Privacy policy

Without a Login

Anyone can see the wines, ratings, comparisons and stock without logging in. Vinsikt then keeps nothing about you on its servers. What is kept is what stays in your browser, and the technical data Cloudflare processes to deliver the site (see below).

Logging in

You need to log in to have a label read, to use Wine for a dish and to link a barcode to a wine. You log in with Google, Apple or a code sent to your email, whichever the Login page offers. Vinsikt has no passwords.

If you log in with Google or Apple, Vinsikt receives the id Google or Apple has for your account, your email address, and your name if you share it. With Google, Vinsikt also receives the address of your profile picture, which it doesn't keep. If you hide your email address with Apple, Vinsikt receives a forwarding address from Apple instead. Vinsikt keeps these with your Login, together with when it was first and last used. Your name is used only to show who is logged in, as initials in the header and in Settings.

If you log in with a code, Vinsikt sends a six-digit code to your email address. For each code, the address is kept with a checksum of the code and of your IP address, never the code or the IP address themselves, when it was sent and how many wrong guesses it has had, so that the code can be checked and nobody can send codes in bulk. These are deleted within about two days. Once you have logged in, the address is kept with your Login.

If you log in with the same confirmed email address in two ways, you get one and the same Login. A forwarding address from Apple, or an address that has not been confirmed, is never joined with any other. With Google, an address is joined only if it is a Gmail address or belongs to a Google Workspace account, since only for those does Google confirm who holds it now.

When you log in, Vinsikt sets the cookie __Host-vinsikt-session, which keeps you logged in on that device. The server keeps only a checksum of it. It ends after 30 days unused, and after a year at the latest. Log out in Settings ends it on that device.

Admins log in through Cloudflare Access, which sets its own cookie for that login.

What is kept with your Login

Each time Vinsikt asks Anthropic to read a label or a dish for you, it saves when, which of the two, and what the reading cost, with your Login, so that it can limit how many readings each person gets a day and what the site spends a month. Never what you asked. These records are kept for 13 months.

If you link a barcode to a wine, the link is saved with your Login, so that it is clear who made it. It is kept until someone links the barcode again. Links made before Vinsikt had its own Logins hold the email address instead.

If you are an admin and confirm or reject which Vivino wine or Munskänkarna review a wine is, your email address is saved with that decision, so that it is clear who made it. It is kept as long as the decision is in use.

If you are logged in, the article numbers of your favourite wines are saved with your Login, so that you have them on all your devices. The legal basis is our agreement with you (the Terms). They are kept until you remove them, delete your Login, or the Login is deleted after 24 months unused.

Nothing else about you is saved on Vinsikt’s servers.

How long, and how to delete your Login

A Login that has not been used for 24 months is deleted, with everything kept with it. Sessions that have ended are deleted too.

You can delete your Login yourself: open Settings and choose Delete my Login. That deletes the Login, what Google, Apple or your email gave it, your saved favourites and all your sessions, and logs you out on every device. The records of what readings cost are kept without the Login until their 13 months are up. Barcodes you linked stay linked, because others use them, but can no longer be tied to you.

What stays in your browser

Your favourite wines, your shopping list, the history of wines you opened (their article numbers, and when and how you opened them), your choice of light or dark mode and whether you closed the tip about installing Vinsikt are kept in your browser’s local storage. They stay in your browser, except that if you are logged in your favourites are also saved with your Login (see above), and logging out removes them from the browser, that the product numbers of your favourites are sent with the request when the Orderable view shows them, and are not kept, that a link you make with Share favourites holds them, that the product numbers on your shopping list are sent to check their stock when you open it, and that the article numbers in your history are sent to fetch those wines when you open it, and are not kept. Clear history removes the history. Clearing your browser’s data removes them all. The site also keeps its own files, and which version of it you have, in your browser, so that it starts quickly, can be installed as an app and reloads when there is a new version. They say nothing about you.

Vinsikt sets only the cookies the site needs to work: syvino-locale, which remembers your language for a year, __Host-vinsikt-session when you log in, __Host-vinsikt-google for up to 10 minutes while you log in with Google, and for admins Cloudflare Access’s own cookie CF_Authorization. That is why Vinsikt does not ask for consent to cookies. Vinsikt uses no analytics, no advertising and no tracking cookies.

If you ask for the nearest store, or for the stores nearest you that have a wine, your browser’s location is used once, in your browser, to find them. It is never sent to Vinsikt or kept.

If you scan a code, your camera is used only while you scan, in your browser. No picture is sent or kept; only the number read from the code is sent to Vinsikt, to find the wine.

If you ask Vinsikt to read a label, the photo you take or pick is made smaller in your browser and sent to Vinsikt, which passes it on to Anthropic to read the wine’s name off it. Vinsikt does not keep the photo; it exists only while it is read. Take the photo of the bottle alone, as anything else in it is sent too.

If you ask for Wine for a dish, what you write, or the photo you pick (made smaller in your browser first), is sent to Vinsikt, which passes it on to Anthropic to read the dish. A recipe link is fetched by Vinsikt, and the recipe on that page is passed on the same way. Vinsikt keeps only what was read about the dish, such as how salty or rich it is, so the same question is answered alike next time; never your text, the link or the photo. Leave out anything personal, as everything you write is sent.

Who else handles your data

Cloudflare hosts the site and runs the admins’ login. Your requests are handled by whichever Cloudflare data centre is nearest you, and the database where what is kept about you is stored is in Western Europe. Like any web host it processes technical data such as your IP address to deliver and protect the site, and Vinsikt’s logs of requests are kept by Cloudflare for a few days. So that nobody can overload the site, Cloudflare counts how many requests each visitor makes a minute, by IP address or Login; the count is forgotten after a minute, and only if someone goes over the limit is the IP address or Login written to the logs. When you ask for a code to your email, Cloudflare Turnstile checks that you are not a robot. Cloudflare also uses that data, as a controller in its own right, to improve Turnstile.

Google and Apple handle your login if you choose them, as controllers in their own right, under their own privacy policies. Resend sends the codes to your email, and receives your address and the code to do so.

Vinsikt asks Systembolaget, Vivino, Munskänkarna and Anthropic about wines. Those requests carry nothing about you, except the label photos you ask Vinsikt to read and the dishes you ask Wine for a dish about, which Anthropic processes under its terms for businesses that use its API: they are deleted within 30 days, unless Anthropic needs them longer to stop misuse or by law, and are not used to train Anthropic’s models. Systembolaget’s bottle photos are fetched by your browser straight from Systembolaget, which then sees your IP address, just as when you visit its website. Links to their websites take you to them, under their own privacy policies.

Cloudflare, Resend and Anthropic are American companies and may process the data in the United States. The transfer rests on the EU’s standard contractual clauses, and for Cloudflare and Resend also on the EU–US Data Privacy Framework. Google and Apple answer for their own transfers, under their own privacy policies.

Why, and your rights

Your Login, what is kept with it and the labels and dishes you ask Vinsikt to read are processed to give you what you ask for (contract). The records of what readings cost, who made a link or a decision, the limits on how often codes are sent and how many requests are made, and the technical data Cloudflare and Systembolaget process, are used on the basis of a legitimate interest: delivering the site with its photos, keeping its costs and misuse down, and knowing who stands behind what others see.

You may ask what is saved about you and get a copy, have it corrected or removed, restrict or object to its use, or get what you have given Vinsikt in a format you can move to another service, by writing to hej@vinsikt.se. You can also delete your Login yourself in Settings. You may also complain to the Swedish Authority for Privacy Protection (IMY).