MyDrams without these features: bottles can be added by hand, and notes can be written and shared without the AI drafting step.

We retain your data for as long as your account is active. If you delete your account, all personal data — including your email, tasting records, and uploaded photos — is permanently deleted within 30 days. Anonymised, aggregated statistics (e.g. total number of tastings) may be retained indefinitely as they cannot identify you.

If you are in the European Economic Area or United Kingdom, you have the following rights:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email whisky@mydrams.app. We will respond within 30 days.

MyDrams uses a session cookie set by Supabase to keep you signed in. No advertising or tracking cookies are used. The app may store preferences in your browser's local storage for performance; this data never leaves your device.

MyDrams is intended for users of legal drinking age in their country of residence. We do not knowingly collect data from anyone below the legal drinking age. If you believe a minor has created an account, contact us and we will delete it promptly.

Most of our processors (Supabase, Vercel, Google, Anthropic, Apple) are based in the USA; Linkup is in the EU. Transfers outside the UK and EEA are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection. Your journal itself — account, tastings, and photos — is stored in Supabase's EU region.

We may update this policy from time to time. If we make material changes, we will notify you by email or via an in-app notice. The date at the top of this page always reflects the most recent revision.

For any privacy questions, contact us at whisky@mydrams.app.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ICO). In the EU, contact the supervisory authority in your member state.