Privacy
What leaves your phone, and what doesn’t.
Written to be checked rather than trusted. Every line below names the part of the app it describes.
Your bottles stay here
Your library lives on your phone. Punt provides no server copy of the complete library, sync or backup. Individual requests send the content described below to other companies. Deleting the app removes its local library.
Signing in
Sign in with Apple is optional. If you choose it, Punt asks Apple for your name and email and keeps the returned details in your phone’s Keychain. They are not sent to Punt’s backend or its model providers. Apple handles sign-in and checks whether your authorization remains valid.
You can choose “Continue without signing in” on the first screen. Signing in does not unlock or sync your library.
What does leave
Punt’s identification and wine lookup use external services. Here is all of it.
| What | Where it goes, and why |
|---|---|
| Your label photographWineIdentifier.swift, WineEnricher.swift | Punt sends it for two jobs through Vercel. OpenAI reads the name. OpenRouter passes it to Perplexity to look up the wine with the photograph, because a half-read name can find the wrong bottle. |
| The words Punt read off the labelLabelText.swift | Your phone reads the label and sends those words to Punt's own service. They are never put in front of a model. The service compares them with the answer for diagnostics; that comparison does not block a result. |
| Your spoken memoryMemoryCapture.swift | Goes through Vercel to OpenAI to be turned into words, with the wine’s name when it is known. OpenAI’s published transcription policy lists no retention of the recording. |
| The wine's name and factsWinePortrait.swift, WinePlate.swift | Go through Vercel to OpenAI when Punt draws a bottle’s vineyard model and engraved plate. Your photograph is never part of those. |
| Your bottles, when you open NextNextAdvisor.swift | Up to forty of them go through Vercel to OpenAI as facts, with your reaction to each, plus up to four sentences the app wrote about your taste. The names and producers of remaining bottles also reach Vercel, but are not forwarded to OpenAI. The app checks suggestions against your full library before showing them. Punt uses them to suggest wines that follow from what you have actually liked. No photographs and no notes are included. |
| A signature from your phoneAppAttestation.swift | Apple’s proof that this is a copy of Punt goes to Vercel, which returns a short-lived access token. Punt’s service does not store the proof or its key identifier. |
| Three product milestones from build 49 onwardActivationMilestones.swift, milestone.js | First bottle saved, third bottle saved, and the first time the free drawing limit offers the price screen. The body includes the app version and no wine, note, photograph, account, device, source or country. Vercel still receives the connection metadata described below. |
Who receives it
Five companies, and it is worth being exact about which does what, because they keep what they are sent for very different lengths of time.
| Company | What it does, and how long it keeps it |
|---|---|
| OpenAI | Reads your label, transcribes your spoken memory, draws both pictures, and writes the Next suggestions. OpenAI says label and picture requests may be retained for misuse checks for up to 30 days, with legal and safety exceptions. Its transcription policy lists no retention. Its published default stores Next response data for at least 30 days. |
| OpenRouter | Carries the wine lookup — the photograph and the question — to Perplexity. OpenRouter says it does not keep the photograph except for billing, security, misuse prevention or legal needs, and gives no fixed period for the wine's name. |
| Perplexity | Does the actual looking up: searches the web for the wine and writes what comes back. Perplexity says it keeps nothing from these API requests and does not train on them. |
| Vercel | Runs Punt's service and receives requests to that service first. Vercel says Hobby request logs remain for one hour. They contain IP-derived coarse location and backend diagnostics linked to the request. Punt declares both to Apple as linked to you and used for App Functionality. They are not used for tracking. |
| Neon | Stores only daily totals for three milestones and short-lived one-way deduplication guards. Event guards become eligible for deletion after seven days; token quota guards become eligible at signed-token expiry; daily totals become eligible after 24 months. A bounded daily cleanup then removes eligible rows, and its health check stops reporting if cleanup is more than 48 hours late. Neon says backups may remain for 30 days. |
Vercel Privacy Notice· Vercel Runtime Logs· Neon security overview· OpenAI data controls· OpenRouter Privacy Policy· Perplexity API privacy
How long it is kept
Punt’s database does not store your wine, note, photograph, account or device. It stores daily milestone totals that become eligible for deletion after 24 months, one-way event guards eligible after seven days, and one-way token quota guards eligible at signed-token expiry. A bounded daily cleanup then removes eligible rows. Punt declares the milestones to Apple as Product Interaction used for Analytics. They are not linked to you and not used for tracking.
Each lookup asks OpenRouter to use only an inference provider with a zero-retention policy. The request fails if no eligible provider is available. This does not control OpenRouter’s own logging; its account setting has not been verified.
One honest limit on that. Looking a wine up means putting a question in front of a search index, and no retention setting reaches that far. The searching itself is ordinary web searching, with everything that implies.
Location embedded in a photograph is stripped before it leaves your phone. The image is re-encoded, so the copy carries no place or timestamp from the original. Separately, Vercel derives city and country from the connection address and retains it with backend diagnostics for one hour.
What is not measured
The milestone totals contain no wine, note, photograph, account, device, source or country. They cannot be used to identify a person or answer which person completed a milestone. Vercel's one-hour request log is separate from those totals and is disclosed above.
Purchases and sharing
Apple handles payment. It also sends signed purchase and refund notices to Punt’s service. The service checks them and writes transaction identifiers, the product, storefront and dates to Vercel’s logs. It creates no purchase database and receives no Apple Account name or email through those notices.
Sharing sends the picture or film, including your memory line if present, to the app you choose. Punt makes it from pictures already on your phone. Looking up a Next suggestion opens Google with that wine’s name when you tap the link.
This website is not the app
punt.wine contacts Google Analytics only after you give permission. Before that choice, it sends Google nothing. If you allow it, Google receives the page you visited, its referrer, basic browser and device information, and coarse location derived from your network address. Google may use that address while processing the visit but does not log or store the raw address.
For App Store taps, Punt sends one additional event: the tap and which of Punt’s six page positions its App Store link came from. It sends no wine, note, photograph, email, account, or app activity. Google Signals, advertising personalization, detailed location and device reporting, User-ID, user-provided data, and cross-domain tracking are off. There is no general app analytics SDK and no session-recording tool.
Google Analytics uses a first-party cookie after permission and retains event and user data for two months. Your choice is saved in this browser. You can withdraw permission here at any time; later pages will not load Analytics.
How Google Analytics handles data
Asking
Write to hello@punt.wine. Deleting the app removes your library because Punt stores no server copy of it. Daily milestone totals cannot be linked back to a person or deleted by person.
Last updated 20 September 2026. Checked against build 52 source and the current backend source.