Privacy Policy
Simena Digital LLC · privacy@therackhouse.app
Last updated: October 21, 2026
Rackhouse is a personal bourbon-collection and tasting-journal app made by Simena Digital LLC ("we," "us," or "our"), a Wyoming limited liability company based in the United States. Rackhouse does not sell alcohol or any other product, and does not connect you to anyone who does — this policy explains what data the app itself collects, why, and how we protect it.
1. Information You Provide
When you use Rackhouse, you may provide the following information:
- Account information: name and email address (via Apple Sign-In), used to identify your account and restore your subscription on a new device.
- Collection data: the shelves, bottles, journal entries, photo moments, and wishlist items you create — names, dates, quantities, prices, ratings, tasting notes, and any other details you choose to record.
- Photos: photos you attach to a bottle, journal entry, or moment. These are uploaded to and stored on our servers, each behind its own hard-to-guess web address. Anyone who has that address can open the photo, so we never index, publish, or share those addresses.
- AI recognition choice: whether you have turned AI label recognition on or off, stored with your account so the same choice applies on every device you sign in on.
- Profile settings: your display name, currency, and timezone.
2. Information Collected Automatically
When you access Rackhouse, we automatically receive:
- IP address and user agent (standard HTTP request data)
- Session tokens for authentication
If crash reporting is enabled for your app version, a technical report (device model, OS version, app version, stack trace) is sent to Sentry when the app crashes or errors, so we can fix the bug. Reports are scrubbed before sending: no email addresses, no IP addresses, no collection or journal content.
We do not run ads in the app and we do not track you across other apps or websites.
3. AI Label Recognition and Your Data
AI label recognition is optional. Rackhouse asks before the first scan, you can add bottles manually without it, and you can turn it on or off at any time in Settings.
When AI recognition is on and you scan a bottle label, the photo is sent to our server and on to OpenAI's GPT models, which suggest a brand and expression. Our server does not save the scan photo; it is used only to process that request. We keep a record of the scan itself (which model was used, the suggestions it returned, how long it took, and its cost) so we can operate the feature responsibly and enforce the daily scan limit, but that record does not include the image. OpenAI processes the photo under its own API data policies; see OpenAI's API data controls for details.
Turning AI recognition off stops new scans from being sent. It cannot recall a scan that was already sent.
4. How We Use Your Information
We use your information to:
- Provide and sync your shelves, collection, journal, and wishlist across devices
- Authenticate your account and keep it secure
- Restore your subscription on a new device via your Apple ID
- Run AI label recognition, when you have turned it on, and enforce its daily scan limit
- Deliver optional local reminders to look back over your shelf and tasting journal
- Enforce subscription entitlements and prevent abuse of introductory pricing
5. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Apple | Authentication (Sign in with Apple) | Name, email |
| OpenAI (GPT models) | AI label recognition, only when you have turned it on | The scan photo, for that single request (see §3) |
| RevenueCat | Subscription management and entitlement enforcement | Anonymous user ID and purchase history |
| Sentry | Crash and error reporting (if enabled for your app version) | Technical crash reports (device model, OS version, stack trace) — scrubbed of email, IP address, and all collection content |
All third-party service providers listed above are contractually required to protect your data to a standard equivalent to or greater than described in this policy.
We do not sell your personal data, and we do not share your collection, journal, or wishlist content with anyone except as described above.
6. Data Storage and Security
Your account record, collection data, and uploaded photos are stored on secure servers in the European Union (Germany), hosted by Hetzner Online GmbH. Communication between the app and our servers uses HTTPS (TLS 1.2+), and authentication uses timing-safe token comparison to prevent timing attacks.
On your device, Rackhouse stores data using:
- AsyncStorage: preferences and app settings
- expo-sqlite: an offline cache of your collection for fast, offline browsing
- expo-secure-store: authentication tokens (encrypted by the OS keychain)
7. Data Retention and Deletion
Your data is retained as long as your account is active. You can delete your account at any time from Settings within the app. Deletion is soft-applied immediately — your active session is ended and your Apple refresh token is revoked — and finalized after 30 days. During this 30-day grace window you may restore the account by signing in again with the same Apple ID. After 30 days, your account, shelves, collection, journal entries, moments, wishlist, and uploaded photos are permanently and irreversibly removed from our servers.
Data held by third-party services (e.g. RevenueCat purchase records, Apple account data) is subject to those services' own retention policies.
8. International Data Transfers
Simena Digital LLC is a U.S. (Wyoming) company, but your account data and user content are stored on servers in the European Union (Germany) — see §6 — regardless of where you are. Some processing occurs in the United States by the service providers named in §5: Apple (sign-in and subscriptions), OpenAI (AI label recognition), RevenueCat (subscription management), and Sentry (crash diagnostics, if enabled). When your data is transferred to these providers, it is protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR and UK GDPR.
9. Legal Basis for Processing (GDPR / UK GDPR)
If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:
- Contract performance: to provide the Rackhouse service you signed up for, including account management, collection sync, and subscription entitlement.
- Consent: for optional features that require your explicit opt-in, including AI label recognition, camera and photo-library access, and local notifications.
- Legitimate interest: for service security and fraud prevention (e.g., preventing abuse of introductory pricing or the daily scan limit).
You may withdraw consent for consent-based processing at any time by turning off the relevant feature (AI recognition can be turned off in Settings) or contacting us at privacy@therackhouse.app.
10. Your Rights Under GDPR / UK GDPR
If you are in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
- Access: request a copy of the data we hold about you
- Rectification: correct inaccurate personal data
- Erasure: delete your account and all associated data
- Portability: receive your data in a machine-readable format
- Restriction: limit how we process your data
- Object: object to processing of your data
- Withdraw consent: withdraw consent at any time where processing is based on consent
- Lodge a complaint: file a complaint with your local data protection authority if you believe your data has been mishandled
To exercise any of these rights, email us at privacy@therackhouse.app. You can also delete your account directly in the app under Settings. We will respond to requests within 30 days.
11. Notifications
Rackhouse uses local notifications only — optional reminders to log what's new on your shelf or to look back over your tasting journal. No push notification tokens are sent to our servers. All notification scheduling happens on your device.
12. Camera and Photos
Rackhouse requests camera access to scan bottle labels and photograph your bottles, and photo library access to add existing photos to your collection. Photos you attach to a bottle, journal entry, or moment are uploaded to our servers as described in §1 and §6. You can remove a photo at any time by editing or deleting the entry it belongs to.
13. Children's Privacy
Rackhouse is not directed at children and requires users to be at least 21 years old (see our Terms of Service). We do not knowingly collect personal information from children under 13 (or 16 in the EEA). If you believe a child has provided us with personal data, please contact us at privacy@therackhouse.app and we will delete it promptly.
14. Your Rights by Jurisdiction
In addition to the GDPR and UK GDPR rights described above, the following rights may apply based on your location:
United States (California — CCPA/CPRA): California residents have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell your personal information. To exercise your rights, contact us at privacy@therackhouse.app.
Canada (PIPEDA): Canadian users have the right to access, correct, and request deletion of their personal data. We only collect personal information for purposes that a reasonable person would consider appropriate. Contact us at privacy@therackhouse.app to exercise your rights.
Australia (Privacy Act 1988): Australian users may access and correct their personal data under the Australian Privacy Principles. If you believe we have breached the APPs, you may lodge a complaint with us at privacy@therackhouse.app or with the Office of the Australian Information Commissioner (OAIC).
Japan (APPI): Japanese users have the right to request disclosure, correction, and deletion of their personal data. We handle personal information in accordance with the Act on the Protection of Personal Information. Contact us at privacy@therackhouse.app.
South Korea (PIPA): Korean users have the right to access, correct, delete, and suspend processing of their personal data under the Personal Information Protection Act. Contact us at privacy@therackhouse.app to exercise your rights.
For all jurisdictions: regardless of where you are located, you can delete your account and all associated data at any time from Settings within the app.
15. Changes to This Policy
We may update this privacy policy from time to time. If we make material changes, we will notify you through the app or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.
16. Contact Us
If you have questions, concerns, or requests regarding this privacy policy or your personal data, contact us at:
Simena Digital LLC
1021 E Lincolnway, Suite 9026
Cheyenne, WY 82001, United States
Email: privacy@therackhouse.app