Cella App Privacy Policy

1. Introduction

Cella ("Cella," "we," "us," or "our") is a wine recommendation mobile application published by Broderick Street Partners LLC, a California limited liability company. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Cella mobile application and visit our websites at cellawine.com and overdraftapps.com (collectively, the "Services").

By creating an account or using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services.

Contact: Broderick Street Partners LLC, 1830 Gough Street, San Francisco, CA 94109. Phone: (626) 770-3854. Email: info@overdraftapps.com

2. Age Restriction

Cella is intended exclusively for users who are 21 years of age or older in the United States, or the legal drinking age in their jurisdiction where that age is higher. Cella is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

By creating an account, you represent and warrant that you meet the applicable minimum age requirement.

3. Information We Collect

3.1 Information You Provide Directly

• Account information. When you create an account, we collect your email address to authenticate you. We use magic link (passwordless) or third-party OAuth sign-in — we do not create or store passwords.
• Taste quiz responses. We collect your answers to Cella's onboarding quiz, including your wine experience level, flavor preferences, typical budget range, color preferences, and occasion context. These answers are used to build your Taste Profile and assign your Wine Vibe archetype.
• Situational session inputs. Each time you use the scanning features, we collect your responses to brief session questions (such as current mood and budget override) to refine that session's recommendations.
• In-app feedback. If you rate a recommendation or submit feedback within the app, we collect that response.
• First name. If you provide your first name during onboarding, we store it to personalize your in-app experience.

3.2 Photos and Camera

When you use Cella's scanning features, you grant the app access to your device camera or photo library to capture or select an image of a wine label, wine list, or store shelf. Here is exactly what happens to that image:

• Before upload: The image is resized and re-encoded to JPEG format on your device by the app. This re-encoding process removes the original EXIF metadata from your photo, including any embedded GPS location coordinates, camera identifiers, and file timestamps. No dedicated metadata-stripping step is required because the re-encoding process does not carry forward the source file's EXIF block.
• Transmission: The re-encoded image is transmitted securely over HTTPS to Cella's backend processing service (Supabase Edge Functions) and then to our AI provider (Anthropic) solely to classify the image and generate your wine recommendation or bottle analysis.
• Storage by Cella: We do not save your photos to Cella's database or file storage. Photos are processed in memory to generate your result and are not retained in any Cella-controlled storage bucket or database table.
• Third-party handling: Our backend infrastructure provider (Supabase) and AI provider (Anthropic) may retain operational or technical logs related to processing requests — such as request metadata, timing, or error diagnostics — according to their own privacy policies and data retention schedules. We do not control their logging behavior. Links to their policies are in Section 5.1 below.

You may revoke camera and photo library permissions at any time through your device's system settings. Revoking these permissions will prevent you from using Cella's core scanning features.

3.3 Usage and Analytics Data

We collect information about how you interact with the Services, including:

• Features you use and screens you visit
• Scan types initiated and completed
• Recommendation feedback (helpful / not helpful)
• Quiz completion and drop-off events
• Session timing and frequency
• App version, device operating system type, and general device category

This data is collected through PostHog, our analytics provider. We do not include personally identifiable information (such as your email address) in analytics events. Events are associated with an anonymous identifier that is not linked to your email.

3.4 Subscription and Payment Data

We do not process or store your payment card information. Subscriptions are managed entirely through Apple App Store (StoreKit) and Google Play Billing. RevenueCat is used to track your subscription status and entitlements on our behalf. The only subscription-related information we store is your current subscription status and trial status fields, which are used solely to determine your access level within the app. For information about how Apple, Google, and RevenueCat handle your billing information, see their respective privacy policies.

3.5 Device and Technical Information

We may collect technical information including your device operating system version, app version, and general device type for purposes of operating and improving the Services. We do not collect your device's advertising identifier (IDFA/GAID) except as may be collected by analytics or attribution services operating under platform-level privacy settings you have separately configured on your device.

4. How We Use Your Information

We use the information we collect to:

• Authenticate your account and maintain your session
• Build and store your Taste Profile and Wine Vibe archetype
• Generate personalized wine recommendations and bottle analysis using AI
• Deliver situational recommendations based on your session inputs
• Process and manage your subscription status and entitlements
• Display personalized home screen content weighted to your Wine Vibe archetype
• Improve recommendation quality and overall app performance
• Respond to your feedback and support inquiries
• Comply with our legal obligations and enforce our Terms of Use
• Detect and prevent fraud, abuse, and security incidents

We do not sell your personal information to third parties. We do not use your information to serve you third-party advertisements inside the Cella app.

5. How We Share Your Information

5.1 Service Providers

We share information with third-party companies that help us operate the Services. These providers are contractually authorized to use your information only as necessary to provide their services to us and not for any independent purpose.

Provider	Purpose	Privacy Policy
Supabase	Database, authentication, backend functions	supabase.com/privacy
Anthropic	AI image classification and recommendation generation	anthropic.com/privacy
RevenueCat	Subscription management and entitlements	revenuecat.com/privacy
Apple App Store / StoreKit	iOS subscription billing and distribution	apple.com/legal/privacy
Google Play Billing	Android subscription billing and distribution	policies.google.com/privacy
PostHog	Product analytics (anonymized)	posthog.com/privacy
Expo / EAS	App build and deployment infrastructure	expo.dev/privacy

Future services we may add: We may engage additional service providers for purposes such as transactional email delivery, email marketing, crash reporting (such as Sentry), and mobile attribution analytics (such as AppsFlyer, Adjust, or Branch). We may also use advertising measurement tools from platforms such as Google, Meta, or TikTok in connection with marketing campaigns. We will update this Privacy Policy when we add new providers that materially affect how your information is handled.

5.2 Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or governmental authority, or if we believe in good faith that disclosure is reasonably necessary to protect the rights, property, or safety of Cella, our users, or the public.

5.3 Business Transfers

If Broderick Street Partners LLC is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will provide notice of any such change and any choices you may have regarding your information via email or a prominent notice within the Services.

5.4 With Your Consent

We may share your information for purposes not described in this Privacy Policy when we have obtained your explicit consent to do so.

6. Cookies and Website Analytics (cellawine.com and overdraftapps.com)

This section applies to our websites at cellawine.com and overdraftapps.com. It does not apply to the Cella mobile app.

What We Use

Our websites may use Google Tag Manager to manage analytics and marketing tags. Through Google Tag Manager, we may use, when configured:

• Google Analytics 4: Collects anonymized data about website traffic, including pages visited, time on site, and general geographic region. Google Analytics uses cookies to distinguish unique visitors. Data is processed by Google pursuant to their privacy policy at policies.google.com/privacy.
• PostHog: We may use PostHog on our websites, when configured, to understand website funnels such as which pages lead visitors to the app stores. PostHog's privacy policy is at posthog.com/privacy.

We may also deploy cookies or tracking technologies from the following categories of providers:

• Social integrations (Meta/Facebook): For social sharing integrations and, in the future, advertising measurement on Meta platforms.
• Advertising and attribution: We may in the future use advertising measurement pixels from platforms such as TikTok or Google Ads to evaluate the effectiveness of marketing campaigns. We will update this section when such tools are activated.

Types of Cookies

• Strictly necessary cookies: Required for basic website functionality. These cannot be disabled.
• Analytics cookies: Used to understand how visitors use the site. You may opt out by adjusting browser settings or using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• Marketing cookies: Used to measure advertising campaign effectiveness. Where required by applicable law, these are deployed only with your consent.

Your Choices

Most browsers allow you to refuse or delete cookies through their settings. Disabling analytics or marketing cookies on our websites will not affect your ability to use the Cella mobile app.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Services, subject to the following:

Data Type	Retention
Account / auth record (email, auth identity)	Retained until account is deleted
Taste Profile and Wine Vibe archetype	Retained until account is deleted
Subscription status fields	Retained until account is deleted; RevenueCat, Apple, and Google retain their own billing records per their respective policies
In-app feedback submissions	Retained until account is deleted (automatically removed via database cascade on account deletion)
Scan rate limit counters	Retained until account is deleted
Analytics events (PostHog)	Retained per PostHog's data retention settings; events are anonymized and not linked to your email address
Scan photos	Not stored by Cella; processed in memory during the scan request only (see Section 3.2)

8. Account Deletion

You may delete your Cella account at any time. Account deletion is permanent and cannot be undone.

How to Delete Your Account In-App

1. Open Cella and go to your Profile screen.
2. Tap Delete Account at the bottom of the screen.
3. Read the confirmation prompt and tap Delete Account to confirm.

Upon confirmed deletion, we will permanently delete:

• Your Supabase authentication record and associated email address
• Your Taste Profile, quiz answers, and Wine Vibe archetype
• Your in-app feedback submissions
• Your scan rate limit records

What is not deleted by Cella upon account deletion:

• Subscription records: RevenueCat, Apple, and Google retain billing and subscription history under their own data retention policies, which we do not control. Deleting your Cella account does not cancel an active subscription. You must cancel your subscription separately through your Apple ID or Google Play account settings before or after account deletion to stop future billing.
• Anonymized analytics: PostHog analytics events are anonymized at collection and are not linked to your email address. They are not deleted as part of account deletion.
• Infrastructure logs: Supabase and Anthropic may retain operational logs for limited periods in accordance with their own policies.

Account Deletion by Email Request

If you are unable to access the in-app deletion feature, you may request account deletion by emailing info@overdraftapps.com with the subject line "Account Deletion Request." Please include the email address associated with your Cella account. We will process your request within 5 business days.

9. Your Privacy Rights

California Residents

If you are a California resident, you may have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, and how we use and share it.
• Right to Delete: You may request that we delete your personal information, subject to certain legal exceptions. The in-app account deletion feature described in Section 8 is the primary mechanism for exercising this right.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you. You may update your Taste Profile at any time by retaking the quiz within the app.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information and do not share it for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at info@overdraftapps.com. We will respond within 45 days of a verifiable request. We may need to verify your identity before processing your request.

All Users

Regardless of your location, you may at any time:

• Update your Taste Profile by retaking the quiz in the app
• Delete your account as described in Section 8
• Contact us to ask questions about your data at info@overdraftapps.com

10. Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

• TLS encryption for all data transmitted between the app and our servers
• Supabase Row Level Security policies that prevent unauthorized cross-user data access
• Authentication via magic link or OAuth only — we do not store passwords
• API rate limiting to detect and prevent abuse
• API keys and credentials stored in server-side environment variables only — never exposed in the client application bundle

No method of electronic transmission or storage is 100% secure. While we work to protect your information using commercially reasonable means, we cannot guarantee absolute security. You use the Services at your own risk.

11. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party platforms and services. This Privacy Policy applies only to the Services operated by Broderick Street Partners LLC and does not apply to any third party. We encourage you to review the privacy policies of any third-party services before providing them with your information. We are not responsible for the privacy practices or content of any third-party service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by applicable law or platform policy, notify you through the app or by email to the address associated with your account. Your continued use of the Services after any update constitutes your acceptance of the revised Privacy Policy.

13. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, contact us at:

Broderick Street Partners LLC
1830 Gough Street
San Francisco, CA 94109
Phone: (626) 770-3854
Email: info@overdraftapps.com