Ghostwood Software LLC (“Mixed Spirits”, “we”, “us”) operates the Mixed Spirits mobile application and mixedspirits.app (collectively, the “Service”). This Privacy Policy describes what we collect, how we use it, who we share it with, and the choices you have. We wrote this in plain language because we think you should be able to read it without a lawyer.
1. Data we collect
We collect only what we need to operate the Service. The table below lists every category of personal data Mixed Spirits touches.
| Data type | Purpose | Where it lives |
|---|---|---|
| Email address | Account creation, sign-in, transactional email | Supabase Auth |
| Display name & username | Showing authorship on recipes and profile pages | Supabase database |
| User ID | Linking your data to your account; access control | Supabase Auth |
| Apple Sign In identifier | Signing you in via “Sign in with Apple” | Supabase Auth |
| Recipe content (text, ingredients, method, notes) | The core function of the app — storing your bar book | Supabase database |
| Recipe photos | Displaying images on your recipe cards | Supabase Storage (private bucket) |
| Avatar photo | Showing your profile picture | Supabase Storage (public bucket) |
| Camera image / pasted text (AI import) | Extracting structured recipe fields via OCR or text parsing | Transient — sent to Anthropic Claude API, not stored by us |
| Purchase history (subscription status) | Granting Pro / Bar entitlements | RevenueCat |
| Workspace memberships & roles | Bar-tier team collaboration | Supabase database |
| Profile bio | Optional “about” text shown on your profile | Supabase database |
| Bar profile (Bar tier): bar name, tagline, season, venue address, Instagram & Facebook handles | Branding your published menus and bar page | Supabase database |
| Bar logo image (Bar tier) | Displaying your bar’s logo on menus and your bar page | Supabase Storage (public bucket) |
| Menus (names, descriptions, section labels, per-recipe pricing) | Building and sharing cocktail menus | Supabase database |
| Collections (names & grouped recipes) | Organizing recipes into your own collections | Supabase database |
| Bottle library & pour-cost data (bottle names, brands, prices, cost lines) | Calculating pour cost and margins (Bar tier) | Supabase database |
| Saved recipes & follows | Your saved-recipe list and the accounts you follow | Supabase database |
| Import logs (source app, timestamps, parse metadata) | Rate-limiting AI import and diagnosing failed imports | Supabase database |
| Waitlist email (web early-access sign-up) | Notifying you when access opens; collected only if you join the waitlist | Supabase database |
What we do not collect
- We do not collect precise or coarse location.
- We do not use the Advertising Identifier (IDFA) and we do not show ads.
- We do not run cross-app or cross-website tracking.
- We do not collect contacts, health data, financial information (card details go directly to Apple / RevenueCat, never to us), or browsing history.
- We do not run a crash-reporting SDK. If we add one in the future, this policy will be updated before it ships.
- The web app uses Vercel Web Analytics for aggregate, cookieless page-view counts. It sets no cookies, stores no identifier on your device, and does not track you across sites; we see page paths and rough geography, never who you are. The iOS app contains no analytics SDK.
2. How we use your data
- Operate the Service — store and display your recipes, sync between iOS and web, share recipes you publish, build menus and pour-cost reports.
- Authenticate you — verify sign-in via email link, password, or Apple Sign In; gate paid features by checking your RevenueCat entitlement.
- AI import features — when you paste a URL, photo, or text into the AI import flow, the content is sent to Anthropic’s Claude API to extract structured recipe fields. The response is returned to your device and stored only if you choose to save the resulting recipe.
- Communicate — send transactional emails (password resets, sign-in links, subscription receipts). We do not send marketing email without your separate opt-in.
- Comply with law — respond to lawful requests, enforce our Terms, prevent abuse.
3. Who we share data with
We share data with the following processors, each subject to a data-processing agreement and each used only for the purposes described:
| Processor | Purpose | Data accessed |
|---|---|---|
| Supabase | Database, authentication, file storage | All Service data listed in §1, encrypted at rest |
| RevenueCat | Subscription state & entitlement | Anonymous app user ID, purchase history |
| Apple | Sign in with Apple, In-App Purchase processing | Apple ID identifier (hashed), purchase receipts |
| Anthropic (Claude API) | OCR / text parsing for AI import | Image or text you submit; deleted on response per Anthropic’s API retention policy |
| Vercel | Hosting mixedspirits.app | Standard server logs (IP, user agent, request path) |
We do not sell your personal data. We do not share data with advertisers, data brokers, or analytics resellers.
4. Visibility of your recipes
- Private — visible only to you (the default).
- Workspace — visible to the members of a workspace you choose.
- Public — visible to anyone, including search engines, on the Community feed and via shareable links. You can change visibility at any time; changing from Public to Private removes the recipe from public listings within minutes but cached copies (e.g., social-media previews) may persist for a short period.
5. Your rights
You have the right to access, correct, export, and delete your data.
- Access & correction — most fields are editable directly in the app or web dashboard (Settings → Profile).
- Export — use the JSON export feature on iOS (Settings → Support → Export My Recipes) to download your recipe library as a JSON file.
- Deletion — Settings → Delete Account removes your account and its data: your profile and avatar, recipes (and their versions, ingredients, and photos), menus, private collections, your bottle library and pour-cost data, bar profile and bar logo, workspace memberships, workspaces you own, your saved-recipe and follow lists, and your import history. Your database records are removed together in a single transaction; your uploaded files and your sign-in record are then deleted. If you published a public collection to the community, it remains as anonymous community content with your name removed. Deletion is irreversible and cannot be undone. If you joined the web early-access waitlist, that entry is keyed to your email rather than your account — email us to have it removed.
- Manual requests — for any rights request, including data subject access requests under GDPR or CCPA, email travis@mixedspirits.app from the address on your account. We respond within 30 days.
6. Data retention
- Active accounts: your data is retained while your account exists.
- Deleted accounts: data is removed from production within 30 days; encrypted backups are retained for up to 60 additional days, after which they are overwritten.
- Server logs: 30 days.
- AI import inputs: not retained — content is forwarded to the Claude API and discarded once the structured response returns.
7. Security
All network requests use HTTPS. Data is encrypted at rest by our infrastructure providers (Supabase, Vercel). Access to the production database is restricted to authorized employees of Ghostwood Software LLC and is logged. Row-level security policies in Supabase enforce that you can only read and write your own data, regardless of any application-level bug.
8. Children
Mixed Spirits is rated 17+ on the App Store. It is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact travis@mixedspirits.app and we will delete it.
9. International transfers
Our infrastructure providers operate primarily in the United States. By using the Service, you consent to transfer of your data to the United States, which may have different data-protection rules than your country.
10. Changes to this policy
We will update this page when our practices change. The effective date at the top will reflect the most recent material revision. Significant changes will be announced in-app and by email to active accounts.
11. Contact
Questions, requests, or concerns: travis@mixedspirits.app
See also our Terms of Service and Support page.