How Liquor Cabinet handles your information

01

Scope & who we are

This Privacy Policy applies to the Liquor Cabinet mobile application (the "App"), our website at liquorcabinet.com.au (the "Website"), and any related services operated in connection with them (together, the "Service"). It's issued by James Farrer, trading as Liquor Cabinet ("we", "us", "our"), ABN 97 751 533 840, of New South Wales, Australia.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is written to apply that standard regardless of whether a specific small-business exemption might otherwise be available to us.

By creating an account or otherwise using the Service, you acknowledge the practices described in this policy. If you don't agree with them, please don't use the Service.

02

Age restriction

Liquor Cabinet catalogues and discusses alcoholic beverages. The Service is intended only for individuals who have reached the legal drinking age in their jurisdiction (18 years in Australia). To enforce this, we ask for your date of birth when you create an account and check it automatically before the account is created — we do not knowingly allow anyone under that age to create an account, and we do not knowingly collect personal information from children. If we become aware that we've collected personal information from someone below the legal drinking age, we'll take reasonable steps to delete it.

The same applies to the launch list on our Website: it's intended only for people of legal drinking age, and we'll delete any address we learn belongs to someone under it.

03

Information we collect

We only collect personal information that's reasonably necessary for the Service to work. What we collect depends on how you use the App:

Account information

• Email address and password, used to create and secure your account. Your password is never stored in plain text — it's hashed by our authentication provider before it ever reaches our database.
• If you choose to sign up or sign in with Apple, Google, or Facebook instead, that provider shares your name and email address with us as part of the sign-in (Apple lets you hide your real email behind a private relay address, which we support). We never see or store a password for these accounts — authentication happens entirely with the provider you chose.
• Your date of birth, collected at sign-up and checked automatically to confirm you meet the legal drinking age before your account is created (see Section 2).

Content you add

• Your bottle inventory: brand, product name, category, ABV, volume, stock level, purchase location/date/price, personal rating and notes.
• Photos you take or choose of your bottles, and photos a distillery account uploads for its own listing.
• Product favourites.
• Your Passport: which distilleries' products you've collected (detected automatically when a bottle you scan matches one) and which you've marked as visited in person.
• If you claim a distillery listing: the business contact name and note you submit with that claim, and any edits you make to that distillery's public info once approved.

Purchases & subscriptions

If you buy a paid feature or subscription, our payments provider (RevenueCat) links the purchase to your account using your account's unique ID, and records your entitlement/subscription status, the product you bought, and purchase or restore events. We never see or store your card details — those are handled entirely by the Apple App Store or Google Play.

Location

• Precise location — only when you use the nearby-stores or distillery-map features, and only with your device permission. This is sent to our backend to search for nearby results and isn't stored against your account afterward.
• Approximate location — derived automatically from your device's IP address by our analytics provider (city/country level, not GPS-precise) when you use the App, as part of standard usage analytics.

Device & diagnostic information

• Device model, operating system version, app version, and locale.
• Crash and error reports if the App fails unexpectedly, to help us fix bugs.
• Usage analytics linked to your account (not just an anonymous device ID): which screens you view, taps/interactions, and specific in-app milestones such as signing up or adding a bottle — used to understand which parts of the App are actually working for people.
• Whether you've granted notification permission. We don't currently send push notifications — this is requested during onboarding for possible future use, and no notification content exists yet.

We don't use session recording (no video-style replay of your screen is captured), and crash/error capture is handled by a separate diagnostics tool from our analytics tool — the two aren't merged.

Our Website

• Launch list. If you join the launch list, we collect the email address you enter, the date you joined, and a note that it came from the Website. You don't need an account to join, and nothing else is asked for.
• Website analytics. When you visit the Website, our analytics provider records the pages you view, basic interactions (such as joining the launch list), your browser and device type, and an approximate location derived from your IP address. It stores a small identifier in your browser (a cookie or local storage) so it can tell repeat visits apart. This isn't linked to an App account, and no session recording is used on the Website either.

04

How we use your information

We use personal information only for the purpose it was collected, or a purpose you'd reasonably expect given that context:

• To create and maintain your account, authenticate you when you log in, and verify you meet the legal drinking age before your account is created.
• To provide the App's core features: your cabinet inventory, your Passport, and the distillery marketplace.
• To identify a scanned bottle photo, which involves sending the photo to a third-party AI model (see Section 5) for processing.
• To find nearby bottle shops and distilleries, using your device's location if you grant that permission.
• To process in-app purchases and manage subscription entitlements to paid features.
• If you joined the launch list on our Website, to send you one email telling you the App is available on the App Store.
• To detect, diagnose, and fix bugs and crashes.
• To understand, in aggregate, how the App is used, so we can improve it.
• To enforce reasonable rate limits and protect the Service from abuse.
• To comply with our legal obligations.

We don't use your personal information to make automated decisions that have a legal or similarly significant effect on you.

05

Who we share it with

We don't sell personal information, and we don't share it with data brokers or advertisers. We do share it with a small number of service providers who help us run the App, each acting on our instructions and only for the purpose described:

If you sign in with Apple, Google, or Facebook, that provider authenticates you on our behalf and shares your name and email with us as part of that sign-in — that exchange is also governed by the provider's own privacy policy.

Referral program (built, not yet switched on): we've built, but haven't enabled in the App, a referral program that would let you earn a share of a friend's subscription if they sign up using your code. If we turn it on, redeeming a code would link your account to the referrer's account, and a percentage of any resulting subscription payment would be recorded as an earning for the referrer — a financial record that, once created, is kept even if either account is later deleted (see Section 8). We'll update this policy with full detail before switching this on.

We may also disclose personal information if required by law, to protect the rights or safety of any person, or in connection with a genuine business transaction such as a merger or acquisition (in which case we'd require the acquiring party to continue to protect it consistent with this policy).

06

Overseas disclosure

Every provider listed in Section 5 operates infrastructure in the United States, and personal information may be processed there and in other countries where these providers run their systems. Before using any overseas provider, we look for one with its own data protection and security commitments, but we can't guarantee an overseas recipient will handle information exactly as an Australian entity bound directly by the APPs would.

By using the Service, you consent to this overseas handling of your personal information as reasonably necessary to provide the App's core functionality (account access, sign-in, AI-assisted features, location search, purchases, crash diagnostics, and analytics).

07

Security

We take reasonable technical and organisational steps to protect the personal information we hold:

• All data in transit between the App and our backend is encrypted (HTTPS/TLS).
• Database-level access controls ensure your account can only read and write your own data — another user's app-level requests can't reach it.
• The Website can add an email address to the launch list, but the list can't be read back through the Website or the App. Only we can access it.
• Passwords are hashed by our authentication provider; we never see or store them in plain text, and we never see a password at all for accounts created via Apple, Google, or Facebook sign-in.

No method of transmission or storage is completely secure, and we can't guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we'll notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

08

Retention & deletion

We keep your personal information for as long as your account is active, and for a reasonable period afterward only where we have a genuine legal or operational reason to.

You can permanently delete your account at any time from within the App (Settings → Account → Delete account), after a two-step confirmation. Deleting your account:

• Permanently deletes your account credentials and every record tied to it — your bottle cabinet, Passport, favourites, and uploaded photos.
• Deletes your identity and event history from our analytics provider.
• A retailer price you've reported — shared, public content — may remain visible to other users after deletion, but is disassociated from your account and can no longer be traced back to you.
• Does not automatically delete your purchase/subscription history from RevenueCat or crash reports already sent to Sentry — those providers keep that data under their own retention practices. Contact us (Section 14) if you'd like us to request deletion from them on your behalf.
• If you were ever part of our referral program (see Section 5), any earning already generated from a purchase is kept, since it's a financial record — but it's disassociated from your other personal information.

You can also request deletion by contacting us directly (Section 14) if you're unable to use the in-app option.

Launch list. We keep launch-list email addresses only until we've sent the launch email, and then delete the list. You can ask us to remove your address at any time before then by contacting us (Section 14).

09

Access & correction

You can access and correct most of your own information directly within the App at any time — your inventory, Passport, profile details, and account email/password are all editable there. For anything you can't change yourself, or to request a copy of the personal information we hold about you, contact us using the details in Section 14. We'll respond within a reasonable period, and won't charge you for making a request, though we may need to verify your identity first.

If we refuse a request for access or correction, we'll tell you why and how you can complain about that decision.

10

Direct marketing

The App doesn't send marketing communications. The only emails it sends are transactional (sign-up verification codes, password reset codes, and account-change confirmations), which aren't marketing and don't require a separate opt-out.

The one exception is the launch list on our Website. By entering your email address there, you consent to us sending you a single email announcing that the App is available on the App Store. That's the only message we'll send to that address: we won't add it to any other list, and we won't share it with anyone except the providers in Section 5 who store it for us. The email will identify us and include a way to opt out, and you can ask us to remove your address before it's sent (Section 14).

If we ever want to send any other marketing, we'll only do so with your consent or as otherwise permitted by the Spam Act 2003 (Cth), and every message will include a clear way to opt out.

11

Children's privacy

The Service isn't directed at children and isn't intended for use by anyone under the legal drinking age (see Section 2). We don't knowingly collect personal information from children. A parent or guardian who believes their child has provided us with personal information should contact us so we can delete it.

12

Complaints

If you think we've mishandled your personal information, contact us first using the details in Section 14 — please include enough detail for us to understand and investigate the issue. We'll acknowledge your complaint promptly and aim to resolve it within 30 days.

If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be made in writing — their phone line is for enquiries about the process, not for lodging a complaint itself:

13

Changes to this policy

We may update this policy from time to time — to reflect a new feature, a new service provider, or a change in the law. We'll update the "Last updated" date at the top of this page whenever we do, and for a change that materially affects how we handle your personal information, we'll take reasonable steps to bring it to your attention (such as an in-app notice) before it takes effect.

14

Contact us

For any question about this policy, or to make a privacy request, reach us at: