1. About this policy
1.1 Cellar Door Days (the Site) is operated by David, an individual based in New South Wales, Australia (we, us, our). We are responsible for the personal information handled as described in this policy.
1.2 In this policy, "personal information" has the meaning given in the Privacy Act 1988(Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.
1.3 By using the Site, you acknowledge that you have read this policy. If you do not agree with it, please do not use the Site or create an account.
1.4 You can contact us about privacy at hello@cellardoordays.com or through our contact page.
2. Summary
2.1 This summary is provided for convenience only and does not replace the detailed terms below.
- You can browse every venue, use the map and build a complete trip without an account.
- A trip you build is stored in your own browser and is not sent to us.
- An account requires only an email address. We do not ask for, or store, a password.
- Photos attached to a review have their GPS and camera metadata removed before storage.
- Analytics runs only if you accept it, and declining costs you nothing.
3. The personal information we collect, and why
3.1 If you browse without signing in
3.1.1 We do not collect information that identifies you. The venues you shortlist, the order of your stops, your chosen experiences and travel modes are stored in your browser's local storage. When you use "Share trip", the plan is encoded into the link itself; we do not receive a copy, and we cannot see a trip you have not shared with us.
3.1.2 Our infrastructure provider keeps short-lived technical logs of requests (including IP address, time, the page requested and browser type) as an ordinary part of operating the Site securely and diagnosing faults.
3.1.3 When you request a sign-in link, we use your IP address to apply rate limits that protect the Site against automated abuse and address enumeration. These counters are held only for a short window and expire automatically.
3.2 If you create an account
- Your email address. This is your account. We sign you in by emailing a single-use link that expires in 15 minutes, so there is no password to store, leak or reuse. An account is created only once you follow a link, so a mistyped address leaves nothing behind.
- A display name, if you choose to set one. It appears next to your reviews and does not have to be your real name.
- Sign-in and session records so that you remain signed in, together with the time of your last sign-in.
3.3 If you submit a review
- Your rating, title, review text, the date of your visit and the venue concerned.
- Any photos you attach. We remove EXIF metadata, including GPS coordinates, before the image is stored, so publishing a photo does not publish where you were or the device used.
- Reviews are checked before publication. Until a review is approved, it is visible only to you and to our moderators. A pending or rejected review, and its photos, are not shown to anyone else.
3.4 If you contact us
3.4.1 We collect whatever you choose to send us (such as your name, email address and the content of your message), and retain it for as long as needed to deal with the matter and keep a reasonable record of it.
3.5 Analytics
3.5.1 We use Google Analytics 4 to understand which regions, guides and pages visitors find useful. It does not load until you accept it. If you decline, no Google analytics script is fetched, no analytics cookie is set, and no analytics request is made to Google. The Site functions identically either way.
3.5.2 If you accept, Google sets cookies that recognise a returning browser and receives your IP address, the pages you view and general information about your device. We have disabled every advertising and personalisation signal, so this information is not used to build an advertising profile of you. You may withdraw consent at any time using "Cookie preferences" in the footer, which also clears the associated cookies.
4. Cookies and local storage
4.1 We use browser cookies and local storage for the following purposes: to keep you signed in (an HttpOnly session cookie); to protect forms against cross-site request forgery; and to remember the trip you are building, your chosen theme and your cookie consent choice. These are necessary for the Site to function and are not used to track you across other websites. Analytics cookies are separate, optional, and set only with your consent.
5. How we collect your information
5.1 We collect personal information directly from you (when you sign in, set a display name, submit a review or contact us) and automatically through your use of the Site (such as request logs and rate-limiting described in clause 3.1). We do not purchase personal information about you from third parties.
6. Disclosure to third parties
6.1 We do not sell your personal information, and we do not disclose it for the marketing purposes of others. We disclose it only to the service providers that operate the Site, and only to the extent needed for them to provide their service:
- Cloudflare, Inc. provides our hosting, database, file storage, content delivery, security and email delivery. Your sign-in link is sent through Cloudflare's email service, which receives your email address for that purpose. Cloudflare processes data on servers located outside Australia.
- Google LLC (Google Fonts). The Site loads its fonts from Google's servers. Each time a page loads, Google receives your IP address and general request information in order to serve those fonts. This is necessary to display the Site and is independent of analytics and of your cookie choice.
- Google LLC (Google Analytics). Analytics data is disclosed to Google only if you have accepted analytics. Google processes this information in the United States and other countries.
- Law enforcement agencies, courts and regulators, where we are required or authorised by law to disclose information.
7. Overseas disclosure (APP 8)
7.1 Some of the providers described in clause 6 are located in, or process data in, the United States and other countries. Using the Site therefore involves your personal information being handled outside Australia. We take reasonable steps to use providers that handle personal information in a manner consistent with the Australian Privacy Principles.
8. Publication of reviews
8.1 An approved review is public. Your rating, title, review text, visit date and any photos are published together with your display name. Your email address is never published.
8.2 You should treat an approved review as permanently public. Once published, it may be copied, cached or indexed by search engines and other services, and we cannot recall those copies.
9. Security
9.1 Traffic to and from the Site is encrypted in transit. We store no passwords. Sign-in links are stored only as a one-way hash, so a copy of our database cannot be used to sign in as you. Uploaded images are validated and stripped of metadata before storage, and a photo attached to an unapproved review can be retrieved only by the person who uploaded it.
9.2 No method of transmission or storage is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee its absolute security.
10. Retention
- Sign-in links: expire in 15 minutes, are single-use, and are swept shortly after.
- Sessions: retained until they expire or you sign out.
- Photos not attached to a review: deleted automatically.
- Account and reviews: retained until you ask us to delete them, or as otherwise required by law.
- Rate-limiting counters and request logs: short-lived and expire automatically.
11. Access and correction (APP 12 and APP 13)
11.1 You may ask us to:
- provide access to the personal information we hold about you;
- correct any personal information that is inaccurate, out of date or incomplete;
- delete your account, your reviews and your photos. You may also delete your own photos yourself at any time.
11.2 To make a request, contact us at hello@cellardoordays.com or through our contact page. We will respond within a reasonable time and will not charge you for making a request. We may need to verify your identity before acting on it.
12. Complaints
12.1 If you believe we have mishandled your personal information, please contact us first so we can investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
13. Children
13.1 The Site concerns visiting cellar doors and licensed premises and is intended for individuals aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have done so, please contact us and we will delete it.
14. Changes to this policy
14.1 We may update this policy as the Site changes. The date at the top records when it was last updated. Where a change is material, such as introducing a new form of tracking, we will seek your consent again rather than rely on a choice you made about something else.