Legal
Privacy Policy
Short version. The app stores your whiskey collection — the bottles, the pours and the notes you write — in a database in the EU, tied to an account that starts out anonymous. It sends crash and error reports to an EU error-tracking service with personal data switched off. It contains no advertising, no third-party trackers and no analytics. The website stores nothing about you unless you join the interest list, in which case it holds your email address, your consent record and the short technical record set out below. We never sell any of it, and you can have all of it deleted by asking.
1. Who we are
My Whiskey Shelf is a product of Nisshagen Advisory AB (Org.nr 559526-6742), a company registered in Stockholm, Sweden. We are the data controller for personal data collected through the mywhiskeyshelf.com website and through the My Whiskey Shelf app.
Contact hello@mywhiskeyshelf.com for any privacy question, including data subject requests under the GDPR.
This policy covers both the website and the app. Where a section applies to only one of them, it says so.
2. The app
Your account
The app creates an anonymous account the first time you open it. That account has no email address, no name and nothing that identifies you as a person — it is an identifier that lets your own shelf come back to you the next time you open the app. You are not asked to sign up, and you can use the app indefinitely without ever creating a real account.
If you later choose to create a real account so your collection survives a new phone, we store what you give us for that purpose:
- Email and password: your email address, and a password we never see in readable form — it is hashed by our authentication provider.
- Sign in with Google: your email address and the account identifier Google returns. We do not receive your Google password, your contacts or anything else in your Google account.
- Sign in with Apple: the account identifier Apple returns, and the email address you choose to share. If you use Apple’s Hide My Email, we only ever see the relay address, never your real one.
What you put on the shelf
Everything else in the app is content you create, stored against your account:
- The bottles you own and what you record about them: name, distillery, style, origin, age, strength, cask, bottler, size and how much is left.
- Provenance, if you fill it in: the date you bought a bottle, what you paid, where you bought it, where you keep it, and any notes you write.
- Pours you log: the date, how you drank it, a rating, and your nose, palate, finish and free-text notes.
This is private to your account. There is no social feed, no public profile and no sharing. Other users cannot see your shelf, and database access rules restrict every row to the account that created it.
Bottles are held in an inventory shared with My Bar Shelf, our companion app, so that one bottle you own is one record rather than two. If you use both apps signed in to the same account, a bottle added in one appears in the other, and deleting it in one deletes it in both. This sharing is between apps you control, under your own account. Nothing is shared with anyone else.
Errors and crashes
The app reports crashes and errors to Sentry, hosted in the EU. Sending personal data is explicitly disabled, so reports do not carry your IP address, your username or your cookies. They contain the technical detail of what failed: the error, where in the code it happened, the device model and the app version. We use them to fix bugs and for nothing else.
Photographs
The app asks for permission to open your photo library only if you choose to attach a picture of your own bottle to its entry. It does not read your library otherwise, and it never uploads photographs you have not selected.
What the app does not do
- No advertising, no advertising identifiers, no ad networks.
- No analytics or behavioural tracking, and no third-party tracking SDKs.
- No location collection. The app does not ask for location access.
- No contacts, calendar, microphone or health data.
- No selling, renting or sharing of personal data with data brokers, ever.
- No purchases. The app has no subscription and no in-app purchase today.
If we later add product analytics or a paid subscription, we will update this policy and the App Store privacy labels before either is switched on, and any analytics will be off until you consent to it.
3. The website
Reading mywhiskeyshelf.com collects nothing about you personally. If you submit the interest-list form, we store only what that form sends:
| Data | Why we collect it | Where it is stored |
|---|---|---|
| Email address | So we can tell you once, when My Whiskey Shelf is ready to test | Supabase (EU) |
| Which app you registered for | Measuring which apps in the “shelf” family people actually want, so we know what to build | Supabase (EU) |
| Consent: that you ticked the box, stored as a yes or no | Proving we had a lawful basis to email you, as the GDPR requires | Supabase (EU) |
| Consent wording: the exact sentence you agreed to | Showing precisely what you consented to, not merely that you consented | Supabase (EU) |
| The date and time you signed up and gave consent | Proof that consent was given, and when. Required under GDPR Article 7(1). | Supabase (EU) |
| The page address you signed up from | Knowing which page produced the sign-up | Supabase (EU) |
| The referring site, if your browser sent one | Understanding where interest came from, in aggregate | Supabase (EU) |
| Your browser’s language setting | Judging which languages an app would need. It is the language preference itself and nothing else. | Supabase (EU) |
| A one-way hash of your IP address: the address is salted and put through SHA-256, and the first 32 characters of the result are kept | Limiting sign-ups to five per hour from the same network, so the form cannot be flooded. Your actual IP address is never written to the database, and the stored hash cannot be turned back into an address. It is still information derived from you, so we treat it as personal data and it is deleted with the rest of your entry. | Supabase (EU), stored on your sign-up row |
The site uses Vercel Web Analytics for aggregate, anonymous traffic measurement (page views, referrers, country-level location). It is cookieless, does not track individuals across sessions or sites, and does not build user profiles. There are no other tracking pixels and no non-essential cookies. If we add any, we will update this policy before they take effect.
4. Legal basis for processing
- Performance of a contract: storing your account and the collection you enter, because that is the service the app provides and cannot be provided without it.
- Consent: your email address on the website interest list. The box is never pre-ticked, and you may withdraw consent at any time.
- Legitimate interests: keeping the service working and secure — crash and error reporting, and rate-limiting the sign-up form so it cannot be abused.
5. Third parties we use
- Supabase — database, authentication and file storage for the app and for the interest list. Hosted in the EU.
- Sentry — crash and error reporting for the app, on its EU service, with personal data sending disabled.
- Vercel — website hosting and cookieless aggregate analytics.
- Google and Apple — only if you choose to sign in with one of them, and only for that sign-in.
Fonts on this website are served by Google Fonts, which means your browser requests the font files from Google’s servers and Google receives your IP address as part of that request. No font-related cookies are set. The app does not load fonts over the network; they ship inside it.
We do not sell your data to any third party, and none of these providers use your data for advertising.
6. How long we keep things
- Your account and your collection: for as long as the account exists. Ask us to delete the account and everything on the shelf goes with it.
- Anonymous accounts: these live on the device that created them. Delete the app and there is no way back to that shelf; the orphaned record is removed in routine clean-up.
- Error reports: retained by Sentry on its standard retention schedule for our plan and then deleted automatically. They are technical records, not account records, and are never used to build a profile of you.
- Interest-list entries: until you ask us to remove them, until you unsubscribe, until we decide not to release the app and delete the list, or two years with no launch and no contact from you — whichever comes first. Consent records are kept for as long as we hold the address, because they are the evidence that we were allowed to hold it, and everything else on that row, including the IP hash, is deleted with it.
7. Your rights under the GDPR
As a user in the European Economic Area you have the right to:
- Access: request a copy of the data we hold about you
- Rectification: ask us to correct anything inaccurate
- Erasure: ask us to delete your account, your collection, your interest-list entry, or all of it
- Portability: request your data in a portable format
- Withdraw consent: tell us to stop at any time, without giving a reason; withdrawal does not affect processing carried out before then
- Object and restrict: object to processing based on legitimate interests, or ask us to restrict it
To exercise any of these, write to hello@mywhiskeyshelf.com from the address on the account. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority; in Sweden that is Integritetsskyddsmyndigheten (IMY).
8. Deleting your account
Email hello@mywhiskeyshelf.com from the address you signed up with and we will delete the account and everything held against it, including your bottles, pours and notes. Because bottles are shared with My Bar Shelf, deleting the account removes them from that app as well. Deletion is permanent and we cannot restore it afterwards.
9. Age
My Whiskey Shelf concerns collections of alcoholic spirits and is intended solely for adults of legal drinking age in their country of residence. It is not directed at children, and we do not knowingly collect data from anyone below that age. If you believe a minor has given us data, write to us and we will delete it.
10. International transfers
Our database, authentication and error reporting are hosted in the European Union. If a provider ever needs to process data outside the EEA, we will only use one that relies on an adequacy decision or the European Commission’s standard contractual clauses, and we will say so here.
11. Changes to this policy
If we make material changes we will publish the updated version here and update the version number and effective date at the top of this page. If a change materially affects data we already hold about you, we will tell you before it takes effect.
12. Contact
Questions or concerns about your privacy? Write to hello@mywhiskeyshelf.com.
Nisshagen Advisory AB, Stockholm, Sweden.