Privacy Policy

This Privacy Policy explains how Evan Roscoe (“we,” “us,” or “our”) handles personal information in connection with route.wine, covering both the website at route.wine and the Route Wine app for iOS (together, the “Service”).

The short version

Who we are and what this covers

The Service is operated by Evan Roscoe in California, United States. For privacy law that uses the term, we are the controller (or, under California law, the business) responsible for the personal information described here. You can reach us at any time at hello@route.wine.

The website and the iOS app share one backend and one database. Everything in this policy applies to both surfaces unless a section says otherwise. Three things exist only in the iOS app: precise location for the Nearby now feature, data stored locally on your device, and trip-morning reminders delivered as local notifications. Those are called out separately below.

This policy does not cover the winery, restaurant, activity, and booking sites we link to. Once you follow a link out of the Service, that site’s own privacy policy governs.

Using route.wine without an account

No account is required for the core product. You can take the quiz, build an itinerary, use the concierge, search the catalog, and open a shared trip while signed out. When you use the Service anonymously, we handle:

• A client-generated session identifier. Your browser or the app generates a random identifier and stores it locally. It is attached to itineraries you generate and to booking-link clicks so a trip you built stays yours during the visit and so we can count clicks. It is not derived from you or your device, and it is never joined to an account, even after you sign up.
• A separate random analytics identifier used only for the product events described under Our analytics. On the web it lives in your tab and is discarded when the tab closes. In the iOS app it persists in app storage until you delete the app. It is never joined to an account.
• Your IP address, which every web request necessarily reveals. We use it in memory to enforce rate limits, and it appears in our hosting provider’s standard request logs. We do not write IP addresses into our own database.
• The itineraries you generate, keyed to the random session identifier above and reachable by an unguessable share link. Anonymous itineraries have no owner.

Anyone who has the share link for a trip can open it. Share links are long random tokens that we do not publish, but they are the key to the trip: treat one like a password, and send it only to people you want to see the plan.

What we collect

We collect only what the Service needs to work.

• Account data, only if you create an account: your email address, your password stored as a bcrypt hash, and an optional display name. We do not currently verify email addresses when a traveler signs up.
• Quiz answers and trip parameters: your dates, the length of the trip, group type and size, the age bands of any children in the party, how you are getting around, budget per stop, requirements you flag (mobility needs, someone not drinking, a dog along, sustainability), what you want out of the day, how much you know about wine, the occasion and any detail you type about it, food preferences, and the extras you pick.
• Places you name yourself: the hotel, resort, or inn you say you are staying at, a starting address or starting coordinates if you provide one, and any restaurant, activity, or custom stop you add to a day, including the title and note you write on a custom stop.
• Saved itineraries, including the generated schedule, the stops, the narrative text written for the trip, and the trip parameters above, which we keep with the itinerary so the trip can be rebuilt when you swap or remove a stop.
• Visit ratings and notes: a 1 to 5 rating and an optional free-text note of up to 500 characters about a winery you visited. We store these and show them back to you and to nobody else. We build no recommendation or preference model from your ratings.
• Concierge chat messages: the free-text messages you send to the concierge. We do not store the conversation in our database. It is held in your browser or app for the session and sent to Anthropic to produce a reply. See What we send to Anthropic.
• Booking-link click events: when you tap a booking link, we record which itinerary, stop, winery, experience, or restaurant it was, the time, and the session identifier. See Booking-link attribution.
• Product events from a fixed list, described under Our analytics.
• Precise location, in the iOS app only, described in the next section.
• Winery portal data, if you claim a winery listing: the work email address you claim with, whether its domain matched the winery’s website, a hashed six-digit verification code, and the field-by-field edits you submit for review. This applies to winery staff, not to travelers.

We do not collect payment information, we do not run a newsletter, and we do not send marketing email to travelers. The only email we send is transactional email in the winery portal.

Precise location in the iOS app

Precise location is used in the iOS app only. The website never asks for it.

• When we ask. Only at the moment you open Nearby now and pick a category. The app asks iOS for permission the first time, and iOS remembers your answer.
• Foreground only. The app requests when-in-use permission. It never asks for always-on or background location, and it does not track your location when you are not using it.
• What we do with it. Your coordinates are sent to our server for that one request, so we can find places within the search radius, rank them by distance, and estimate drive times. The result comes straight back to you.
• We do not save it. Your coordinates are not written to our database and are not attached to your account, your itineraries, or your ratings. They are sent inside the request rather than in the web address, so they are not recorded in our hosting provider’s standard request logs either.
• Declining costs you nothing important. If you say no, Nearby now still works. It centers on the middle of the region you are browsing instead of on you, and the screen says so.

Separately, the app draws maps using Apple Maps. Apple receives map requests from your device under Apple’s own privacy policy. On the website, maps are drawn with tiles from CARTO built on OpenStreetMap data.

What stays on your device

Some information never reaches us at all. In the iOS app we store the following on the device itself, and you can remove all of it by deleting the app:

Trip reminders are local. If you turn on a reminder for a trip, the app asks iOS for notification permission and schedules a single notification on your device for 8:00 the morning of the trip. We operate no push server, we hold no push token, and the reminder is delivered by iOS without contacting us.

On the website, your trip in progress, your concierge conversation, the analytics identifier, and the session identifier are held in your browser’s local and session storage. Our Cookie Policy lists those by name alongside the single rw_session sign-in cookie.

Why we use it

• to generate personalized recommendations and build and rebuild your itineraries;
• to let you save, view, share, and manage trips, ratings, and notes;
• to run the concierge chat and write the notes that appear on an itinerary;
• to rank nearby places by distance when you ask for them;
• to keep you signed in, and to verify a winery claim before we grant portal access;
• to protect the Service through rate limiting, request logging, and abuse investigation;
• to understand, in aggregate, how the product is used and which booking links are followed, including reporting attribution to winery and tourism partners;
• to maintain, secure, debug, and improve the Service;
• to comply with law and to establish, exercise, or defend legal claims.

We do not use your data to build advertising profiles, and we do not make decisions about you by automated means that produce legal or similarly significant effects.

Our analytics, and the trackers we do not use

Our analytics are entirely first-party. There is no Google Analytics, no advertising pixel, no session-replay tool, no crash-reporting or attribution SDK, and no third-party tag of any kind on the website or in the app. We do no cross-site or cross-app tracking, and we do not access the iOS advertising identifier or ask for App Tracking Transparency permission.

The Service records a small set of product events. The server accepts only these event names, and rejects anything else:

Each event carries the random analytics identifier, the platform when it comes from the app, and, on the website, any utm_ campaign values that were on the link you arrived through. Event properties are capped at 512 bytes. Events carry no name, no email address, no account identifier, and no IP address, and we do not join them to accounts.

What we send to Anthropic

Two features in the Service are written by a large language model, Anthropic’s Claude, called through the Anthropic API. In both cases content leaves our systems and is processed by Anthropic.

• The concierge. The full text of your messages in the conversation, up to sixteen messages of a thousand characters each, is sent to Anthropic along with a list of real wineries and restaurants drawn from our catalog. Do not type anything into the concierge you would not want processed by a third-party AI provider. We do not store the conversation.
• Itinerary notes. When we generate the copy for a trip, we send Anthropic the trip details for each day: your dates, group type and size, the age bands of any children, transport, budget, the requirements you flagged, your stated occasion and any detail you typed about it, your food and wine preferences, the name of your lodging if you gave one, your starting coordinates if you gave them, and the list of stops for that day.

Anthropic processes this content to return a reply or the itinerary copy. Under the commercial terms that govern our use of the Anthropic API, Anthropic does not use this content to train its models. Anthropic acts as our processor for this purpose.

Both features degrade rather than block. If the Anthropic API is unavailable, the concierge falls back to answers assembled from our own catalog, and itineraries ship with notes assembled from stop data.

Service providers and other recipients

We use a small set of service providers to run the Service, and we share personal information with them only as needed to operate it. We have no other data-sharing arrangements.

We may also disclose personal information when we are required to by law or valid legal process, when it is necessary to investigate abuse or protect the rights and safety of users, or in connection with a merger, acquisition, or sale of assets, in which case we will say so on this page before your information becomes subject to a different policy.

When you follow a booking link you leave the Service for a winery, restaurant, or activity site or a booking platform such as Commerce7, Tock, CellarPass, OpenTable, or Resy. Those sites handle your data under their own policies, not this one.

Booking-link attribution

When you tap a booking link, we record the click in our database: which itinerary, stop, winery, experience, or restaurant it was, the time, and the session identifier. We also append campaign parameters to the outbound web address. Those parameters carry the identifier of the itinerary and of the specific experience, so a partner can see that a booking came from route.wine and from which plan.

Those identifiers are random values from our database. They do not contain your name, your email address, or your account identifier, and we do not give partners a list of who you are. We may earn a referral or partnership fee for bookings that originate from the Service, and we report attribution to partners in aggregate rather than as a profile of you.

How long we keep data

Your choices and rights

Wherever you live, you can do the following, and we will not treat you differently for doing any of it.

• Use the Service without an account. Nothing in the core product requires one.
• Delete your account from inside the app or the website, which we cover in the next section.
• Delete saved trips at any time in the app or on the website.
• Turn location off in the iOS Settings app under Route Wine. Nearby now continues to work, centered on the region.
• Turn reminders off in the same place, or cancel a scheduled reminder from the itinerary screen.
• Clear what is on your device by clearing site data for route.wine in your browser, or by deleting the iOS app.
• Ask us for a copy of your data, a correction, or a deletion by emailing hello@route.wine. We do not yet offer a self-serve export, so we handle those requests by hand. We answer within 45 days for California requests and within one month for UK and European requests, and we will tell you if we need the extension the law allows. We verify a request by confirming control of the email address on the account, and we ask for nothing beyond that.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of, and we honor Global Privacy Control signals by default because we run no sale or sharing to begin with.

Deleting your account, and what happens to your trips

You can delete your account yourself, from the Account screen in the iOS app or from your account on the website. Because deletion is permanent, we ask you to re-enter your password first, so that someone holding your unlocked phone cannot erase the account.

Deleting the account immediately and permanently removes:

• your email address, password hash, and display name;
• every visit rating and every note you wrote;
• any winery claims you hold, and the edits you submitted through the portal;
• any email-verification records.

California privacy rights

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories we collect. Identifiers, including an email address, an IP address, and the random session identifiers described above. Internet or other electronic network activity information, including product events, booking-link clicks, and server logs. Geolocation data, in the iOS app only, and only as described under Precise location. Commercial information, in the sense of which booking links you followed. And other information you choose to provide, including a display name, quiz answers, trip parameters, ratings, notes, custom-stop notes, and concierge messages. We collect these from you directly and from your device. Our purposes are the ones listed under Why we use it, and the categories of third parties we disclose to are listed under Service providers.

Sensitive personal information. Precise geolocation is sensitive personal information under California law. We use it only to perform the Nearby now feature you asked for, which is a permitted purpose that does not trigger a right to limit its use, and we do not use or disclose it to infer characteristics about you.

No sale, no sharing. In the twelve months preceding the date of this policy, we have not sold personal information and we have not shared it for cross-context behavioral advertising, as those terms are defined under the CCPA and CPRA. We do not knowingly sell or share the personal information of anyone under 16. We use no third-party advertising or analytics trackers.

Your rights. You have the right to know what we collect and how we use and disclose it, to request a copy of it, to request correction, to request deletion, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. To exercise them, email hello@route.wine. You may use an authorized agent, in which case we will ask for written proof of the authorization. If we deny a request, you may appeal by replying to our response.

Legal bases for processing

Where the UK GDPR or the EU GDPR applies, we rely on the following legal bases.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you may object to that processing as described below. Where we rely on consent, withdrawing it does not affect processing already carried out.

UK and European privacy rights

If you are in the United Kingdom, the European Economic Area, or Switzerland, you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability of the data you gave us, and to object to processing we carry out on the basis of legitimate interests, including any processing for direct marketing, which we do not do. Where processing rests on consent, you may withdraw it at any time.

To exercise any of these, email hello@route.wine. We do not charge a fee unless a request is manifestly unfounded or excessive, and we will explain any refusal. You also have the right to complain to your national supervisory authority, or to the Information Commissioner’s Office in the United Kingdom.

We have not appointed a data protection officer. Our processing does not consist of large-scale systematic monitoring or large-scale processing of special categories of data, so one is not required. Privacy questions go to hello@route.wine, which is read by the person who operates the Service.

Where data is processed

We operate from the United States, and our hosting, database, email, and AI providers process data in the United States. The map-tile and routing services we call are operated by third parties and may run elsewhere. If you use the Service from outside the United States, your information is transferred to and processed in the United States, whose laws may not offer the same protections as your own.

For transfers of personal data out of the United Kingdom or the European Economic Area, we rely on the European Commission’s standard contractual clauses and the UK addendum, incorporated into our agreements with the providers that receive that data.

Not for anyone under 21

The Service plans visits to wineries and is about alcohol. It is for adults aged 21 and older. It is not directed to children, we do not knowingly collect personal information from anyone under 21, and we do not knowingly sell or share the personal information of anyone under 16, which we could not do in any case because we do not sell or share personal information at all. If you believe someone under 21 has given us information, email hello@route.wine and we will delete it.

You may tell us that children are travelling with you, in the form of age bands for the party, so that we can pick places that welcome them. That is information about your trip provided by an adult, and we do not use it to build a profile of a child.

How we protect data

We take the measures below. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

• Passwords are never stored in plain text. They are stored as bcrypt hashes. Verification codes for winery claims are hashed the same way, so the database never holds a usable secret.
• The sign-in cookie is cryptographically signed. The rw_session cookie carries an HMAC-SHA256 signature over the user identifier and expiry. Any tampering makes it invalid. It is marked HttpOnly, so page scripts cannot read it, SameSite Lax, and Secure in production, and it expires after 30 days.
• Traffic is encrypted in transit with TLS, on both the website and the app.
• State-changing requests are origin-checked to defend against cross-site request forgery.
• Rate limits sit in front of the sensitive endpoints: ten sign-in attempts and ten account-deletion attempts per address per ten minutes, eight sign-ups, five winery-claim starts, three verification-code resends, and ten concierge messages per minute. Verification codes expire after fifteen minutes and allow five attempts.
• Login does not reveal whether an email address is registered, because the password check runs at the same cost either way.
• Deleting an account requires the password, not just a valid session.
• Share tokens are long random values, not sequential identifiers, so a trip cannot be found by guessing.

Changes to this policy

We may update this policy as the Service changes. When we do, we will revise the “Last updated” date at the top of this page. If a change materially affects how we handle personal information already collected, we will give notice in the Service before the change takes effect, and where the law requires consent for the change we will ask for it. Earlier versions are available on request at hello@route.wine.

Contact

For privacy questions, or to make a request to access, correct, delete, or export your personal information, email hello@route.wine. Please say which surface you use, the website or the iOS app, and the email address on your account if you have one.