Privacy Policy

Effective July 31, 2026

MaltMemo is a personal Scotch tasting journal operated by Brett and Tanya Mowat (“we”, “us”) in Alberta, Canada. This policy explains what we collect, why, and the choices you have.

1. Information we collect

Account information

Your name, email address, and password. Passwords are stored only as a salted hash — we never see or store your actual password.

Content you create

The tastings you log (distillery, bottle, notes on nose, palate, and finish, scores, ABV, age, and dates), any bottle photos you upload, the bottles in your cabinet, the flights (dram line-ups) and live tasting sessions you create, your friend connections, and whether you choose to make a tasting publicly shareable.

Live tasting sessions

If you host a live tasting session, we store the session and the ratings its attendees submit. You can join a session as an attendee without an account— in that case we collect the scores and flavour tags you submit for each dram and any display name you choose to enter (a name is optional). To let you revise your own ratings, your browser’s local storage holds a random participant identifier for the session; it isn’t linked to any real-world identity. Your submissions are shown to the host, individually and as group averages. If you later create an account in the same browser, you can choose to import the ratings you submitted into your own journal.

Billing information

Your subscription tier and status, and a customer identifier from our payment processor. We do not collect or store your card details — payments are handled entirely by Stripe.

Technical information

Basic log and device data (IP address, browser type, pages requested), error diagnostics used to fix crashes, rate-limiting metadata used to prevent abuse, and aggregate, cookieless usage analytics (such as page views, referrer, approximate country, and device or browser type) that help us understand how the service is used. When you create an account, we also record how you arrived — the referring site and any campaign tag on the link — so we can tell which channels bring people in.

Cookies

We use a single session cookie to keep you logged in. We do not use advertising or third-party tracking cookies. Our usage analytics (Vercel Analytics) are cookieless — they count page views without setting cookies or building a profile of you. We also use your browser’s local storage (not a cookie) to briefly remember the link you arrived through, so we can attach it to your account if you sign up; and, if you take part in a live tasting session, to hold a random participant identifier and the ratings you submitted so you can revise them and import them if you sign up.

2. How we use your information

• To provide the service — store your journal, authenticate you, and show your data back to you.
• To run live tasting sessions and show hosts the group’s scores and flavours.
• To process subscriptions and payments.
• To send transactional email (verification and password resets).
• To keep the service secure and prevent abuse.
• To diagnose errors and improve the product.

For users in the EU and UK, our legal bases are: performance of our contract with you, our legitimate interests in running and securing the service, your consent where applicable, and compliance with legal obligations.

3. How your information is shared

We do not sell your personal information. We share data only with service providers who help us run MaltMemo, each handling only what their function requires:

• Stripe — payment processing.
• Supabase — database hosting and bottle-photo storage.
• Resend — transactional email delivery.
• Upstash — rate-limiting.
• Sentry — error monitoring.
• Vercel — application hosting and cookieless usage analytics.
• Google Fonts — web-font delivery (receives your IP address to serve fonts).
• CARTO — map tiles for the distillery map (receives your IP address when a map loads).
• Anthropic — powers a few optional AI features. If you use “Scan a label,” the bottle photo you choose is sent to Anthropic’s API to read the label and pre-fill the form. If you use the AI sommelier (Malt Cloud), a summary of your palate — such as your highest-scoring whiskies and flavour tags — is sent to Anthropic’s API, which may run web searches to suggest bottles you might like. If you look up a whisky’s peat level (ppm), the bottle name is sent to Anthropic’s API, which may run web searches to find the figure. Anthropic does not use this data to train its models, and it is not retained beyond processing the request.

We may also disclose information if required by law, or to protect our rights, our users, or the public.

4. Friends and public sharing

If you accept a friend, your recent tasting activity is visible to that friend within the app. If you mark a tasting as public, it becomes viewable by anyone who has its link, including in search-engine results. You control both, and can unshare at any time.

5. Data retention

We keep your information for as long as your account is active. If you ask us to delete your account, we remove your personal data, except where we must retain limited records to comply with legal, tax, or accounting obligations.

6. Your rights and choices

You can:

• Access and update your account information at any time.
• Export your tastings as a CSV file from the Data page in the app.
• Request correction or deletion of your data.
• Withdraw consent or object to certain processing.
• Lodge a complaint with a privacy regulator — in Canada, the Office of the Privacy Commissioner or the Office of the Information and Privacy Commissioner of Alberta; in the EU or UK, your local data protection authority.

To exercise any of these, email privacy@maltmemo.ca.

7. Security

We protect your data with hashed passwords, encrypted connections (HTTPS/HSTS), a strict content-security policy, and access controls. No system is perfectly secure, but we work to keep your information safe and to notify you if a breach affects you.

8. International transfers

Some of our service providers process data outside Canada, including in the United States. Where required, we rely on appropriate safeguards for these transfers.

9. Children

MaltMemo is intended for adults of legal drinking age. We do not knowingly collect information from anyone under the legal drinking age in their jurisdiction (18 in Alberta).

10. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes, notify you in the app or by email.

11. Contact

Brett and Tanya Mowat
Alberta, Canada
privacy@maltmemo.ca

Terms of Service →