Last updated 14 August 2026
Oenora keeps a private record of the wine you own, built from photographs of the labels. This policy states exactly what leaves your device, who receives it, and what is kept.
Label photographs are written to disk before any recognition runs. Your cellar is a versioned, restart-safe record on your own device. Photographs, OCR evidence, and working state stay local — they are not synced to iCloud.
When you ask Oenora to identify a label, the app sends to Oenora's recognition
service (bd-oenora-recognition.fly.dev):
Apple Vision OCR runs on your device. Structured identification does not, and we do not claim otherwise.
The recognition service is a stateless proxy. It forwards your label photographs and OCR text, with an identification prompt, to OpenAI's API, which returns structured results.
Each request sets "store": false, explicitly asking OpenAI not to
persist it. Beyond that, OpenAI's standard API data policy applies: API content
is not used to train their models, and they apply a short retention period for
abuse monitoring.
OpenAI is the only third party that receives your data.
Nothing. Recognition is proxied in memory with no disk writes. Requests are gated by a bearer token. Errors returned by the provider are read and discarded on the server so that no provider response fragment is relayed back to the app.
Every AI provider named on this page runs on someone else's servers. The intended destination is on-device — Apple's on-device models, with no request leaving your machine for this feature at all.
That is a statement of direction, not a description of today. On-device will be the only configuration ever described as on-device here, and only once it ships in a released build. Until then, what is written above is what happens.
The same host offers an optional backup. If you use it, an encrypted snapshot of your cellar and its image blobs is stored on a server volume.
The snapshot is encrypted with AES-GCM using a key derived from a recovery code held on your device. The server stores opaque ciphertext it cannot decrypt and never receives your recovery code.
Oenora syncs through your own private iCloud database
(iCloud.com.billdonner.oenora), in a single zone. There is no public
database. The developer cannot read any user's private database.
iCloud carries structured cellar metadata only — no photographs:
Label photographs, OCR evidence, recovery codes, and encrypted backups are deliberately excluded from iCloud.
Camera access photographs wine labels. Photo library access selects existing label photographs. Neither is used for anything else.
Oenora contains no analytics, advertising, or tracking SDKs. Nothing is collected for advertising, nothing is sold, and nothing is shared beyond the one provider named above.