Privacy Policy
What the WineBudd app and winebudd.com collect, who helps us run them, and how to have your data deleted.
Last updated: 11 October 2026
In short. WineBudd keeps the wine journal you write. We use your data only to run the app, we do not sell it and we do not use it for advertising. You can delete your account and journal from inside the app at any time.
Who we are
WineBudd (the "App") and this website, winebudd.com, are operated by Upstack Studio Sdn. Bhd. ("we", "us"). This policy covers the App and winebudd.com only. It is separate from, and does not apply to, upstackstudio.com.
What we collect
Account information
- Your first name, last name and email address.
- A password, if you register with email. We store only a one-way cryptographic hash of it, never the password itself.
- If you sign in with Apple, an identifier and an access token issued by Apple. Accounts created earlier with Facebook sign-in also have a Facebook identifier and token. We store these tokens encrypted in our database.
- Your wine preferences, if you choose any (for example, the wine categories you like).
- Sign-in records: how many times you have signed in, when, and the IP address of your current and previous sign-in. We use these to secure your account.
Your wine journal
The tasting notes you create: wine name, vintage, country, region, wine type, colour, price, currency, where you tasted or bought it, whether it was a gift, the tasting ratings you pick (such as clarity, acidity, tannin, body and finish), aromas and flavours, quality level, and your free-text note.
Photos
Photos you attach to a journal entry, such as a picture of a wine label. They are stored with Amazon Web Services (S3) and sent over an encrypted connection.
Feedback and support messages
If you send feedback from the App, we receive your message together with your name and email address. If you email us, we receive whatever you write.
Diagnostics and usage
- Crash and error reports (Sentry): device and app information and error details when the App or our servers fail. Your account ID and email address are attached to these reports so we can fix problems for the right account.
- Product analytics (PostHog): events such as the App being installed, opened or updated, linked to your account ID, email address, the way you sign in, how many times you have signed in and whether you have set wine preferences. We use these to understand how many people use the App and which parts they use.
- Push notifications (OneSignal): a device identifier and push token, so that we can send notifications to your phone. OneSignal does not receive your journal.
How we use it
Only to run and improve the App: to sign you in and keep your account secure, to store and show you your own wine journal, to send you account emails (confirmation and password reset), to reply to your messages, to fix bugs, and to understand how the App is used. We do not sell your data, we do not rent it, and we do not use it for advertising or share it with advertisers.
Who we share it with
We use a small number of service providers. Each receives only what it needs for its job.
| Provider | What for | What it receives |
|---|---|---|
| Fly.io | Runs our servers | Everything the App sends to our servers, while it is processed |
| Amazon Web Services (S3) | Stores your journal photos | Your photos |
| Brevo | Sends account emails | Your email address and the email content (such as a confirmation or password reset link) |
| Tawk.to | Receives feedback sent from the App and emails sent to our support address | Your name, email address and message |
| Sentry | Crash and error reports | Diagnostic data, your account ID and email address |
| PostHog | Product analytics | Usage events, your account ID and email address |
| OneSignal | Push notifications | Device identifier and push token |
| Apple, Facebook | Sign-in, if you use it | The sign-in details you authorise. When you delete your account we ask Apple or Facebook to revoke the token we hold |
We do not intentionally send your journal entries or photos to Sentry, PostHog, OneSignal or Brevo. Some providers process data outside your country, including in the United States. We may also disclose information if the law requires it.
Security
All traffic between the App and our servers uses HTTPS. We store passwords only as one-way hashes, and sign-in tokens from Apple and Facebook are encrypted in our database. Photos are stored with Amazon Web Services S3. No online service is perfectly secure, so we cannot guarantee absolute security.
Keeping and deleting your data
We keep your account and journal until you delete your account.
To delete your account: open the App, go to Profile, choose Delete Account and confirm. This deletes your account and your journal entries, and starts the removal of the photos attached to them from our storage. If you want us to confirm that your photos have been removed, email us. You may be asked for an optional reason, which we use only to improve the App. Copies may remain in our routine database backups until those backups are replaced in the normal cycle.
Data already sent to our providers (for example crash reports or analytics events) is kept under their retention rules. If you want it removed, email us and we will ask them to delete it for you.
Your choices and rights
You can edit your name, email and password in the App, and delete your account as described above. You can also email us to ask for a copy of your data, to correct it, or to have it deleted. Depending on where you live, you may have further rights over your personal data, including the right to object to or restrict how we use it and to complain to your local data protection authority. We will respond as soon as we can.
This website
This website does not use advertising or analytics cookies. Cloudflare delivers it to your browser, so Cloudflare processes your IP address as part of serving each page. See Cloudflare's privacy policy.
The free tasting sheets on this website run entirely in your browser. What you type into a sheet is saved only on your own device (in your browser's local storage) so it is still there when you return. It is never sent to us. Clear the sheet, or your browser data, to remove it.
Links to the App Store and Google Play take you to Apple's or Google's service, which has its own privacy policy. Some of our links carry a campaign label such as "tasting-sheet-red" so that we can count how many people arrive from this website. The label does not identify you.
Children
WineBudd is about wine and is not directed at children. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and the date at the top.
Contact
Questions, data requests or deletion help: [email protected]
Upstack Studio Sdn. Bhd.