Legal

Privacy Policy

Version 2.1  ·  Effective date: 1 September 2026

1. Who we are

My Whiskey Shelf is a product of Nisshagen Advisory AB (Org.nr 559526-6742), a company registered in Stockholm, Sweden. We are the data controller for personal data collected through the My Whiskey Shelf app and through the mywhiskeyshelf.com website.

Contact hello@mywhiskeyshelf.com for any privacy question, including requests under the GDPR. We have not appointed a data protection officer and are not required to.

This policy covers both the app and the website. Where a section applies to only one of them, it says so.

2. Your account

The app creates an anonymous account the first time you open it. That account holds no email address and no name. It is a random identifier that lets your own shelf come back to you the next time you open the app. You are not asked to sign up, and you can use the app indefinitely without ever creating a real account.

An anonymous account is still a real record in our database. Everything you enter is stored against it, exactly as described in section 3. What an anonymous account cannot do is turn on usage analytics, so nothing in section 6 applies to you until you sign in.

If you create a real account so your collection survives a new phone, we store what you give us for that:

• Email and password: your email address, and a password we never see in readable form. It is hashed by our authentication provider.
• A one-time sign-in link: your email address, so we can send the link to it.
• Sign in with Google: your email address and the account identifier Google returns. We do not receive your Google password, your contacts or anything else in your Google account.
• Sign in with Apple: the account identifier Apple returns, and the email address you choose to share. If you use Apple’s Hide My Email, we only ever see the relay address, never your real one.

On your device the app stores your sign-in session, a flag recording that this device has held a real account, and your language preference. Signing out clears them.

3. What you record, and who it is shared with

Everything in the app besides the reference catalogue is content you create, stored against your account:

• Bottles: name, distillery, style, origin, age, vintage, strength, cask, bottler, size, barcode, how much is left, and any notes you write.
• Provenance, if you fill it in: the date you bought a bottle, what you paid and in which currency, where you bought it, and where you keep it.
• Pours: the date, how you drank it, a rating, and your nose, palate, finish and free-text notes.
• Shopping list: what you want, any note against it, and when you bought it.
• Accessories: category, name, brand, notes, quantity, when you acquired it, and a photograph if you add one.

This is private to your account. There is no social feed, no public profile and no sharing with other people. Database access rules restrict every row to the account that created it. There is one exception, the shared barcode table, and section 5 sets it out.

Your bottles are shared with My Bar Shelf. Bottles live in a single inventory used by both My Whiskey Shelf and My Bar Shelf, so one bottle you own is one record rather than two. If you are signed in to the same real account in both, a bottle added in one appears in the other, editing it in one edits it in both, and deleting it in one deletes it in both. Deleting your account removes those bottles from both apps at once. This is between apps you control, under your own account. Nothing is shared with anyone else.

While you are anonymous you have a different account in each app, so nothing is shared until you sign in with a real account in both.

Three things reach past this app, and each reaches a different set of apps, so each is named rather than lumped together:

• Your analytics choice is one row on your account, read and written by My Bar Shelf, My Whiskey Shelf, My Wine Shelf, My Beer Shelf and My Cigar Shelf. It does not cover My Coffee Shelf, which keeps its own answer in its own table. Section 6.
• Your free AI scan allowance is shared between My Whiskey Shelf, My Cigar Shelf and My Coffee Shelf, which call the same scan function and count against the same ledger. Section 4.
• Your subscription is keyed to your account identifier at RevenueCat, and what it unlocks depends on which subscription you bought. Section 8.

Version 2.0 of this policy called all three “set once and apply to every Shelf app you use”. That was one sentence covering three different scopes, and it was wrong about each of them.

4. Photographs and the AI label scan

This is the part of the app that sends the most away from your device, so it is set out in full.

The camera and the photo library are used for one thing: reading a bottle label. There is no separate feature for attaching a picture to a bottle. If you never run a label scan, no photograph of yours ever leaves your device.

When you start a scan, the app asks for camera or photo library permission, then:

• The picture is resized on your device to 768 pixels on its long edge and re-encoded as a JPEG.
• That resized image is sent to our own server function, which runs on our database provider’s infrastructure in the EU. Your sign-in token goes with it, so the function knows whose allowance to count.
• Our function forwards the image and a fixed instruction to Google, to the Gemini API, which reads the label and returns text. Nothing else is sent to Google: not your account identifier, not your email, not your device identifier, and nothing from your shelf.
• The reading comes back and fills in the add form. You review and edit every field.

This happens before anything is saved, and it happens even if you then discard the reading and add nothing. Cancelling the form does not undo the upload.

If you do save the bottle, the same photograph is also uploaded to our file storage and kept with the bottle. That storage area is not access controlled: the file sits at a long random web address, and anyone who has that address can open it without signing in. The address is only ever stored in your own record and we do not publish it, but we are not going to describe the file as private, because it is not.

Each successful scan writes one row recording your account identifier, which Shelf app ran the scan, what kind of scan it was and the time. That row exists to count your free allowance, which is five AI scans in total, for the lifetime of the account. It is not a daily or a monthly allowance and it does not reset.

Those five are not five per app. The count is kept on your ACCOUNT, in one ledger, and the check that reads it does not filter by app. So an AI scan you ran in any Shelf app comes off the same five. We checked the ledger rather than reasoning about it: it currently holds scans recorded by My Bar Shelf, My Cigar Shelf and My Wine Shelf. Not every Shelf app meters its AI features this way, and each of their policies is the place to read how theirs works. Two earlier versions got this wrong in opposite directions: one said the five were shared across every Shelf app, which was more than we had checked, and the correction named three apps as a closed set, which was less than the ledger actually counts.

If you have a subscription you are not metered, but the row is still written.

Before running a scan our server asks RevenueCat whether your account has an active subscription, which sends your account identifier to RevenueCat. Section 8 covers that.

What we cannot tell you. We call Google’s general endpoint and have not pinned it to a European region, so you should assume the photograph is processed outside the EU. We do not control what Google does with the image after it has read it, and we are not going to state a retention period we cannot verify. Google’s own terms for that API govern it. If that is not acceptable to you, do not use the label scan. Adding a bottle by barcode, by catalogue search or by hand never sends a photograph anywhere.

Older builds of the app carry a camera permission notice saying that nothing is uploaded unless you save it. That notice is wrong and it is being corrected. This section describes what the app actually does.

5. Barcode scanning, and the shared barcode table

When you scan a barcode, the digits are first checked against our own shared table of barcode-to-product mappings. If that misses, the app asks up to five external barcode databases in order and stops at the first one that returns a usable answer:

• Open Food Facts and Open Products Facts, run by the same non-profit in France
• UPCitemdb, in the United States
• Vinmonopolet, the Norwegian state retailer
• Brocade, in the United States

Each of them receives the barcode digits and, because the request comes from your phone, your device’s IP address. None of them receives your account identifier, your email, a photograph or anything from your shelf.

If you confirm that a barcode belongs to a particular catalogue product, the app saves that mapping to a table shared with My Bar Shelf, so the next person who scans that bottle gets an answer immediately. The saved row holds the barcode, the product, and the account identifier of whoever contributed it.

That table is readable by anyone holding the app’s public key, which is embedded in the app and is not a secret. So the contributor identifier on a barcode mapping is not private. It is a random identifier and carries no name, no email and nothing from your shelf, but it is the one place where a row of yours is not restricted to your account, and you should know it. Your contributions are deleted when you delete your account.

6. Usage analytics, which are off until you turn them on

The app can send product analytics to Mixpanel, on its EU service. It does not do so unless you switch it on.

Before you consent

The setting is off by default and is off for every new account. While it is off, the analytics library is never started, no analytics identifier is generated, no events are queued, and no connection to Mixpanel is opened at all. It is not a filter applied to data that was collected anyway. Nothing is collected.

The setting is only offered on a real account. An anonymous account cannot turn it on, so if you never sign in, no analytics of any kind are ever sent.

Turning it on

Profile, then Data, then the Usage data switch. It is a single setting, stored as one row on your account, and it covers My Bar Shelf, My Whiskey Shelf, My Wine Shelf, My Beer Shelf and My Cigar Shelf, which all read and write that one row. Turning it on here turns it on in those, and the other way round.

It does not cover My Coffee Shelf, which keeps its own separate answer in its own table and asks you again there, so turning it off here leaves coffee where you set it. My Supply Shelf sends no analytics at all. Version 2.0 of this policy said the setting covered every Shelf app you use with the same account, which was wrong about coffee. The wording on the switch inside the app makes the same overstatement and is being corrected there too.

You can turn it off again at any time in the same place, and you do not have to give a reason.

What is sent once it is on

Ten events and nothing else: adding an item, adding your first item, sharing a dram card, a paywall being shown, a paywall being dismissed, a restore being attempted, a restore succeeding or failing, a subscription starting, and a purchase failing. Each carries short labels from a fixed list: which route you added the bottle by, which screen you were on, whether there was a photo, whether you rated it, which paywall you saw and which feature triggered it, and an error code when a purchase fails.

Attached to every event: whether the account has a subscription, whether it is anonymous, and which sign-in method it uses. The Mixpanel library also attaches your operating system and its version, and your device manufacturer and model.

Events are identified by your account identifier, not by your name or your email address. The switch in the app calls this anonymous usage data. Pseudonymous is the accurate word, and that wording is being corrected in the app.

Never sent: bottle names, distilleries, tasting notes, ratings, prices, purchase places, storage locations, photographs, your email address, or anything else you typed.

Approximate location. We do not suppress the IP address on these events, so Mixpanel resolves it to an approximate city, region and country and stores that against the event and the profile. The app does not ask for location permission and does not read your device’s location; this is derived from the network address of the request. If you would rather that did not happen, leave the switch off.

Turning the switch off clears the stored analytics identifier, so if you ever turn it back on, the new events are not joined to the old profile. Events already sent stay with Mixpanel. Section 12 says what we do about that.

7. Crash and error reports

The app reports crashes and errors to Sentry, on its German service. This is always on and is not covered by the analytics switch, because it is how we find out that the app is broken.

Sending personal data is switched off in our configuration, and we never attach an account to a report, so reports do not carry your account identifier by design, your email, a username, your IP address or cookies.

A report contains the error and its message, where in the code it happened, the device model, the operating system and version, the app version, the device locale and timezone, memory, storage, battery and orientation, and the list of loaded modules. Screenshots, view hierarchies, session replay and performance profiling are all switched off.

The honest limit. The Sentry library records a breadcrumb trail of network requests, storing the method, the web address and the status of each. Some of our database requests carry your account identifier in the address, and a catalogue search carries the text you typed. So a crash report can contain those two things. Request bodies are not recorded, so a bottle you saved does not travel to Sentry that way. We cannot promise more than that: when a database write fails, the error we attach is the database's own message, and a database message can quote the value that caused the failure. We are not going to claim that a crash report contains nothing about you.

8. Subscriptions and purchases

Some parts of the app are reserved for subscribers, and the free AI scan allowance in section 4 is one of the limits a subscription lifts.

We do not take your money and we never see your payment details. Subscriptions are sold and billed by Apple on the App Store or by Google on Google Play. Your card, bank details and billing address are held by them, not by us, and are never sent to us.

We use RevenueCat to keep track of whether a subscription is active. RevenueCat receives your account identifier as soon as you sign in, whether or not you ever buy anything, because the app asks it on every launch whether that account holds a subscription. It also receives your platform and the IP address of the request, from which it derives an approximate country. If you do buy or restore a subscription, it additionally receives the purchase and receipt information the store issues and the country of your store account. Our server also asks RevenueCat about your account when you run a label scan, to decide whether to count the scan against your free allowance.

RevenueCat processes this in the United States. Section 15 covers that transfer.

What a subscription unlocks depends on which one you bought. RevenueCat holds your entitlements against your account identifier, so an entitlement bought in one Shelf app is visible to another that asks about the same account. There are two kinds. A bundle subscription is honoured by the Shelf apps that check for it, so it unlocks more than the app you bought it in. A single-app subscription, which is what most current subscribers hold, unlocks the app it was bought for and is not honoured by the others. Version 2.0 of this policy said one subscription covers every Shelf app on the same account. That is true of the bundle and not of the rest, and it should not have been written as a flat rule.

Either way it needs a real account: while you are anonymous your identifier differs per app, so nothing carries across.

Cancel in your App Store account settings or your Google Play subscriptions. We cannot cancel or refund it for you. Deleting your My Whiskey Shelf account does not cancel a subscription, so cancel it in the store first or billing continues. The Terms of Service set out the renewal and cancellation terms in full.

9. The website

Reading pages on mywhiskeyshelf.com does not require an account and we do not ask you for anything.

The site uses Vercel Web Analytics for aggregate traffic measurement: page views, referrer, country, device, operating system and browser, with a visitor identifier that is hashed and rotates daily. It is cookieless, it does not follow you across sites, and it does not build a profile of you. There are no other pixels and no non-essential cookies, so there is no cookie banner.

You can sign in on the website with the same account as the app, using an email address and password, a one-time link, Google or Apple, and you can delete your account there. Signing in stores a session in your browser. That is functional storage, not tracking, and it is cleared when you sign out.

Catalogue pages load data straight from our database, so your browser’s IP address reaches our database provider in the EU. Some product photographs are served from the Swedish retail catalogue’s own image server rather than from us, so your IP address reaches that server too.

Fonts on this website are served by Google Fonts, which means your browser requests the font files from Google’s servers and Google receives your IP address as part of that request. No font cookies are set. The app does not load fonts over the network; they ship inside it.

10. Who processes your data

We do not sell your data, we do not rent it, and we do not share it with data brokers. None of the providers above is an advertising network, and we do not use any of them for advertising. We are describing our own configuration and our contracts with them, not making a promise on their behalf about their other business.

There is no advertising in the app, no advertising identifier, and nothing that Apple defines as tracking, so the app does not show the tracking permission prompt.

11. Lawful basis for each purpose

• Performance of a contract, Article 6(1)(b): creating and holding your account, storing your shelf, pours, notes, shopping list and accessories, running a label scan or a barcode lookup you asked for, and managing a subscription you bought. Without this there is no service to provide.
• Consent, Article 6(1)(a): usage analytics, and nothing else. Off by default, withdrawable at any time in Profile, and withdrawal does not affect what was processed before.
• Legitimate interests, Article 6(1)(f): crash and error reporting, so the app keeps working; the scan ledger, so the free allowance can be counted and not circumvented; the shared barcode table, so a lookup that works for one person works for the next; and aggregate website analytics.

Giving us this data is not a statutory requirement. It is what the app needs in order to be a shelf: without an account there is nowhere to put a bottle.

There is no automated decision-making that produces legal or similarly significant effects, and no profiling. The label reading is a machine guess that fills a form, and you review and edit every field before anything is saved.

12. How long we keep things

• Your account and your shelf: until you delete it. There is no expiry and no automatic clear-out.
• Anonymous accounts: the same, indefinitely. We do not run any job that removes an abandoned anonymous account. If you delete the app without ever signing in, the record stays in our database and there is no way for you or for us to get back to it.
• Scan ledger rows: for the life of the account, because the free allowance is a lifetime one and counting it needs the rows. They go when the sign-in record goes. If your sign-in survives because you hold data in another Shelf app, the ledger survives with it.
• Data export files: pressing Export writes a file to private storage and gives you a link that expires after seven days. The link expires; the file does not. Nothing deletes it today. It contains your email address, your account identifier, your sign-in timestamps, your whole shelf, every pour with its notes, your shopping list and your accessories. If you want an export file removed, write to us and we will remove it.
• Barcode contributions: deleted when you delete your account.
• Crash reports: kept by Sentry on the standard retention schedule for our plan and then deleted automatically. Reports are not filed under your account, so there is no reliable way to find yours and delete it on request. If you tell us roughly when a crash happened we will look and remove what we can find.
• Analytics already sent to Mixpanel: deleting your account does not delete them, because we do not run a Mixpanel deletion step today. They are keyed to your account identifier. Ask us and we will delete them by hand.
• Your RevenueCat record: the subscriber record keyed to your account identifier stays with RevenueCat after you delete your account. Ask us and we will remove it.
• Backups: deleted rows can remain in our database provider’s routine backups for a short period until those backups age out.

13. Your rights under the GDPR

You have the right to access your data, to rectification of anything inaccurate, to erasure, to restriction of processing, to object to processing based on legitimate interests, to portability, and to withdraw consent at any time.

Three of these are buttons rather than emails, and using the button is faster than writing to us:

• Access and portability: Profile, then Data, then Export your data. It produces a JSON file containing your account details, your whole shared bottle inventory rather than only the whiskey part of it, your bottle details, your pours, your shopping list and your accessories, and it gives you a link to download it.
• Erasure: Profile, then Delete account. See section 14.
• Withdrawing consent: Profile, then Data, then the Usage data switch.

For anything else, write to hello@mywhiskeyshelf.com from the address on the account. We will respond within one month, and it is free of charge. If we cannot identify you from what you send us, we may have to ask for more before we can act.

You also have the right to complain to a supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY), imy.se. You can also complain to the authority where you live.

14. Deleting your account

You can do it yourself. In the app: Profile, then Delete account, then confirm twice. On this website: sign in and delete from your account page. No email and no asking us first. The account deletion page sets out the steps.

What is removed: your bottles, from the inventory shared with My Bar Shelf, so they disappear from there as well; your bottle details, including purchase price, place and storage location; your pours and every tasting note on them; your shopping list; your accessories; the photographs you saved; your barcode contributions; and your profile record, including your analytics consent setting. That consent row is the one shared with My Bar Shelf, My Wine Shelf, My Beer Shelf and My Cigar Shelf, so removing it here removes your recorded answer for those as well, and any of them will ask you again.

What may stay. Your sign-in record is only deleted if the account holds no data in the other Shelf apps. If you also use My Coffee Shelf, My Wine Shelf, My Cigar Shelf, My Beer Shelf or My Supply Shelf, the sign-in stays and only the data listed above is removed, so that those apps keep working. Delete your data there first if you want the sign-in gone, or write to us and we will do it.

Removing the saved photograph files is best effort: they are deleted after the records that point at them, and if that step fails it is logged and the deletion still completes. If you want confirmation that a photograph is gone, write to us.

Section 12 lists the three things that survive a deletion: export files, analytics already sent, and your RevenueCat record. Ask and we will remove them by hand.

If you have an active subscription, deleting your account does not cancel it. Cancel it in your App Store account settings or your Google Play subscriptions first, or the store will keep billing you.

Deletion is permanent. We cannot restore it afterwards.

15. International transfers

Our database, sign-in, file storage, server functions, crash reporting and analytics are hosted in the European Union: the database and storage in Frankfurt, crash reporting in Germany, analytics on Mixpanel’s EU service. Two of the barcode databases are in France and one is in Norway, inside the EEA.

These leave the EEA:

• Google receives label photographs, at a general endpoint we have not pinned to a European region.
• RevenueCat, in the United States, receives your account identifier and your subscription state.
• UPCitemdb and Brocade, in the United States, receive a barcode and your device’s IP address.
• Vercel, a United States company, hosts this website.
• Apple and Google handle distribution, payment and, if you use them, sign-in.

For these we rely on the European Commission’s standard contractual clauses, which form part of the data processing terms these providers publish, together with the safeguards described in those terms.

16. Age

My Whiskey Shelf concerns collections of alcoholic spirits and is intended solely for adults of legal drinking age in their country of residence. When you create an account the app asks you to confirm that you are. It is not directed at children, and we do not knowingly collect data from anyone below that age. If you believe a minor has given us data, write to us and we will delete it.

17. Changes to this policy

If we make material changes we will publish the updated version here and update the version number and effective date at the top of this page. If a change materially affects data we already hold about you, we will tell you before it takes effect.

Version 2.1, 1 September 2026, corrected four claims in version 2.0. Each of them said something was uniform across the Shelf apps when it is not, and each was written from the shape of the portfolio rather than from what we had checked:

• “Three things are set once and apply to every Shelf app you use with the same account.” Three different scopes in one sentence. Section 3 now lists them separately and names the apps each one reaches.
• “Five AI scans in total, shared across every Shelf app you use.” The five are counted once on your account, in a ledger the check does not filter by app, so a scan from any Shelf app comes off the same five. Not every Shelf app meters its AI features this way. Section 4.
• “A single setting that covers every Shelf app you use with the same account.” It covers five: My Bar Shelf, My Whiskey Shelf, My Wine Shelf, My Beer Shelf and My Cigar Shelf, which share one row on your account. My Coffee Shelf keeps its own answer in its own table and cannot see this one. My Supply Shelf sends no analytics at all. Section 6, and the wording on the switch inside the app is being corrected too.
• “One subscription covers every Shelf app on the same account.” True of the bundle subscription and not of a single-app one, which unlocks only the app it was bought for and is what most current subscribers hold. Section 8.

This policy was the reference the other Shelf policies were corrected against in the passes before this one, and it was left unedited on that basis. It carried the same errors. That is recorded here rather than quietly fixed.

Version 2.0, 31 August 2026, replaced version 1.0 in full. What changed:

• Removed the statement that the app contains no analytics and no third-party trackers. It ships Mixpanel, behind a consent switch. Now section 6.
• Removed the statement that the app has no subscription and no in-app purchase. Now section 8.
• Removed the description of photographs as attachments that never leave the device. Label photographs are sent to our server and on to Google. Now section 4, with the public storage address and the scan allowance stated.
• Removed the entire interest-list section and its table. There is no interest-list form on this site and no entries are held.
• Removed the statement that deletion happens by writing to us. It is a button in the app and on the site. Now section 14.
• Removed the statement that orphaned anonymous accounts are cleared up in routine maintenance. No such job exists. Now stated as indefinite in section 12.
• Removed the promise that we would update this policy before adding analytics or a subscription. We did not, and repeating the promise would not be worth anything.
• Added: barcode lookups leaving the device, the shared barcode table and the contributor identifier on it, the bottle inventory shared with My Bar Shelf, the limit on what a crash report contains, the approximate location Mixpanel derives, the processor table, the transfers out of the EEA, and the three things that survive an account deletion.

18. Contact

Questions or concerns about your privacy? Write to hello@mywhiskeyshelf.com.

Nisshagen Advisory AB, Stockholm, Sweden.