Privacy
Cellarfy · last updated 3 September 2026
Cellarfy keeps a record of the wine in your fridge. This page says exactly what it stores, what it never collects, who else sees any of it, and how to delete the lot.
What is stored
- Your account — the username you chose, an optional display name, and your password, which is stored only as a PBKDF2 hash with a salt unique to you. The password itself is never written down anywhere and cannot be recovered, by us or by anyone else.
- Your cellar — the fridges you set up and the bottles in them: producer, bottling, vintage, grape, region, country, format, what you paid, what you reckon it is worth, your score, drinking window, pours, and your notes.
- Your history — bottles you mark as drunk, and when.
- Label thumbnails — a small image kept with a bottle if you photographed its label.
- Your settings — theme, which view opens first, shelf labels.
- Signed-in devices — for each one, the time it signed in, when that expires, and the browser's user-agent string. The session token itself is stored only as a SHA-256 hash, so a copy of the database does not let anyone sign in as you.
- A daily count of how many label reads and value estimates the account has used, so no single account can run the bill up without limit.
What is never collected
No email address. No real name. No phone number. No location. No contacts. No advertising identifiers. No analytics, no tracking pixels, no third-party scripts of any kind. Nothing is sold, rented or shared for marketing, because none of it is gathered in the first place.
Photographs and the AI features
Two features send data to Anthropic, who run the Claude model:
- Read the label. The photos you choose are shrunk in your browser and sent to Anthropic to be read. Up to four photos of one bottle can be sent together. A small thumbnail of the first is kept with the bottle; the full-size originals are never stored by Cellarfy.
- Estimate what it's worth. The producer, bottling, vintage, region, country and format are sent to Anthropic as text. No photograph and nothing about you is sent with it.
Neither feature sends your username, your notes, your prices or anything else about your account. Anthropic's handling of what it receives is governed by their own terms and privacy policy. If you would rather nothing left the app at all, do not use those two buttons — every field can be typed in by hand, and the rest of Cellarfy works without them.
Where it lives
Everything is held in a Cloudflare D1 database and served from Cloudflare Pages. Cloudflare processes the traffic and stores the data on our behalf. Connections are HTTPS only.
Cookies
One cookie, named cellar_session. It holds a random session token, is
marked HttpOnly, Secure and SameSite=Lax, and lasts thirty days. It exists solely to
keep you signed in. There are no analytics or advertising cookies.
Deleting your data
Open Account → Close account, confirm with your password, and every one of the things listed above is deleted immediately: the account, its fridges, bottles, history, thumbnails, sessions and usage counts. Nothing is retained afterwards and there is no separate archive to ask about. Signing out on its own deletes only the session.
Children
Cellarfy is about wine and is not directed at children. It is intended for adults of legal drinking age where they live.
Changes
If this policy changes, the date at the top changes with it.
Contact
Questions about any of this, or about data held for your account: rich@lyneninteriors.com.
← Back to Cellarfy