Privacy Policy
Last updated: October 1, 2026
1. Who we are
Vino.cy, Cyprus (“we”), operates vino.cy and the Vino.cy mobile app, including registration on the website and the Wine Club. Contact for privacy questions: webmaster@vino.cy.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account data: username, e-mail, first and last name, password (stored as a hash) | To create and run your account | Contract |
| Check-in data: when you tap “Check in” we receive your precise location, its accuracy, whether the phone reports a simulated (mock) location, your platform and app version, the time, and a salted hash of your IP address | To confirm you are at the winery, award corks and keep the leaderboard and rewards fair | Contract; legitimate interest (fraud prevention) |
| Activity: corks, achievements, Wine Passport entries (wine, rating, note), reviews, saved routes, leaderboard position | To provide the game and the routes features | Contract |
| Reward requests: name, phone, delivery note | To hand over the prize you requested; shared with the partner winery that delivers it | Contract |
| Device data: a random install ID, push token, platform, app version, language | To send notifications you agreed to and to keep the app working | Consent (push); legitimate interest (service) |
| Recommendations and route planning: a taste profile computed on our server from your own Wine Passport ratings (grapes and styles you rate high or low), and — only when you choose “near me” or “start from my location” — your current position, used for that one request and not stored | To suggest wines and wineries and to plan a day route (opening hours, driving time); no third party receives this data and there is no advertising profiling | Contract; consent (location) |
| Onboarding and reminders: your answer to “white / red / not sure” and an on/off choice for reminders; reminders are sent by e-mail or push notification (at most 2 per week, 10:00–20:00 local time) and are based on your passport, saved routes and — for friends’ places — your friends who share their activity | To personalise first suggestions and to remind you about places and wines you may like; you can switch reminders off in My Cellar at any time; no third party receives this data | Consent; legitimate interest |
| Visit notes: the short text you may write after a check-in (“what did you like?”), stored with the winery and the date | To thank you with corks and to give the team feedback about wineries; visible only to the Vino.cy team, never published unless you post it yourself as a review; deleted when you delete your account | Consent |
| Friends and groups: a personal invitation code, your friendships, membership in route groups, and your progress on a shared route | To let you compare corks with friends, see a friends activity feed and walk a route together; friends see your public name, grade, corks, check-ins (winery name, not coordinates), finished routes, achievements and approved photos unless you switch “Show my activity to friends” off | Contract |
| Photos you choose to upload (camera or gallery), with winery, optional caption and time. Photos are re-encoded on our server (size reduced, camera metadata incl. GPS removed) | Wine Passport / check-in photos, reviewed by us before friends can see them; approved photos earn corks | Contract; consent (you choose to upload); legitimate interest (moderation) |
| E-mail notifications about achievements and ranking | To keep you informed; you can switch them off in My Cellar or with the link in any e-mail | Consent / legitimate interest |
3. Location, in plain words
- Your location is sent to us only when you tap Check in.
- If you turn on nearby-winery alerts, your phone compares its position with a list of wineries on the device and shows a notification when you are close. This position is not sent to us and is not stored. You can turn this off at any time in your phone's settings.
- We do not build movement profiles and do not sell or share location data with advertisers.
4. Who receives data
- Your friends and group members (people who accepted your invitation): as described above. Group members see each other's first name, initial and progress on the shared route.
- Partner wineries: only the details of a reward you request (name, phone, delivery note).
- Service providers: hosting; e-mail delivery; Google Firebase Cloud Messaging and Apple Push Notification service to deliver push messages (they receive your push token and message content); translation service (DeepL) that receives the text of a public review to show it in another language; map/routing services used by the route builder receive stop coordinates of the route you build, not your live position.
- Authorities if required by law.
We do not sell personal data. The app contains no advertising or analytics SDKs.
5. International transfers
Push delivery through Google/Apple can involve processing outside the EEA under the providers' standard contractual safeguards.
6. Retention
We keep your data while your account exists. When you delete your account (My Cellar → Delete my account) we delete your profile, check-ins, corks, achievements, passport, photos (files and records), friendships, group memberships, saved routes and registered devices; reward records that we must keep for the winery are retained without your name, phone or address. Server logs are kept for a limited period needed for security and troubleshooting.
7. Your rights
You can access, correct, export and delete your data, object to processing, withdraw consent, and complain to the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy). Write to webmaster@vino.cy; in-app deletion is immediate.
8. Photos and community rules
Upload only pictures you took yourself of wine, bottles, glasses, food or the view at a winery. Do not upload pictures of other people without their consent, minors, nudity, advertising or anything unlawful. Every photo is reviewed by us before friends see it; we may reject or remove photos and suspend accounts that break these rules. Friends can report a photo, you can block a person and you can delete your photos at any time. Report problems to webmaster@vino.cy.
9. Children and alcohol
The service is for adults (18+) because it concerns alcohol. We do not knowingly collect data from minors.
10. Security
HTTPS everywhere, hashed passwords, rate limits and fraud checks. No system is perfectly secure.
11. Changes
We will post updates here and, for material changes, notify you in the app or by e-mail.