Your wine, your data

Last updated September 7, 2026 · version 2026-09-07

Corvago is made by Norevia Group LLC. This policy explains what we collect when you use the Corvago app and corvago.com, why we collect it, who processes it for us, how long we keep it, and the choices you have. The short version: we collect what we need to run your cellar and give you guidance built around your taste; we don't sell your data; and you can pause, download or delete it from inside the app.

What we collect

Account. Your email address and a password (stored only as a secure hash by our authentication provider). Optionally a display name for cellar sharing.
Date of birth. Asked once at signup and used only to confirm you are 21 or older. We record the date and the time you confirmed it.
Your cellar and tastings. The bottles you add (name, producer, vintage, quantity, location, price, notes), the wines and spirits you log, your reactions, scores and notes, wish lists and clubs.
Your taste profile. From your onboarding answers and reactions we build a model of your palate so Corvago can explain why a wine fits you. This is derived by us; it is not something you type in.
Location — only if you turn it on. When you use the store picker or save a shelf scan, and only while you are using the app, we read your location to name the shop or restaurant you are in and to remember where a scan was taken. We never track you in the background and never ask for “always” permission. Wines seen at a commercial venue may be shared with other users as anonymous store-availability observations; observations at private places (your home, a friend's cellar) stay private to you. You can pause location capture and delete your private location history at any time in Privacy & Data.
Photos you scan. Shelf and label photos are processed to read the labels. Saved shelf scans are stored privately in your account so you can revisit them; delete a scan and its photo goes with it.
Purchases. Subscriptions and credits are bought through Apple. Apple handles payment; we never see your card. We receive receipt data — including a stable transaction identifier — to unlock what you bought and to keep one subscription tied to one Corvago account.
Notifications. If you turn them on, a device push token so we can send the reminders and digests you chose.
Usage and diagnostics. Which features you use, how many questions and scans you have used against your plan, errors, and the cost of serving your requests. This is first-party: there is no third-party advertising or analytics tracker in Corvago.
Support. Anything you send us by email or through the in-app feedback form.

How we use it

To run your cellar and tasting log and keep them in sync across your devices.
To personalize: every recommendation and explanation is grounded in your taste profile.
To answer your questions about wines, shelves, menus and dishes. The wine, dish and taste text of a request is processed by the model providers listed below; your name, email and account identifiers are never sent with it.
To power the shared store-availability signal — anonymously — so nearby wine lovers can find bottles too.
To meter your plan, unlock purchases, prevent abuse and keep the service secure.
To improve Corvago using aggregate, non-identifying measures.
To reply when you contact us.

What we don't do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We show no ads and embed no third-party advertising or analytics trackers.
We never send your name, email or account identifiers to a model provider.

Who processes data for us

These companies process personal data on our behalf, under contracts that limit what they may do with it:

Supabase — database, authentication, file storage and server functions (hosted in the United States).
Cloudflare — hosting and delivery of corvago.com.
Anthropic, Google and Groq — the model providers that process the wine, dish and taste text of your requests to produce Corvago's answers — they never receive your name, email or account identifiers.
Resend — transactional email (account emails, your data-export links).
Expo — delivery of push notifications, if you turn them on.
Apple — in-app purchases and subscriptions — Apple processes payment; we receive receipt data to unlock what you bought.

Place names and coordinates come from OpenStreetMap and Overture Maps; that is public map data, not data about you.

How long we keep it

Your account data stays for as long as you keep your account.
Data-export download links expire after 7 days.
Saved shelf-scan photos stay until you delete the scan.
When you delete your account, everything identifying you is removed right away. Anonymous store-availability observations you contributed at commercial venues are kept as anonymous data points (your identity is removed from them). Purchase records stay with Apple.

Your choices and rights

Delete your account — in the app: Profile → Delete my account; or on the web at corvago.com/account/delete. Deletion is immediate and cannot be undone.
Download your data — in the app: Profile → Privacy & Data → Download my data. You get your bottles, notes and tastings as CSV and JSON. The export contains what you entered; it does not include the taste model Corvago built or its analysis of any wine.
Location — pause location capture, delete your private location history, or turn the permission off in your device settings, all from Privacy & Data.
Correct anything in your cellar or tastings directly in the app.
Notifications — turn each kind on or off in Profile.
Anything else — email info@noreviagroup.com.

California residents

Under the California Consumer Privacy Act you have the right to know what personal information we collect and how we use it (this page), to access and delete it (the controls above), and to opt out of sale or sharing — which we do not do. We will never discriminate against you for exercising these rights. We verify requests through your signed-in account; email requests are verified against the account's email address. We respond within 45 days.

Age

Corvago is for adults of legal drinking age — 21 and over in the United States. We do not knowingly collect information from anyone younger, and we delete any such account we discover.

Security

Data is encrypted in transit; every record is scoped to its owner at the database level; we hold no payment card data. No system is perfectly secure, so if you believe your account has been compromised, email us.

Where your data lives

Our services are hosted in the United States. If you use Corvago from elsewhere, your data is processed there.

Changes

This policy is versioned. If we make a change that matters, the app will ask you to review and accept the new version before you continue.

Contact

Norevia Group LLC · info@noreviagroup.com
See also our Terms of Service and Support pages.