eSomme
Menu

Legal

Privacy Policy

This policy explains what information eSomme handles, why we handle it, who processes it, how long it is retained, and the choices available to you.

Effective September 10, 2026

1. Scope

This Privacy Policy explains how eSomme (“eSomme,” “we,” “us,” or “our”) collects, uses, shares, and retains information when you use the eSomme iOS application, the eSomme website, and related support services (collectively, the “Service”).

2. Information we collect

Account and authentication information

When you create or use an account, we process your email address, an account identifier, and information your selected sign-in provider sends to complete authentication. You may also provide a display name. Sign-in is offered through Apple or Google and is handled through our self-hosted authentication service.

Profile information

You may choose to provide a birth year, country, state or region, gender, and wine-experience level. Country and state or region are selected manually; eSomme does not request access to your device's precise location.

Wine and tasting information

The Service lets you create wine reviews and a palate profile. This information may include wine name, producer, vintage, varietal, region, wine type, tasting date, price, ratings, aromas, descriptors, tasting notes, slider values, and other wine preferences. Reviews associated with your account may be synchronized with our servers. Your palate profile is stored on your device but may be sent for AI processing when you grant AI permission and request an AI feature.

App and installation identifiers

eSomme creates a random installation identifier to support reliable account synchronization. It is not an advertising identifier, is not used to track you across other companies' apps or websites, and is rotated after account deletion.

Subscription information

If you purchase a subscription, Apple handles payment and payment-card information. eSomme receives and stores only the subscription information needed to verify and provide your entitlement, such as product and transaction identifiers, purchase and expiration dates, subscription status, and Apple-signed transaction evidence.

AI feature information

AI features are disabled until you grant permission through the in-app AI disclosure. When you request an AI write-up, insight, recommendation, or pairing, the Service may send the information needed for that request to our AI Gateway and OpenAI. Depending on the feature, this may include wine preferences, palate information, tasting-history summaries, ratings, tasting notes, dish or regional hints, and other text you submit for the request.

The eSomme AI Gateway does not retain prompt text, response text, tasting payloads, free-form request hints, review identifiers, or detailed exception messages in its operational log. It records limited operational information, including your account identifier, the requested feature, model, request and response character counts, token counts when available, response status, latency, and limited fixed-format service metadata.

Generated AI results may be stored on your device. AI-generated content can be inaccurate and should be evaluated using your own judgment.

Support and service information

If you contact us, we receive the information in your communication and the contact information you use. When your device communicates with the Service, network information such as an IP address is necessarily received and may appear in short-lived infrastructure or security logs. We use limited service measurements to operate, secure, diagnose, and improve reliability. The current app does not include a third-party advertising, cross-app tracking, or crash analytics SDK.

3. How we use information

We use information to:

  • create and authenticate your account;
  • synchronize and display your profile and wine reviews;
  • personalize tasting insights, recommendations, and pairings;
  • process AI requests you initiate after granting permission;
  • verify subscriptions and provide paid features;
  • enforce usage limits and prevent fraud, abuse, or security incidents;
  • operate, maintain, troubleshoot, and improve the Service;
  • respond to support requests; and
  • comply with applicable legal obligations and protect our rights and users.

4. How we share information

We do not sell your personal information. We do not use it for third-party advertising or tracking across other companies' apps or websites.

We disclose information only as needed for the Service, including to:

  • Infrastructure and database services. eSomme uses self-hosted Supabase components and VPS infrastructure to authenticate accounts, synchronize data, run the AI Gateway, and operate the Service.
  • Authentication providers. Apple or Google processes information when you choose its sign-in service.
  • OpenAI. After you grant permission and initiate an AI feature, OpenAI processes the request information needed to generate the result. OpenAI states that data sent through its API is not used to train or improve its models unless the API customer explicitly opts in. OpenAI also states that its default abuse-monitoring logs may retain API content for up to 30 days, with limited exceptions for legal or abuse-prevention needs. More information is available in OpenAI's API data controls.
  • Apple. Apple processes App Store purchases and provides eSomme with the transaction evidence needed to verify subscription access.

We may also disclose information if required by law; to protect the rights, safety, and security of eSomme, our users, or others; or as part of a merger, financing, acquisition, or sale of assets, subject to appropriate protections. Service providers are permitted to process information only for their assigned role and subject to applicable agreements and law.

5. Retention

We retain account, profile, synchronized wine-review, and subscription records while your account is active and as needed to provide the Service.

  • User-linked eSomme AI Gateway operational logs are automatically deleted after 30 days.
  • Daily AI usage aggregates are retained for up to 25 months. These aggregates contain no user, account, device, request, or review identifiers and cannot be used to recover prompt or response content.
  • OpenAI applies its own retention practices to API processing, as described above and in its API data controls.
  • Support, infrastructure, security, legal, and backup records are retained only for as long as reasonably necessary for their purpose and normal backup rotation, subject to applicable law.

6. Your choices and controls

You may edit supported profile information in the app. You can withdraw AI permission from the Account screen at any time. Withdrawal blocks future AI requests unless you grant permission again; it does not undo processing that already occurred.

You can delete your account in the app by opening Account and choosing Delete Account. Account deletion removes the account and associated user-linked profile, review, entitlement, subscription, and AI operational-log records from the active Service, subject to narrow legal, security, and backup retention needs. De-identified aggregate statistics may remain because they are not linked to an account and cannot be used to reconstruct your content. Learn more on our account deletion page.

Deleting your eSomme account does not cancel a subscription managed by Apple. You can manage or cancel that subscription in your Apple account settings.

For assistance with a privacy request or account deletion, contact support@esomme.com. We may need to verify your identity before completing a request. Depending on where you live, you may also have rights to access, correct, delete, restrict, or receive a copy of certain personal information, or to object to particular processing.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted network connections, access controls, database row-level security, restricted server credentials, and data-minimized operational logging. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

8. International processing

The Service and its providers may process information in countries other than the country where you live. Where required, we use safeguards intended to protect information in accordance with applicable law.

9. Children

The Service is intended for people who are legally permitted to consume alcohol in their jurisdiction and is not directed to children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy as the Service or applicable requirements change. We will post the updated policy and revise the effective date. If a change materially affects how we use information, we will provide additional notice when required.

11. Contact

Questions or privacy requests may be sent to support@esomme.com.