Privacy

CRU55 · last updated 9 September 2026

CRU55 keeps a record of the wine in your fridge. This page says exactly what it stores, what it never collects, who else sees any of it, and how to delete the lot.

What is stored

• Your account — the username you chose, an optional display name, and your password, which is stored only as a PBKDF2 hash with a salt unique to you. The password itself is never written down anywhere and cannot be recovered, by us or by anyone else.
• Your email address, if you give one — it is optional, and it exists for one purpose: to send you a link if you forget your password. It is never used for anything else, and clearing the box removes it.
• Your cellar — the fridges you set up and the bottles in them: producer, bottling, vintage, grape, region, country, format, what you paid, what you reckon it is worth, your score, drinking window, pours, whether a bottle was a gift and who from, and your notes.
• Your history — bottles you mark as drunk, and when.
• Label thumbnails — a small image kept with a bottle if you photographed its label.
• Your settings — theme, which view opens first, shelf labels.
• Signed-in devices — for each one, the time it signed in, when that expires, and the browser's user-agent string. The session token itself is stored only as a SHA-256 hash, so a copy of the database does not let anyone sign in as you.
• Notification subscriptions — if you switch on reminders in a browser, the address your browser gives us to deliver them to. Reminders in the iPhone app are different and are described below.
• Password reset requests — a hash of the link's token and when it expires, so a used or stale link cannot be replayed.
• A daily count of how many label reads and value estimates the account has used, so no single account can run the bill up without limit. To slow down someone trying passwords, a hash of the requesting IP address is kept with a counter for the day. The address itself is not stored.

What is never collected

No real name. No phone number. No location. No contacts. No advertising identifiers. No analytics, no tracking pixels, no third-party scripts of any kind. Nothing is sold, rented or shared for marketing, because none of it is gathered in the first place. An email address is asked for only if you want a way back into a forgotten password, and the app works completely without one.

Reminders

Telling you a bottle is ready works two different ways, and they are worth separating.

• In the iPhone app, nothing leaves your phone. A drinking window is a year, known years ahead, so the phone schedules its own reminders from what it already holds. No server is involved and no wine is named to anyone. Switching the setting off cancels every one of them.
• In a browser, a reminder has to be pushed, which means going through your browser's own notification service — Apple's, Google's or Mozilla's, depending on the browser. What we send them carries no content at all: it is an empty nudge that wakes the app up, and the app then reads your cellar itself. Your wine is never named to them.

Photographs and the AI features

Three features send something to Anthropic, who run the Claude model:

• Read the label. The photos you choose are shrunk in your browser and sent to Anthropic to be read. Up to four photos of one bottle can be sent together. A small thumbnail of the first is kept with the bottle; the full-size originals are never stored by CRU55.
• Estimate what it's worth. The producer, bottling, vintage, region, country and format are sent as text. No photograph, and nothing about you.
• What does it taste like. The producer, bottling, vintage, grape, region and country are sent as text, and the note that comes back is cached for everyone, filed under the wine rather than under you.

None of the three sends your username, your notes, what you paid, your score, or anything else about your account.

Market prices

When you ask what a bottle is worth, CRU55 may also look it up with Wine Labs, a wine data company, to see what the market is actually paying. Only the producer, bottling and vintage are sent — the words off the label, nothing about you. What comes back is cached under the wine, so two people with the same bottle share one lookup and neither is identified.

Anthropic's and Wine Labs' handling of what they receive is governed by their own terms and privacy policies. If you would rather nothing left the app at all, do not use those buttons — every field can be typed in by hand, and the rest of CRU55 works without them.

Where it lives

Everything is held in a Cloudflare D1 database and served from Cloudflare Pages. Cloudflare processes the traffic and stores the data on our behalf. Connections are HTTPS only.

Staying signed in

On the web, one cookie, named cellar_session. It holds a random session token, is marked HttpOnly, Secure and SameSite=Lax, and lasts thirty days. It exists solely to keep you signed in. There are no analytics or advertising cookies.

The iPhone app uses no cookies at all. It holds the same kind of session token in the app's own storage and sends it with each request, which is deleted when you sign out or delete the app.

Deleting your data

Open Account → Close account, confirm with your password, and every one of the things listed above is deleted immediately: the account, its email address, fridges, bottles, history, thumbnails, sessions, notification subscriptions and usage counts. Nothing is retained afterwards and there is no separate archive to ask about. Signing out on its own deletes only the session.

The cached wine notes and market prices are not yours to delete and are not deleted with your account, because they are filed under the wine and contain nothing about you — the same note would be there whether or not you ever used CRU55.

Children

CRU55 is about wine and is not directed at children. It is intended for adults of legal drinking age where they live.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions about any of this, or about data held for your account: [email protected].