Privacy Policy
Last updated: November 2, 2026
Fork & Cork is an invite-only iPhone app for logging restaurant visits, keeping a home wine cellar, and saving tasting notes. It is a small, independent project run by one developer (“we” below). This page explains what the app and its server collect, why, who else handles it, how long it is kept, and how you can take it with you or delete it. Questions go to [email protected].
The short version
- What you log is yours. No other user can see it, and we don’t look at it, except in the few cases under “Who can see it”.
- We use your data only to run the app. No ads, no tracking, no analytics tools, and we never sell or rent your data.
- Photos upload without their location metadata. Shared pages never show prices, coordinates, or addresses.
- You can export everything, and deleting your account in the app deletes all of it.
What we collect
Your account
- How you sign in (Apple, Google, or email) and the identifier that service gives us: your Apple or Google account ID, or, for email sign-in, your email address.
- Your name, if Apple or Google shares it when you first sign in. Apple lets you choose whether to share it, and email sign-in asks for no name.
- When you created the account, and which invite code you used.
- For Sign in with Apple, an encrypted token from Apple. We keep it only so that we can revoke the app’s access to your Apple ID when you delete your account, as Apple requires.
- Your sign-in sessions: a scrambled (hashed) form of each session token, and when it was created and last used.
What you keep in the app
- Restaurants and visits: names, addresses, cities and countries, the map coordinates and Apple Maps ID of each place, dates, Michelin distinctions, ratings, notes, the amount per person you enter, and the dishes you add.
- Wines, bottles, and tastings: the wine’s details, how many bottles you have and their sizes, purchase prices and dates, where you store them, their status, your ratings, notes, flavor tags, and any prices you enter.
- The share links you create.
Photos
- Before a photo leaves your iPhone, the app resizes it and removes all of its metadata, including where it was taken.
- The app keeps the time the photo was taken and, when the photo has it, the place it was taken, as separate details next to the photo. They let the app suggest a visit’s date and restaurant. Photos taken with the in-app camera have no location.
- The app never asks for access to your photo library. It gets only the photos you pick in the system photo picker, and the picker’s Location option lets you leave their location out.
Location
- When you start a visit, the app asks to use your location while you’re using the app. It sends your coordinates to our server, to find restaurants you’ve logged nearby, and to Apple Maps, to find places around you. We don’t keep them.
- When you start a visit from photos, the app doesn’t ask for your location. When the photos say where they were taken, it uses that place in the same way: it sends those coordinates to our server and to Apple Maps to find restaurants there. The visit’s date comes from when the photos were taken.
- If you’ve already allowed location, the app also uses it on your iPhone to suggest the currency of a price you enter. That never leaves the device.
AI scans
- When you scan a wine label or a menu, or ask for a wine’s typical profile, our server sends that photo, or the wine’s details, to an AI model running on Cloudflare Workers AI. Cloudflare doesn’t use them to train models and doesn’t keep them once it has answered.
- The answer only fills in a form for you to check. Nothing from it is saved until you confirm it.
- For each AI request we record its kind, the model, whether it worked, how much text went in and out, how long it took, and when. We use this for the monthly limit and to keep the service running.
Email sign-in
- We use your email address to send you a 6-digit code. We store the code only in a scrambled form and delete it once it is used, or when it expires after 10 minutes.
- To stop anyone from sending codes in bulk, we keep a scrambled form of your address and of your network’s IP address for 24 hours after each code.
Server logs
- Our server logs errors, and how long each label lookup took, without personal data, and keeps those lines for 3 days. Request addresses, search text, and coordinates are not logged.
- As with any website, our hosting provider sees your IP address when the app connects. We don’t store it, apart from the scrambled form above.
What we don’t collect
- No advertising, no tracking, and no analytics or crash-reporting tools.
- No contacts, no access to your photo library, and no payment details.
- Not your email address from Apple or Google: the app doesn’t ask either of them for it.
How we use it
Only to provide the app: to sign you in, keep your records safe on our server, read labels and menus for you, show the pages you share, apply usage limits, and keep the service secure and working. We don’t use your data for advertising, we don’t sell it, and we don’t use it to train AI models.
Who can see it
- You. Every account is private. There is no feed of other people and no one to follow.
- People you send a share link to. A share link, an address on share.forkncork.app, shows one visit or one tasting to anyone who has the link: its photos, dishes, drinks, notes, ratings, flavor tags, and the restaurant’s name and city. It never shows prices, the amount per person, coordinates, the address, menu photos, or a note on where a tasting took place. Share pages ask search engines not to list them, and you can turn a link off at any time in the Me tab, after which it stops working.
- Us, the operator. Our admin tools show account details and counts: how each account signs in, its name, the email address of an email account, when it was created and last used, how many visits, tastings, bottles, and photos it has, and its AI usage. They never show your notes, places, wine or dish names, prices, or photos. We don’t look at what you keep, except to help when you ask us to, to restore lost data, or where the law requires it.
- Service providers that run parts of the app for us:
- Cloudflare: hosting, the database, photo storage, the AI models, and logs.
- Resend: sends the sign-in code emails, and keeps each email and its delivery record for 30 days.
- Apple: Sign in with Apple, the Apple Maps place search, and TestFlight.
- Google: Google sign-in.
- When the law requires it. We would disclose data only if the law requires us to.
Google user data
When you sign in with Google, the app asks Google only for your basic profile (the openid and profile scopes). From Google’s answer, our server keeps your Google account ID and, for a new account, your name. The app doesn’t ask for your email address, your contacts, or anything else in your Google account, and it never keeps Google’s access or refresh tokens. We use this data only to sign you in and show your name, and we don’t share it, sell it, or use it for advertising. Fork & Cork’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Apple
The app asks Apple only for your name, which Apple shares the first time you sign in if you choose to. It doesn’t ask for your email address. Our server keeps your Apple account ID, your name if shared, and the encrypted token described above.
Where it’s stored and how it’s protected
- Your data is stored with Cloudflare: the database in Cloudflare’s Western North America region, and photos in Cloudflare R2 storage. It travels only over encrypted connections (HTTPS).
- Photos are private. The app fetches them with your session, a share page can show only the photos of the visit or tasting it shares, and the photo links in a data export you make work for 7 days without signing in.
- Session tokens, the tokens in export photo links, and sign-in codes are stored only in scrambled (hashed) form. The keys our server uses are kept as server secrets, never in the app.
How long we keep it
- Your account and what you keep stay until you delete them. You can delete any record at any time.
- When you delete your account in the app (in the Me tab), all of your records and photos leave the app straight away, we end all of your sessions, and, if you use Sign in with Apple, we revoke the app’s access to your Apple ID. If Apple can’t be reached at that moment, we keep only the encrypted Apple token and try again every day for up to 30 days, then delete it.
- So that we can recover from mistakes, deleted data stays recoverable for a short time. Our database can be restored to any minute of the past 7 days, so deleted records stay in that recovery history for up to 7 days. A deleted photo, whether you delete it on its own, with the visit, wine, or tasting it belongs to, or with your account, leaves the app at once and stays in a private recovery copy for up to 7 days, plus about a day for Cloudflare R2 to remove it. After that, deleted data is gone for good. While we recover from a problem, we keep a copy of the database on our own computer, and delete it once the recovery is done; photos we bring back pass through it one at a time and aren’t kept. Rarely, a photo can’t be moved there: if our storage fails while it is being deleted, or if a visit with more than 450 photos is deleted at once. Such a photo stays in private storage, where the app can’t show it, until you delete your account, when it goes the same way as your other photos.
- A session ends 90 days after its last use, and never more than a year after you signed in. Sign-in codes are deleted once used or expired, and their sending records after 24 hours. An export’s photo links stop working 7 days after the export. Server logs are deleted after 3 days.
Your choices
- Take your data with you. In the Me tab you can export all of your data as a JSON file, with links to download your photos and the addresses of your share links. The photo links work for 7 days without signing in, so anyone you give the file to can open your photos until then, and your shared pages until you turn those links off.
- Correct or delete it. Edit or delete any record in the app, or delete your account.
- Share links. Turn any of them off in the Me tab.
- Permissions. Change location and camera access at any time in your iPhone’s Settings app. Without them you can still enter everything by hand.
- Ask us. Write to [email protected] about anything to do with your data, including a copy, a correction, or deletion.
Children
Fork & Cork is about wine and spirits and is meant for adults. It isn’t directed at children, and we don’t knowingly collect data from children.
Changes to this policy
When what the app collects, or how we use it, changes, we update this page first and change the date at the top.