Privacy policy

Information you provide

You can create an on-device taste profile without an account. It can include your display name, age confirmation, bottle statuses, dislike reasons, and personal bottle notes. A verified email account is optional and enables synchronization. If you add one, Scotchy stores your email and profile data online so the same profile can synchronize between signed-in devices.

Local and cloud storage

Profile data remains cached on the device so the app can work with unreliable connectivity. An ownerless local taste profile remains usable on that device. On the web, Scotchy hides account-owned cache data while its verified account is signed out or a different account is loading. When you add email to a local profile, Scotchy may temporarily store an opaque account identifier and profile timestamps in browser site data so that exact profile can be linked after verification; the marker is removed after linking or a profile reset, and expires after 30 days unless you request a new verification email. Browser site data remains until it is cleared, so people who control the same operating-system or browser profile may still be able to inspect it. Signed-in profile data is also stored in Scotchy's managed database. Passwords are handled by the authentication provider and are not available to Scotchy.

Network requests

Scotchy connects to its authentication, profile-synchronization, and feedback-email services and loads bottle photos from HTTPS image hosts. Those providers may receive normal request information such as IP address and browser or device details.

Sharing and selling

Scotchy does not sell personal information. Your taste profile stays private. Bottle lists share only the title you enter and the bottles you select, not your display name, email, account ID, ratings, personal notes, dislike reasons, or private journal history.

Anyone with a bottle-list link can view its selected bottles without an account and can forward the link. The snapshot is carried in the link's URL fragment, not stored as a public profile on Scotchy's server. Your selected text or email app receives the link when you choose to share it.

List links are fixed snapshots. Editing or deleting your local list does not update or revoke copies already sent. List drafts stay on this device, are separate from account profile synchronization, and can be removed by deleting a list or clearing site data. People who control the same browser or device profile may inspect its stored drafts.

Friends and member-profile sharing are retired. Old member-profile pages no longer fetch profile information. Historical server records are retained until account deletion; they are not reused as bottle lists.

A full profile export is different: it includes private ratings and notes. Only share an export with people you trust. Data is shared with service providers only as needed to host the website, authenticate accounts, synchronize profiles, and deliver account or feedback email.

Feedback

When a signed-in user submits feedback directly in the app, Scotchy sends the message, feedback type, the display name associated with the account (when available), verified account email, app version, and basic device or browser details through Supabase and Resend to the developer's support inbox. Copied and email-draft reports include the diagnostic details, but Scotchy does not add your display name or account email to the report body. Scotchy does not automatically attach profile ratings, bottle lists, dislike reasons, or personal notes; anything you type in the message is included.

Supabase does not store the plaintext feedback message in Scotchy's database. To prevent duplicate delivery and abuse, it stores the account ID, an opaque submission ID, a SHA-256 fingerprint of the feedback type and message, delivery state and provider ID, timestamps, and attempt and rate-limit counts. That metadata is deleted with the account. Resend retains sent email data for 30 days by default, and the receiving support inbox retains the delivered email according to its own settings. If direct submission is unavailable, Scotchy may open a draft in the user's email app instead.

Export and deletion

You can export a readable copy of your profile from the app. Import replaces the current profile; when you are signed in, it also replaces the account's synchronized profile and updates its other devices. Signed-in users can delete their account in the account and taste-profile screen or through the account deletion page. Account deletion removes the cloud account, private profile, shared member profile, friendships, and pending friend requests. Local exports must be deleted separately.

Contact

For privacy questions, contact greatwhitepolarbear@gmail.com.