Privacy Policy

This Privacy Policy explains how Wolf's Whiskey Wall ("we," "us," or "the app") collects, uses, stores, and protects your personal information when you use our service at wolfs-whiskey-wall.vercel.app.

1. Information We Collect

We collect only what is necessary to operate the service:

• Account credentials — username, email address, and password. Your password is hashed with bcrypt before storage and additionally encrypted at rest using AES-256 via a tokenization vault. The plaintext password is never persisted.
• Collection data — whiskey names, quantities, purchase prices, purchase dates, and personal notes you voluntarily enter.
• Session tokens — a JSON Web Token (JWT) is stored in an httpOnly, SameSite=lax cookie to maintain your login session. It expires after 60 minutes of inactivity.
• Audit logs — internal vault access events (token mint, decrypt, rotate) are logged for security purposes. These logs contain no plaintext personal data.

We do not collect payment information, government IDs, or any financial account data.

2. How We Use Your Information

• Authenticate you and maintain your session
• Display and manage your personal whiskey collection
• Calculate portfolio valuations against live market prices
• Detect duplicate catalog entries you submit
• Investigate security incidents via audit logs

We do not use your data for advertising, behavioral profiling, or any purpose beyond operating the app.

3. Data Storage & Security

Data is stored in a PostgreSQL database hosted on Supabase (US region). We employ multiple layers of protection:

• Sensitive fields (user ID, password hash, phone, date of birth) are stored only as encrypted vault references — never as plaintext columns.
• The AES-256 encryption passphrase is never stored in the database; it is injected at runtime via environment variables.
• Row-Level Security (RLS) is enforced at the database level. Application code accesses the vault only through SECURITY DEFINER functions.
• All traffic is served over HTTPS via Vercel's TLS termination.
• Your internal user ID is never returned in any API response.

4. Third-Party Services

We use the following third-party infrastructure providers:

• Vercel — hosting and serverless deployment (Privacy Policy)
• Supabase — managed PostgreSQL database (Privacy Policy)

We do not sell, rent, or share your personal data with any other third parties.

5. Automated Price Scraping

Nightly price data is collected from 13 public-facing online liquor retailers. This scraping process involves no user data — it reads only publicly listed product names and prices. Your collection data is never transmitted to any retailer.

6. Data Retention

Your account and collection data are retained for as long as your account is active. Price history is append-only and retained indefinitely for valuation accuracy. If you request account deletion, all personal data will be removed within 30 days.

7. Your Rights

You have the right to:

• Access — view all data associated with your account via the dashboard
• Correction — update your username, email, or password in Account Settings
• Deletion — request full account and data deletion by emailing joeyrd03@gmail.com
• Portability — request an export of your collection data in JSON format

8. Cookies

We use a single httpOnly session cookie for authentication. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

9. Age Requirement

This app is intended for users aged 21 and older in the United States, or the legal drinking age in your jurisdiction. By registering, you confirm you meet this requirement.

10. Changes to This Policy

We may update this policy as the app evolves. Significant changes will be noted on this page with an updated effective date.

11. Contact

For privacy-related questions or requests: joeyrd03@gmail.com