Privacy

Vinyl Bookcase is a place to keep your record collection. This page explains, in plain words, what the app stores, who can see it and how you stay in control. We don't sell your data, we don't show ads, and we don't use advertising or third-party analytics or tracking tools.

What we store

• Your account: your name, email address and profile photo link from Google when you sign in with Google, plus the display name, username, bio, favourite genres and artists, and photo link you choose. Our sign-in library also keeps the sign-in tokens Google issues for your account (not your Google password). If you sign in with Apple (where that option is offered), we receive the name and email address Apple chooses to share: Apple may give us your name only the first time you sign in, and your email may be a private relay address that forwards to your real one if you chose to hide it. We keep the tokens Apple issues in the same way (never your Apple password). If you use the mobile app we keep a record of each signed-in device: an optional device name (as the phone reports it, which may be a name you gave it), the platform, and when it was last used. These device records are kept until you delete your account; we don't currently remove old or signed-out ones sooner.
• What you add: your records and notes, wishlist, ratings and reviews, lists and mixtapes, followed artists, friends, shared shelves and messages (including the record or list you attach to a message).
• Settings: privacy choices, shelf appearance and feed preferences.
• Discogs import: if you import from Discogs, the Discogs username you enter, and which Discogs items you imported (we read your public collection — we never ask for your Discogs password).
• Feedback and reports you send us, including the page you were on and your browser or device description for feedback.
• Blocks you set.
• Usage events: a small set of product events (for example "added a record", "created a list" or "sent a message"), each with a timestamp and linked to your account, plus the time you were last active (updated at most once an hour). They contain no message text, notes or reviews. We use them only to understand which features help people. They are kept until you delete your account; we have not set a shorter retention period.
• Abuse protection: to limit automated abuse we keep request counters keyed by your account or, when you're signed out, your IP address. Each counter covers a window of one minute to one hour, but old counters are only cleaned up occasionally (they are deleted once they are more than a day old, at some point after that), so an IP address or account ID may stay in the database for longer than a day. Counters tied to your account are deleted when you delete it; counters keyed by IP address are not tied to you and are cleaned up on that same schedule.
• Server logs: our hosting provider keeps standard request logs (including IP addresses). We also log a short line for unexpected server errors: the request path (without query), the error type and the first part of the error text. We don't log cookies, headers or request bodies, but an error's own text could in rare cases include a fragment of what was being submitted.

Who can see what

You choose who can see your collection, ratings and wishlist: only you, your friends, or everyone (Settings → Privacy). New accounts start with friends-only for these, and new lists start private; lists have their own visibility. Private things are filtered out on our servers — they never appear in feeds, search, popularity charts or profile previews. Only collections you make public appear in community feeds. Your username, display name, photo and bio are visible to people who find your profile.

• Shared shelves: everyone on a shared shelf (up to four people) sees all the records that any of them owns on that shelf, and who owns each copy. Joining sends friend requests to the other members (they choose whether to accept). A shared shelf has an invite link, so anyone who has the link and is signed in can join while there is room — only share it with people you trust.
• Messages are visible only to you and the person you're talking to. Our admin tools don't display message text; a message only reaches us if someone reports it and describes it in the report details. (As with any hosted service, the database itself holds messages in readable form.)
• Gift reservations: when a friend reserves something on your wishlist, you can't see it, but your other friends who can see the wishlist can.
• People who run the service (a small list of administrators) can see aggregate usage numbers, reports and feedback, which include the details people write in them.

Services we rely on

• Vercel hosts the website and API.
• Neon hosts the database (in the EU, in its Frankfurt-area region).
• Google handles sign-in. We receive your name, email and photo link; we never see your Google password.
• Apple, if you sign in with Apple (where offered), handles that sign-in. We receive the name and email Apple shares (possibly a private relay address) and never see your Apple password. We don't send email to relay addresses today, and we don't use anything from Apple for advertising or tracking. If you delete your account we also ask Apple to revoke the sign-in tokens it issued to us; you can also stop using Sign in with Apple for Vinyl Bookcase at any time in your Apple ID settings. Apple's own privacy policy covers what Apple does.
• Discogs provides album details. When you search or import, our servers send Discogs the search text or the Discogs username you entered. Cover images are loaded from Discogs' servers, so your browser contacts Discogs when showing them.
• MusicBrainz and Cover Art Archive are used to find the matching Spotify album and for new-release suggestions for artists you follow. Our servers send only artist and album titles and artist identifiers, never anything else about you. On the Discover page your browser loads cover images from the Cover Art Archive, which may pass the request on to servers of the Internet Archive that hosts it, so those services can see your IP address. Our pages ask browsers not to send a referring page address with image requests.
• Spotify only when you choose "Listen on Spotify" — that opens Spotify or its website; we don't connect to your Spotify account.
• Profile photos: a profile photo is a link to an image hosted by Google, Gravatar, GitHub or Discogs (we only accept those). Whoever views a profile has their browser load the photo from that host, so that host can see the viewer's IP address.

We don't load third-party scripts, fonts or trackers. These services have their own privacy policies.

Cookies and storage

We use only the cookies needed to keep you signed in and to protect sign-in: Auth.js session and security cookies on the website (a sign-in lasts up to 30 days), and a short-lived (15 minutes) cookie while you sign in to the mobile app. The site remembers one display choice on your wishlist page in your browser's local storage. The mobile apps keep their sign-in tokens in the phone's secure storage, plus a cache of recently viewed data and artwork on the phone for offline use (the data cache is separate per account and cleared when you sign out). If you download your data in the mobile app, the file is created temporarily on your phone and handed to the app you choose in the share sheet. We don't use advertising or tracking cookies, so there is no cookie banner.

Your controls

• Download your data at any time: Settings → Your account. The file includes your profile and settings, collection with notes, wishlist, ratings and reviews, lists, followed artists, friends and shared shelves (other people by name only), your conversations, and the feedback you sent, plus which sign-in provider you use. It doesn't include usage events, reports, blocks, signed-in device records, sign-in tokens or abuse-protection counters.
• Delete your account from the same place on the website, or in the mobile app under Settings → Delete account. Deletion is immediate and permanent. See below for exactly what goes and what stays.
• Sign out everywhere ends every session on every device.
• Block or report anyone from their profile (see Safety below).

When you delete your account

To delete your account, sign in and use Settings → Your account on the website, or Settings → Delete account in the mobile app. If you can't sign in, contact us at the address in the Contact section below from the email address on the account and ask us to delete it; we may need to confirm it is you.

• Removed: your profile, records that only you own, wishlist, ratings and reviews, lists, bookmarks, followed artists, friendships, blocks, sign-in records (including stored Google or Apple sign-in tokens and signed-in device records), usage events, and your gift reservations on other people's wishlists.
• Conversations are deleted for both sides, including the messages you sent, because a chat with a deleted account can't continue. The other person loses that history.
• Shared with others: records you co-own stay on the other owner's shelf, and copies you added for someone else stay with them. A shared shelf you started passes to another member (or is deleted if nobody else is on it).
• Kept without a link to you: feedback you sent (the text, page and device description stay, but your account link is removed), and reports you filed or that were filed about you (the reason and details stay for moderation, but the link to you is removed). Please don't put information in feedback or report details that you wouldn't want kept. We also keep a count that an account was deleted, with no account ID.
• Not covered by deletion: hosting logs, and database backups and history held by our database provider, which are kept for a limited time and then rotate out. Shared catalogue data about albums (artist, title, cover link) isn't personal and stays.

Safety: blocking and reporting

When you block someone, any friendship or request between you ends, gift reservations between you are released, and neither of you can find, message or open the other's profile. When you report a person, message, list or review, we store who reported, who it was about, what was reported, the reason and any details you add, so we can review it. Reports are visible to the administrators only.

How long we keep things

Your account and content are kept until you delete them or your account. Usage events and signed-in device records are kept until you delete your account. Abuse-protection counters are cleared out on a rolling schedule (see above). Backups and history held by our database provider may contain deleted data for a limited period until they rotate out.

Where your data is stored

The database is hosted in the EU. The website and API run on Vercel's network, and the services listed above may process data in other countries, so if you use Vinyl Bookcase from outside the EU or the countries where those services run, your data will travel. We haven't yet had this reviewed for any particular country's rules.

Your rights

Depending on where you live (for example in the EU or UK), you may have legal rights over your data, such as to access it, correct it, have it deleted, object to or restrict how it is used, receive a copy, or complain to your local data protection authority. Most of this you can do yourself under Your controls above; for anything else, contact us. This section is a plain-language summary awaiting legal review.

Children

Vinyl Bookcase isn't intended for children under 13 (or the minimum age for online services where you live). If you think a child has created an account, contact us and we'll remove it.

Changes to this policy

When we change what the app stores or who it shares data with, we'll update this page and its "last updated" date. For significant changes we'll also make it visible in the app.

Contact

Questions or requests about your data: support@vinylbookcase.com.