Horreum

Privacy Policy

Effective September 25, 2026

Horreum is the wine-reserve app your venue uses to keep your locker: the bottles in it, the ones you've enjoyed, your requests, and your conversations with the team. This page explains what the app keeps about you, why, who can see it, and how to remove it. It is written to be read, not skimmed past.

In short: Horreum keeps only what it takes to run your locker and to learn how the app itself is used. Nothing is sold, no advertising network touches it, and the app does not track you across other apps or websites. Your venue's team sees your locker because they stock it. You can delete your account from inside the app.

Who is responsible

Horreum is operated by HORREUM LLC, a Michigan limited liability company ("Horreum", "we"). The venue that holds your locker (the restaurant, club or cellar that invited you) is a separate business and uses Horreum to serve its own members. Questions about this policy go to gabriel@horreum.cloud.

What the app keeps

Your account. Your name, email address and phone number, as your venue entered them when it set up your locker and as you edit them in Profile settings; a sign-in password you choose; the one-time codes emailed to you to confirm it's you.
Your locker. The bottles stocked for you and the ones you brought in, when they arrived, when a bottle was pulled and how (at the table or off site), the requests you send the team, and your ratings and notes.
Messages. Conversations between you and the venue's team inside the app.
Keepsake photos. When a bottle comes to your table, the venue's team may offer to take a photo of you with it. Only if you say yes: the photo is taken inside the app with the device's camera (it cannot be saved to the staff member's phone or gallery), held in private storage, checked by a manager, and then shown to you — and only you — on your History page. You can delete it there at any time, and deletion is permanent.
Preferences. Your theme and locker finish, saved to your account so they follow you between devices.
Payments, only where your venue has turned them on. If your venue accepts cards through the app, your card details go directly to Stripe, our payment processor; Horreum never sees the number and keeps only the card's brand, its last four digits and a payment reference for your receipts.
If you work at a venue. Your name, email address and role, as the venue set them; and a record of what you do in the app — bottles added, pulls logged, requests answered — kept in the venue's activity log under your name, because a chain of custody is the point of the record.
Notifications, only if you turn them on. The app can tell you when a bottle is pulled from your locker, when your venue posts an announcement, or when the team sends you a message, and the day after a pull it can remind you to rate the wine. Nothing is sent until you say yes, and each kind has its own switch in Profile settings. To deliver them, Horreum keeps a push token: an identifier your phone's notification service issues for this app on this device. It is not your device's serial or advertising number and cannot be used to identify you anywhere else. It is removed when you turn notifications off, sign out, or delete your account.
Bug reports. If you report a problem, we keep what you wrote, which screen you were on and the app version, so it can be reproduced.
How the app is used. Which screens and features are opened and how often — for example whether a request began on the atlas or the list, or whether a bottle was rated — together with the app version and the kind of device. It is kept in Horreum's own database, tied to your account only so it can be removed with it, never sold or shared, and never includes what you wrote in a note, a journal entry or a message. We use it to decide what to build and fix.
Technical records. To keep the app reliable we record when a loading screen misbehaves (which page, which version, your device's browser string) and standard server logs.

Location. The app never asks for, reads or stores your location. Its day and night looks follow the clock: sunrise and sunset are estimated from your device's time zone, nothing more precise than that.

Camera. The camera is used by venue staff, in the staff app, for two things: reading bottle labels and tags, where the code is read from the frame on the device and no image is kept; and keepsake photos, described above, which are only ever taken with your agreement.

Why

To run your locker and show it to you; to let the venue stock it, pull bottles for you and answer your requests; to send you the emails you've asked for (codes, invitations and, if you've left them on, notices about your bottles); to issue receipts where the venue takes payment in the app; to find and fix faults; and to see which parts of the app are used, so we know what to improve. That is the whole list. Horreum does not use your information for advertising, does not sell or rent it, and does not build profiles of you for anyone else.

Who can see it

Your venue. The team at the venue that holds your locker sees your locker, your requests and your messages — they need them to serve you. Staff with no permission to read messages cannot.
Service providers working for Horreum. Supabase hosts the database, file storage and sign-in; Stripe handles payments for venues that use them; an email service delivers codes and notices; Apple and Google carry notifications to your phone through their notification services (Apple Push Notification service and Firebase Cloud Messaging), and see only the token described above and the text of the notification. Each processes data only to provide its service to us.
Ordinary web requests. A few things load straight from other services as any web page would, and those services see your device's network address in the process, nothing else: fonts a venue has chosen for its branding (Google Fonts), the label-reading library used in the staff app (jsDelivr), and the weather shown over a wine region in the atlas (Open-Meteo, which is sent the region's coordinates, never yours).
When the law requires it, or to protect the safety of members, venues or the service.

Nobody else. Your information is not shared with other venues on the platform.

Your choices

Edit your name, email, phone and notification preferences any time in Profile settings.
Delete your account from Profile settings → Close account, or follow the steps at app.horreum.cloud/delete-account. Your sign-in, personal details, preferences, messages and keepsake photos are removed. Records of past purchases and pulls remain with the venue as its own business records, as the law requires of it; they are no longer tied to a live account.
Remove a keepsake photo from its entry on your History page whenever you like.
Ask us for a copy of what we hold, or to correct or erase it, at gabriel@horreum.cloud.

Where it's kept

Horreum's database, file storage and sign-in are hosted by Supabase on Amazon Web Services in the United States. If you use Horreum from somewhere else, your information is processed in the United States.

How long it's kept

For as long as your account is open. After you delete it, personal details are removed promptly; server logs and diagnostic records age out on their own within a year; the venue keeps its purchase records for as long as its books require.

Security

Everything travels encrypted between your device and our servers. Access to the database is controlled row by row, so a member can only ever read their own locker and a venue can only ever read its own members. Photos and attachments live in private storage that is reachable only through short-lived signed links issued to people the rules above allow. Passwords are stored hashed; card numbers are never stored by Horreum at all.

Your rights where you live

Some places — California and a number of other US states among them — give people specific rights over their personal information: to know what is held, to have it corrected or deleted, and not to be treated differently for asking. You have those from us wherever you live: write to gabriel@horreum.cloud and we will answer within thirty days. We do not sell personal information or share it for advertising, so there is nothing to opt out of on that front.

Age

Horreum is built around wine. It is not directed to anyone under the legal drinking age where they live, venues may only open lockers for adults, and we do not knowingly keep information about anyone younger. If you believe we have, write to us and it will be removed.

Changes

If this policy changes in a way that matters, the app will say so the next time you open it, and the date at the top will move.