AgaveNomad

Privacy Policy

AgaveNomad ("we", "us") is a personal collection app for agave-spirit enthusiasts. This policy explains what we collect, why, how it's stored, and the choices you have. We aim to collect as little as possible.

1. Information we collect

Account information

When you sign up, we collect your email address and a password (stored only as a secure hash by our authentication provider — we never see your plaintext password). Authentication is handled by Supabase Auth.

Collection data you create

The content you add to your vault, including: bottle names, brands, NOM/distillery references, quantities, prices you enter, ratings and tasting notes, wishlist items, and any photos you upload. This is data you choose to provide.

Technical data

We use privacy-respecting Cloudflare Web Analytics, which does not use cookies and does not fingerprint or track individuals across sites. Standard server logs may briefly record IP addresses for security and abuse prevention.

We do not collect location data. Photos you upload are automatically re-encoded in your browser before they leave your device, which strips embedded metadata (including GPS/EXIF).

2. How we use your information

• To provide the core service: storing and syncing your collection across your devices.
• To authenticate you and keep your account secure.
• To send essential account emails (such as email confirmation and password resets).
• To detect and prevent abuse, and to keep the service reliable.

We do not sell or rent your personal information, and we do not use it for advertising.

3. Where your data is stored

• On your device first (offline-first), in your browser's local storage.
• Cloudflare D1 (database) and Cloudflare R2 (photo storage) when you sign in and sync. Data is transmitted over encrypted HTTPS connections.
• Supabase stores only your authentication record (email + hashed password).

4. Sharing & third parties

We share data only with the infrastructure providers that operate the service on our behalf:

• Cloudflare — hosting, database, photo storage, and analytics.
• Supabase — authentication.

These providers process data solely to deliver the service. We do not share your data with advertisers or data brokers.

5. Your rights & choices

• Access & export: download everything we store about you as JSON (Profile → Data → "Export All My Data"), or your bottles as CSV.
• Deletion: permanently delete your account and all associated data (Profile → Danger Zone → "Delete My Account"). This removes your bottles, tastings, wishlist, photos, and your authentication record.
• Use without an account: you can use the app entirely on-device without signing up; in that case no data reaches our servers.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA (access, correction, deletion, portability). The tools above let you exercise the core ones directly; for anything else, contact us.

6. Data retention

We keep your data for as long as your account exists. When you delete your account, your data is removed from our active systems promptly. Residual copies may persist briefly in provider backups before expiring.

7. Children

AgaveNomad concerns alcoholic beverages and is intended for adults of legal drinking age in their jurisdiction. It is not directed to children, and we do not knowingly collect data from anyone under the legal drinking age.

8. Security

We use HTTPS everywhere, scoped access controls so you can only access your own data, a strict Content Security Policy, and rate limiting. No system is perfectly secure, but we work to protect your information and minimize what we hold.

9. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the "Last updated" date above.

10. Contact

Questions about this policy or your data? Reach us at privacy@agavenomad.com.