Legal information

Privacy policy

Last updated: [publication date]

Excessive drinking is dangerous to your health. Please drink responsibly.

Grena is an app for managing your wine cellar: organizing your bottles, scanning their labels, logging your tastings, and finding food pairings. This policy explains what data we process, why, for how long, with whom, and how to exercise your rights.

We built Grena to collect as little as possible: no password, no advertising, no usage analytics without your consent, no resale of data.

1. Who is responsible for your data

The data controller is Géraldine Puel EI, registered with the Béziers Trade and Companies Register (RCS) under number 800 989 162, with its registered office at 18 impasse Mauduit, 34500 Béziers (“Grena,” “we”).

Contact for any questions about your data: hello@grena.app.

2. The data we process

2.1 Your account

When you first open the app, Grena creates a guest account without asking you for anything: a random technical identifier, with no name or email. A guest account is not backed up on our servers: your cellar stays only on your phone.

If you create an account, we record:

your email address, which is used to identify you and to send you a sign-in code;
your account’s technical identifier;
the app language (French or English), so we can write to you in your language;
the dates of creation and last sign-in.

There is no password.

Bot check. To stop bots from creating accounts in bulk, creating a guest account and requesting a sign-in code go through Turnstile, by Cloudflare. A verification page, usually invisible, opens in the app: Cloudflare receives the phone’s IP address and technical information about the device and the browser built into the app, which it analyzes to tell a person from a bot. If in doubt, the app asks you to tick a box. We only receive a token saying whether the check succeeded.

2.2 Your profile

What you choose to provide: your first name, your last name, your country, the currency of your purchase prices, your default cellar, your notification preferences, and the list of alerts you have read or hidden.

2.3 Your cellar

What you enter in the app:

your cellars (name, storage type, dimensions);
the wines in your cellar, the number of bottles, their location, the date they were stored and, if you provide them, the purchase price and the origin (bought, and where; a gift, and from whom; or other);
bottles going in and out (drunk, given away, removed), for your statistics;
your wishlist (wines to buy), with the place, the context, and your comments;
your tasting notes: rating, date, occasion, dish, comment, and the guided tasting (color, aromas, structure).

This data is stored on your phone. If you have created an account, it is also synced to our servers (see Section 2.6).

Your comments and details (place of purchase, first name of the person who gave you a bottle) are free text: we recommend that you do not write sensitive information about yourself or other people in them (health, opinions…).

2.4 Label scanning and photographs

To recognize a wine, you take a photo of its label or choose a photo from your photo library.

The photo is analyzed on your phone: the operating system’s built-in text recognition (Apple Vision on iPhone, ML Kit on Android) reads the text, and an image recognition model installed in the app computes a visual fingerprint of the label, a series of numbers that describes its appearance and cannot be used to reconstruct the photo. The photo is not sent to Grena and we do not keep it, unless you choose to send it to us (see below). It remains a temporary app file, which the operating system deletes.
Only the text read from the label (name of the estate, the cuvée, appellation, vintage…) and this fingerprint are sent to our server to look up the wine in the Grena database. They are not kept after the search and are not linked to your identity.
The image recognition model (about 176 MB) is downloaded once, automatically over Wi-Fi or when you request it in Profile. [Before publication: it will be hosted by Grena. During development, it is downloaded from Hugging Face, which then receives the phone’s IP address, as with any download.]
The number of scans in the current month is counted on your phone, for the free plan’s limit.

Linking your hand-entered wines to the database. After you import a cellar (CSV file), or when you tap “Link to the database” on a wine’s page, the app sends our server, for each wine, the producer, the cuvée, the appellation, the vintage and the colour, to look it up in the Grena database. This information is not kept after the search and is not linked to your identity. When the wine is in the database but not in your vintage, we only record that wine and that year, with the number of requests, so we can add the vintage to the database: with no link to your account.

Wine suggestions. To suggest wines (“You’ll also like” on the home screen, similar wines on a wine’s page), the app sends our server references to wines in the Grena database: the wines you loved (a rating of 4 or 5, a “Loved it” or a “Very good” in your wishlist, a wine bought again after drinking it), each with a weight; the wines to avoid (a rating of 1 or 2, or “Not for me”); the wines in your cellar and wishlist, so they are not suggested to you; the country in your profile; and a value made of today’s date and an identifier drawn at random on your phone, which makes the suggestions change from one day to the next. Your ratings themselves, your comments and your prices are not sent. This information is used for the calculation, is not kept afterwards, and is not linked to your identity. Like every request from the app, it leaves a trace in our host’s technical logs (time, account), kept for a few days (see § 5), without the wines sent. Your “Not for me” choices and the day’s suggestions stay on your phone and are not synced.

Labels you choose to send us. When the scanner does not recognize a wine, the app offers to send us the photo of the label so that we can add the wine to the database. Nothing is sent unless you act: you tap “Send the label to Grena,” or you turn on “Send the label so we can identify this wine” before saving a wine entry you filled in manually. We then receive the photo, downsized and stripped of its metadata (including GPS location), the text read from the label, its fingerprint, the wines suggested by the scan, the entry you filled in (producer, cuvée, vintage, appellation, color), the type of phone (iPhone or Android), and the app version. This submission is not linked to your account. These photos are used to expand the Grena database, under the conditions set out in Section 9 of the Terms. They must show only the label: we delete any in which people appear, and those we do not use are deleted no later than 30 days after they are reviewed.

Finding out when your label is recognized. To let you know in the app when we have identified the wine, your phone keeps a list of what you sent: the identifier of each submission (a random number drawn when it is sent) and the wine entry or wish it goes with. This link exists only on your phone: it is not synced with your account, and it is erased when you sign out or delete your account. When you open the app, at most once an hour, the phone asks our server about these identifiers. For each one, the server answers whether it is pending, recognized (with the wine), or could not be identified. We do not record this request: neither the list of identifiers nor the account making it. Like every call from the app, it goes through a connection to your account and leaves a trace in our hosting provider’s technical logs (time, account, IP address), kept for a few days (see Section 5); we do not use them to link a photo to an account. If you answer “This isn’t my wine,” the phone sends us only the submission’s identifier, so that we can check the photo again.

2.5 The camera and photo library

Grena asks for access to the camera only to scan labels, when you open the scanner. Access to the photo library goes through the system picker: Grena sees only the photo you choose, not the rest of your photos.

You can deny or revoke these permissions at any time in your phone’s settings. The rest of the app keeps working, and you can always add a wine manually.

Grena does not access your microphone, your location, or your contacts.

2.6 Syncing

Once you have created an account, each item in your cellar (a cellar, a wine, a stock line, a wishlist item, a note, a bottle going in or out, your profile) is saved on our servers, so that you can find it on another phone or after changing devices. When you delete an item, a record with no content is kept so that your other devices learn of the deletion.

If you sign out, your cellar is erased from the phone and remains in your account.

One phone at a time (free plan). Each phone draws a random identifier the first time the app opens; it says nothing about the device or about you. The identifier of the phone that syncs is saved with your profile, so that on another phone the app knows not to sync until you choose it. With Premium, it is not used.

2.7 Subscriptions and payments

The Premium subscription is purchased through the App Store (Apple) or Google Play (Google). Grena never sees your bank details: payment, billing, and refunds are handled by Apple or Google, under their own policies.

To find out whether your subscription is active, we use a third-party service, which receives from the App Store or Google Play: your Grena account ID, the products purchased, the dates of purchase, renewal, and expiration, the store country, and technical information about the device (operating system, app version). No email address or personal information is transmitted.

2.8 Usage data and technical data

Usage statistics, only with your consent. They are off until you turn them on (Profile › Usage statistics). Once they are on, the app sends our usage analytics tool, PostHog: the screens you view; the app being opened, moved to the background, installed, and updated; your actions in the app (a scan and its number of results, a cellar created or deleted, a bottle added, moved, or taken out, a wishlist item, a tasting note, a dish chosen in pairings, a wine style opened, a wine suggestion dismissed, an alert opened, an export or import of your cellar and its matching with the database (the number of rows, bottles and linked wines, never their content), a wine linked to the database, a label sent, the download of the image recognition model (how long it took, or its failure), an invitation to back up your cellar and your answer, a step in purchasing Premium, a sign-in or sign-out, an app error (its type and the screen, never its message)). Each event carries your account ID (guest or with an email), an identifier drawn at random by PostHog when the app is installed, and the model and version of your phone and of the app.
Your profile in these statistics. It shows your plan (free or Premium, free trial, automatic renewal), whether your account has an email address (without the address itself), the country and currency in your profile, the number of your cellars, bottles, wishlist items, and tastings, the status of the image recognition model on the phone, and the date you first launched the app.
What the statistics never contain: your email, your first name, your photos, the text you type, the names of your wines. Your screen is never recorded. We do not infer your location from your IP address, and the IP address is not kept with the statistics [setting to turn on in PostHog before publication]. These statistics are used only to understand how the app is used and to improve it.
Withdrawing your consent. At any time, in Profile: nothing more is sent afterwards. What has already been sent is kept for the period given in Section 5, unless you ask us to erase it (Section 8). [Before publication: decide whether to ask for consent at first launch.]
No advertising, no tracking. Grena does not include any advertising or cross-app tracking tools. We do not track you from one app to another and do not request Apple’s tracking permission (ATT).
Technical logs. Like any online service, our servers automatically record, for each request, the IP address, the date and time, and the request made. These logs are used to run the service, keep it secure, and fix outages. They are kept for a few days ([exact period depending on the Supabase plan]).
Storage on your phone. The app stores your cellar, your settings, and your session on your phone so that it can work offline, as well as the count of your free scans and the dates when the app offered you Premium (so as not to offer it too often). These last two never leave the phone.
Phone notifications. If you allow it, the app schedules on your phone the reminder that your Premium trial ends in 2 days. The app prepares this reminder itself, without going through our servers or a notification service: no data is sent for it. You can withdraw permission in your phone settings. This storage is strictly necessary for the service: it is not used for advertising or tracking.

2.9 Communications with support

If you write to us, we process your email address, the content of your messages, and anything you choose to send us (screenshots, a description of a problem), in order to reply to you and improve the app.

2.10 Data we do not collect

No password, no bank details, no location, no contacts, no health data, no photos from your photo library other than the one you choose to scan.

3. Why we process your data, and on what basis

Purpose	Data	Legal basis (GDPR)
Creating and managing your account, sending you the sign-in code	Email, ID	Performance of a contract (the Terms)
Running the app: cellar, wishlist, notes, statistics	Profile, cellar	Performance of a contract
Syncing your cellar across your devices	Profile, cellar	Performance of a contract
Recognizing a scanned label	Text read from the label	Performance of a contract
Managing the Premium subscription	Purchase data	Performance of a contract
Measuring app usage to improve the app	Screens and actions, ID, phone model, app profile (plan, country, counts)	Your consent (Profile › Usage statistics)
Securing the service, preventing abuse and fraud	Technical logs, ID	Legitimate interest (protecting the service and its users)
Preventing bots from creating accounts	IP address, technical information about the device (at Cloudflare)	Legitimate interest (protecting the service and its users)
Responding to your requests	Email, messages	Performance of a contract or legitimate interest
Expanding the Grena database with a photo you send us	Label photo	Your consent, given with each submission
Letting you know when a label you sent is recognized	Identifiers of your submissions, kept on your phone	Performance of the contract
Complying with our legal obligations (requests from authorities, disputes)	Depending on the case	Legal obligation

We do not use your data for advertising, profiling, or automated decisions about you. We do not sell or rent your data.

Your data is accessible only to the members of the Grena team who need it, and to the technical service providers below, who act on our behalf and on our instructions (processors within the meaning of the GDPR):

Provider	Role	Data	Place of processing
Supabase	Hosting of the database, accounts, and syncing	Account, profile, cellar, logs	European Union
Resend	Sending sign-in code emails	Email address, code	United States
Cloudflare	Bot check (Turnstile) when a guest account is created and when a code is requested	IP address, technical information about the device and the built-in browser	United States and Cloudflare’s global network
RevenueCat	Subscription tracking	Account ID, purchase data	United States
PostHog	Usage statistics, if you have accepted them	Account ID, screens and actions, model and version of the phone and of the app, app profile (Section 2.8)	European Union (Frankfurt servers)
Apple and Google	App distribution, subscription payment and billing	As set out in their own policies, as data controllers	As set out in their policies

We may also disclose data to the authorities when required by law.

Transfers outside the European Union. Some providers are located in the United States. These transfers are governed by the “EU-U.S. Data Privacy Framework” adequacy decision when the provider participates in it, and otherwise by the European Commission’s standard contractual clauses. You may ask us for a copy of these safeguards.

5. How long we keep it

Data	Retention period
Account with email, profile, and synced cellar	As long as your account exists. Erased when the account is deleted
Guest account never linked to an email	Deleted after [90] days of inactivity
Sync deletion records	[6 months]
Sign-in code	10 minutes, then unusable
Text read from a label	For the duration of the search, not kept
Wines sent for suggestions	For the duration of the calculation, not kept
Technical logs	A few days ([exact period])
Bot check data at Cloudflare	[Period to be checked in Cloudflare’s terms]
Subscription data at RevenueCat	As long as your account exists. Erased when the account is deleted
Usage statistics at PostHog	[Period to be set in PostHog, for example 12 months]
Communications with support	3 years after the last exchange
Label photo you send us	As long as it is used for the Grena database, unless you ask us to remove it
List of the labels you sent (on your phone)	One year after the answer, or until you sign out or delete your account. The status request is not kept on our server
Data needed for a dispute or a legal obligation	For the applicable limitation period

Backups of our database are kept for [7] days: deleted data disappears from the backups at the end of that period.

Data on your phone stays there as long as the app is installed, until you sign out or delete your account.

6. Deleting your account

You can delete your account at any time, in the app: Profile › Delete my account. Before confirming, you can export your cellar in CSV format.

Deletion immediately and permanently erases: your account and your email, your profile, your synced cellar, and your subscription history. The data on the phone is erased too. The app then starts over with a new guest account.

If you had turned on usage statistics, those already sent to PostHog remain there, linked to the former account’s ID, until the end of their retention period (Section 5), unless you ask us to erase them. [Before publication: erase them along with the account.]

Deleting your account does not cancel your subscription: it is billed by Apple or Google and must be canceled in your store settings (see the Terms). The app reminds you of this before deletion.

You can also request deletion by email at hello@grena.app if you no longer have access to the app.

7. The security of your data

All communications between the app and our servers are encrypted (HTTPS / TLS).
Data is also encrypted at our hosting provider.
Each account can read and write only its own data: access rules are enforced by the database itself, not just by the app.
Sign-in uses a one-time code, valid for 10 minutes. Changing your email address requires a code sent to both the old and the new address.
Team access limited to what is strictly necessary.

No system is infallible. In the event of a data breach that poses a risk to you, we will notify the competent authority (in France, the CNIL) within 72 hours and, if the risk is high, we will inform you directly.

On your phone, the protection of your data also depends on the device lock.

8. Your rights

Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

the right of access to your data and to obtain a copy of it;
the right to rectification (most data can be edited directly in the app);
the right to erasure (see Section 6);
the right to restriction of processing;
the right of objection to processing based on our legitimate interest;
the right to data portability: to receive your data in a structured, machine-readable format (the cellar CSV export in the app, or a full export on request);
the right to withdraw your consent at any time, for processing based on it;
the right to set directives regarding what happens to your data after your death (French law, Article 85 of the French Data Protection Act).

To exercise these rights, contact us. We respond as quickly as possible. We may ask you to confirm your identity, for example with a code sent to your account’s email address.

If you believe your rights have not been respected, you can file a complaint with the data protection authority in your country.

9. If you live outside the European Union

We apply the same protection to all our users, wherever they live. Some laws give you additional rights:

United Kingdom (UK GDPR) and Switzerland (nFADP): rights equivalent to those in Section 8.
Canada (PIPEDA) and Quebec (Law 25): you can access your personal information, have it corrected, and withdraw your consent. The person in charge of the protection of personal information at Grena is [name or title], who can be reached at [email address].
United States, in particular California (CCPA / CPRA): we do not sell or “share” your personal information within the meaning of these laws, and we do not use it for targeted advertising. You can request access to your information, its correction, or its deletion, without being discriminated against. The categories collected are those described in Section 2: identifiers (email, account ID), commercial information (subscription), in-app activity data (your cellar), and technical information (IP address).
Australia, New Zealand, Japan, South Africa, and other countries: you can exercise the rights your local law gives you at the same address.

10. Minimum age

Grena is about wine and is intended for adults who are of legal age to purchase and consume alcohol in their country. We do not knowingly collect data about minors. If you believe a minor has provided us with data, write to us: we will delete it.

11. Changes to this policy

We may update this policy, for example if the app changes. The date of the last update appears at the top of the page. In the event of a significant change, we will notify you in the app before it takes effect.

12. The grena.app website

This website presents the app. It has no account and no form.

Cookies and audience measurement. The site sets no audience measurement cookie and loads no tracking tool without your consent. A banner at the bottom right of the screen asks you to accept or refuse them. Your choice is stored on your device (browser local storage) for 6 months if you refuse and 13 months if you accept, after which you are asked again. You can change it at any time with the “Manage cookies” link at the bottom of every page.
If you accept, the site loads Google Tag Manager, which can trigger audience measurement tools. [List of tags and tools triggered, retention period: to be completed.] If you refuse, none of these tools is loaded and no data is sent to them.
Strictly necessary cookies. The site sets none: only your cookie choice is stored, in your browser’s local storage.
Writing to us. If you write to hello@grena.app, we process your email address and your message to reply to you (legitimate interest), and keep them for 3 years after the last exchange.
Hosting. The site is hosted by Cloudflare, which automatically records the IP address and technical data of each visit in its logs, to keep the service running and secure.