Privacy Policy

Last updated: 8 September 2026

The short version

Your taste never leaves your phone. Every drink you log, every menu you scan, your diary, and the taste profile built from them are stored on your device and are never uploaded to Petalform.

The one thing that does leave your phone is a photo of a menu, and only at the moment you take it. It is sent to be read, the text is returned, and the image itself is not kept.

What stays on your device

Your setup answers, every logged drink and how you rated it, any café name or note you attach to one, the menus you have scanned, and your taste profile are all held in local storage on your device.

Sip does not upload them, cannot read them, and does not back them up. Deleting the app, or using "Start over" in Settings, removes them permanently. There is no copy elsewhere to restore from.

Because they are held on the device rather than in your account, they are also cleared when you sign out — a second person signing in on the same phone never sees the first person's diary or taste profile. The flip side is that they do not follow you to a new phone.

Menu photos, and the AI that reads them

When you photograph a menu, the image is sent over an encrypted connection to our server, which forwards it to Google's Gemini API to transcribe the drink names, descriptions, and prices written on it.

The photo is not saved. It is held in memory only for as long as the request takes, and neither we nor Google retain it as part of this feature. Google processes it as our service provider on paid API terms, which means it is not used to train or improve their models.

What we do keep is a cache entry: a one-way SHA-256 fingerprint of the image, plus the café name and drink lines that were read from it. That entry is stored against the fingerprint and is NOT linked to your account. We do this so the same menu is never sent to be read twice — which keeps the feature cheap — and it deliberately means the cache cannot be turned into a record of which cafés any particular person visits.

Everything after transcription — scoring, ranking, and the reasons shown next to each drink — happens on your device. No taste information is sent anywhere in order to produce a recommendation.

Your account

Creating an account stores your email address and an encrypted authentication record with our hosting provider, Supabase. We use it to sign you in and to associate a subscription with you.

We also keep a count of how many menu scans your account has used in the current month, so the free allowance can be enforced. It is a number and a month — not a list of what you scanned, where, or when. Menu contents are cached separately against the image fingerprint and are never linked to your account.

If you enable notifications, a push token for your device is stored so we can send them. You can turn notifications off at any time in Settings, on the device, or both.

Rating reminders are the exception: they are scheduled by the app on your phone, from what you scanned on it. Sending one involves no server and tells us nothing about where you were or what you drank.

Analytics and crash reports

We collect anonymous product analytics (PostHog) covering which screens are used and how the app performs, and automatic crash reports (Sentry) when something fails. These help us find slow screens and broken flows.

Personal fields are stripped before any event is sent, and we do not send the contents of your diary, the drinks you log, or your taste profile. You can turn analytics off in Settings under Privacy.

Subscriptions

Plus is sold through the App Store or Google Play. Your payment is handled entirely by Apple or Google — we never see or store your card details. RevenueCat processes the purchase receipt on our behalf so we know whether your subscription is active.

Camera and photo access

Sip asks for camera access so you can photograph a menu, and photo library access so you can choose a menu you have already photographed. Both are used only for that, only when you start a scan, and you can decline either and still type a menu in by hand.

Who else processes your data

Supabase (hosting, authentication, database), Google (reading menu photos, via the Gemini API), PostHog (analytics), Sentry (crash reporting), RevenueCat (subscription receipts), and Apple or Google (payments and app delivery).

We do not sell your personal information, and we do not share it with advertisers or data brokers. Sip contains no advertising and no third-party ad tracking.

Deleting your data

You can delete your account from Settings. This permanently removes your profile, your sign-in credentials, and your scan count from our servers.

Two things are worth knowing. Data held on your device is removed by deleting the app or using "Start over" — account deletion does not reach it. And an active Plus subscription is NOT cancelled by deleting your account; cancel it in your Apple ID or Google Play settings, or you will continue to be billed.

Children

Sip is not directed to children under 13, and we do not knowingly collect information from them.

Changes and contact

If this policy changes materially we will update the date at the top and, where the change affects you, tell you in the app.

Questions about your data can be sent to support@petalform.com.

Sip is made by Petalform LLC. Questions about this document: support@petalform.com.