Bacchus Privacy Policy

Last updated: 19 May 2026
Effective: 19 May 2026

This policy explains how IDENTIDEM LTD ("we", "us") handles personal data in the Bacchus iOS application ("the App"). IDENTIDEM LTD is the data controller for the limited processing described below.

We have designed Bacchus so that, in its default configuration, none of your data ever leaves your device. Anything that does is opt-in, with a separate in-app consent screen at the point of activation.

1. Who we are

  • Controller: IDENTIDEM LTD, Littlemoor Chapel Business Center Unit 8, Gladstone Street, Glossop, SK13 8LX, England, United Kingdom.
  • Contact: security@identidem.design
  • Country of establishment: United Kingdom.

If you are in the UK or EU/EEA, you have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office, https://ico.org.uk).

2. What Bacchus is

Bacchus is a personal cellar app for wine, beer, and spirits. You enter or scan bottles, view your collection, and optionally track what you've opened. All inventory data lives on your device by default.

Label scanning is an assist, not a guarantee. What Bacchus reads depends on the label and the quality of the photo, and results should always be reviewed and corrected before saving.

3. Data processed locally on your device

The App stores the following on-device in the iOS app sandbox (a private container that is not accessible to other apps):

  • Inventory data you enter or import: producer, name, vintage, region, ratings, tasting notes, prices, quantities, drink-window dates, consumption-log entries.
  • Label photos you take with the camera or pick from your photo library.
  • App preferences: which cellar modes are enabled, App Lock state, AI provider choice, web-search preference, consent state.
  • API keys you paste in for Bring-Your-Own-Key cloud recognition. These are stored in the iOS Keychain with the WhenUnlockedThisDeviceOnly accessibility class, which keeps them out of iCloud backups that could be restored to another device.

None of this is transmitted to IDENTIDEM LTD. We have no servers that receive your inventory.

4. Optional iCloud sync

If you sign in to iCloud on your device, the App can use Apple CloudKit to sync your cellar between your own Apple devices and to back it up to your private iCloud account. This processing is performed by Apple under your Apple ID; IDENTIDEM LTD does not have access to it. See Apple's privacy policy: https://www.apple.com/legal/privacy/.

Apple CloudKit data shared with other people via "Share My Collection" remains in your iCloud account and is governed by Apple's terms.

5. Optional cloud-powered label recognition

By default, label scanning runs on your device using Apple's on-device machine learning. No image or text leaves the device.

If — and only if — you enable cloud recognition in Settings → AI Recognition and explicitly grant consent on the disclosure screen we show before any data leaves the device, the App will transmit the following, in order to extract structured information from a label:

  • The photograph of the label you just captured (downscaled JPEG).
  • The text that on-device OCR extracted from that label.

We do not transmit your personal tasting notes, ratings, prices, lists, or any other inventory metadata.

You have two ways to enable cloud recognition:

5.1 Bacchus Pro (default)

If you subscribe to Bacchus Pro, requests are routed through a Cloudflare Workers proxy operated by IDENTIDEM LTD, which in turn calls Anthropic. The proxy authenticates each request with an Apple-signed subscription receipt and does not log inventory content; it retains only short-lived operational logs (request timing, HTTP status, error category) that do not include the photograph or OCR text. Anthropic processes the request under its own privacy policy.

5.2 Bring Your Own Key (advanced)

If you instead paste an Anthropic or OpenAI API key into the Advanced settings, the App calls the chosen provider directly; the proxy is not involved. The provider processes the request under its own privacy policy:

5.3 Common to both routes

The recipient providers (Cloudflare, Anthropic, OpenAI) are based in the United States. Any data sent leaves the UK/EEA. Your explicit consent under Article 49(1)(a) UK/EU GDPR is the lawful basis for this transfer; you can revoke it at any time in Settings by disconnecting the provider, which clears the stored consent record and switches the App back to on-device-only processing.

Disconnecting does not delete data already received by the provider — to do that, contact the provider directly using the links above.

6. Web research enrichment (optional)

If cloud recognition is enabled, the App also offers a Web Research toggle. When on, after a label has been recognised the App makes a second request to the chosen AI provider asking it to perform a web search and fill in fields the label itself does not show — typically region, average price, and tasting notes.

This second request shares only the small set of label-identification fields produced by the previous recognition step (producer or distillery or brewery, product name, vintage, style or category, country) — not the photograph and not the OCR text, and not your personal tasting notes, ratings, prices, lists, or any other inventory data. Search results may be retrieved from public web sources by the provider on your behalf.

Turn the toggle off in Settings to suppress this enrichment.

7. Subscriptions and payments

Bacchus Pro is an in-app subscription handled by Apple's App Store. IDENTIDEM LTD does not receive your payment details. Apple shares only the information necessary to confirm an active subscription — a cryptographically signed transaction record containing a subscription identifier, the product identifier, an expiry timestamp, and a sandbox/production indicator. This record is not linked to your name, address, or any payment data.

The Cloudflare proxy described in §5.1 uses this signed receipt only to verify that an active Bacchus Pro subscription exists before relaying the request. It does not store the receipt long-term, and the originalTransactionId is the only stable identifier retained — it is not linked to a name, email, or any data you have entered into the App.

Apple's privacy policy: https://www.apple.com/legal/privacy/.

8. Data we explicitly do not collect

Bacchus does not:

  • Collect or use device advertising identifiers (IDFA).
  • Track you across other apps or websites.
  • Include third-party analytics, advertising, attribution, or crash-reporting SDKs.
  • Log or transmit your tasting notes, personal ratings, prices, or consumption history.
  • Profile you for marketing.

The App declares NSPrivacyTracking: false in its on-device privacy manifest, which is auditable by Apple.

9. Permissions Bacchus requests

Permission What it is used for
Camera To photograph labels for on-device OCR. Images are stored locally and only sent off-device if you have enabled cloud recognition (see §5).
Photo Library To let you pick an existing photo as a label image.
Face ID / Touch ID Only if you enable "Require Face ID" in Settings, to unlock the App.

You can revoke any permission at any time in iOS Settings → Bacchus.

10. Security

  • All in-app data is stored inside the iOS app sandbox, with file protection set to NSFileProtectionComplete (encrypted when the device is locked).
  • Bring-Your-Own-Key API keys are stored in the iOS Keychain with the WhenUnlockedThisDeviceOnly accessibility class.
  • All network requests use HTTPS / TLS. No cleartext HTTP exemptions are declared.
  • When App Lock is enabled, the cellar UI is hidden from the iOS App Switcher snapshot.
  • The Cloudflare proxy authenticates every request with an Apple-signed transaction receipt; unauthenticated requests are refused at the edge.

No security control is absolute. If you discover a security issue please report it to security@identidem.design with "Security" in the subject line.

11. Retention

  • Local inventory data: kept until you delete it. You can delete individual records in the App or wipe everything via Settings → Data → Delete All Cellar Data, which removes all Core Data records, all Keychain keys, and all preferences in a single action.
  • iCloud data: governed by Apple and your iCloud settings.
  • Data shared with Anthropic / OpenAI: governed by the chosen provider's retention policy. We do not control retention upstream.
  • Cloudflare proxy logs: short-lived operational metadata only (request timing, HTTP status, error category). Inventory content (photographs, OCR text) is not logged.

12. Your rights (UK / EU GDPR)

Because the only data IDENTIDEM LTD itself processes is the optional cloud recognition request relayed via our Cloudflare proxy — which we do not link to your identity — there is typically nothing for us to disclose, rectify, or erase under a subject access request. Nevertheless, you have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate data;
  • Erase data ("right to be forgotten");
  • Restrict or object to processing;
  • Portability of data you have provided;
  • Withdraw consent at any time, without affecting the lawfulness of prior processing;
  • Lodge a complaint with your supervisory authority.

To exercise any right, contact us at security@identidem.design. We will respond within one month, in accordance with UK/EU GDPR Article 12.

For data held by Anthropic, OpenAI, or Apple, you must contact the provider directly using the links above — we are not the controller for that data.

13. Children

Bacchus is intended for adults legal to purchase, possess, and consume alcohol in their jurisdiction. The App is rated 17+ in the App Store. It is not directed at children, and we do not knowingly process the personal data of anyone under 16 (UK) / under the equivalent age threshold in your country.

14. International transfers

When you enable optional cloud recognition, your label image and OCR text are transferred outside the UK/EEA:

  • Bacchus Pro path: through Cloudflare, Inc. (United States; its edge network is global and a request may be served from a datacenter near you), then to Anthropic PBC (United States).
  • Bring Your Own Key path: directly to Anthropic PBC or OpenAI OpCo, LLC (both United States), depending on which provider you selected.

The lawful basis for all of the above is your explicit consent under Article 49(1)(a) UK/EU GDPR. You can withdraw this consent at any time by disconnecting the provider in Settings.

15. Changes to this policy

We may update this policy from time to time. Material changes will be flagged in-app and at the top of this document with a new "Last updated" date. The current version is always reachable from Settings → About → Privacy Policy inside the App and at https://identidem.design/pages/bacchus-privacy-policy.

16. Contact

IDENTIDEM LTD
Littlemoor Chapel Business Center Unit 8, Gladstone Street, Glossop, SK13 8LX, England, United Kingdom
security@identidem.design