Privacy Policy

1. Introduction

Vinyl Catalog ("we," "us," or "our") is a record collection management service operated by Joseph Condon. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, our iOS application, and our Android application (collectively, the "Service").

By using Vinyl Catalog, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Account Information

• First name and last name
• Display name
• Email address
• Password (stored encrypted, never in plain text)
• Apple ID identifier (if you sign in with Apple)
• Date format preference

Collection Data

• Albums and releases you add to your collection
• Condition ratings (media and sleeve), personal notes, and star ratings you assign
• Purchase details (price paid, date, location) if you choose to enter them
• Folders and organizational structures you create
• Wishlist items with priority levels, price thresholds, and notes
• Multiple copies of the same album, each with independent metadata
• Photos you upload of your own records (a Vinyl Catalog+ feature), which we resize before storing

Subscription Information

• Subscription status (free, active, expired, billing issue)
• Subscription plan and product identifier
• Subscription expiration date and renewal status
• Purchase source (App Store, web, etc.)
• Original purchase date
• If you installed the iPhone app from one of our Apple Search Ads advertisements: the campaign, ad group and search keyword that led to the install (see Section 4)

Subscription billing is managed by RevenueCat and Apple (for App Store purchases). We do not store your payment card details. See Section 4 for more information.

Automatically Collected Data

• Activity logs of collection changes (additions, removals, rating changes, condition updates) for your activity feed
• Basic request information (IP address, browser type) via standard server logs
• Approximate country (e.g. "US" or "GB"), derived from your IP address at signup or your first authenticated visit. We store only the two-letter country code on your account — your IP address itself is not saved to your profile. The lookup is performed by a third-party geolocation service (ipinfo.io). We use this information to prioritize language support and regional features.

Imported Data

If you use our CSV import feature, we process the uploaded file to add albums to your collection. The CSV file is processed on our servers and is not retained after the import is complete. Duplicate detection is performed automatically to avoid re-importing albums you already own.

Contact Form Data

If you submit a message through our contact form, we store your name, email address, message category, subject, and message body. This data is used to respond to your inquiry and is emailed to our support team. We also record the IP address of contact form submissions for anti-spam purposes.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Vinyl Catalog service
• Authenticate your account and secure your data
• Display your collection, statistics, and activity history
• Estimate collection values based on marketplace pricing data
• Manage your subscription status and feature access
• Send transactional emails (password resets, contact form confirmations)
• Respond to support inquiries submitted through the contact form
• Improve the service based on usage patterns
• Measure which of our Apple Search Ads advertisements lead to subscriptions

4. Third-Party Services

Discogs

We use the Discogs API to provide album, artist, and label information. When you search for or add a release, your search queries are sent to the Discogs API. We also periodically fetch marketplace pricing data from Discogs to provide condition-adjusted value estimates for your collection. Discogs has its own privacy policy. We cache release data and pricing information locally to reduce API calls and improve performance.

RevenueCat

Subscription billing and management is handled by RevenueCat. When you subscribe to Vinyl Catalog+, RevenueCat processes your payment (via Apple's App Store or Stripe for web purchases) and sends us subscription lifecycle events (purchase, renewal, cancellation, expiration). We store your subscription status but never your payment card details. RevenueCat's privacy policy governs their handling of your data.

When you first open the iPhone app, it asks Apple whether it was installed from one of our Apple Search Ads advertisements. This uses Apple's standard ad attribution, which needs no tracking permission and uses no advertising identifier. If the install came from an ad, Apple tells RevenueCat which campaign, ad group and search keyword led to it. If you subscribe, RevenueCat passes this to us with your subscription events and we keep it with your account. We use it only to count which advertisements bring subscribers, never to show you ads, and our copy is deleted with your account.

Image Storage

Album, artist, label, and master release images are downloaded and stored on Backblaze B2 cloud storage to ensure fast and reliable image loading. These are publicly accessible images sourced from Discogs.

Photos you upload of your own records (Vinyl Catalog+) are stored in the same Backblaze B2 storage. They are shown only to you and to a household partner you have linked with, and are never listed or shown to other users. Each photo is served from a long, unguessable address rather than from behind a login, so anyone you give that address to could open it. We resize every photo and save it again before storing it, so camera data embedded in the original, such as the location where it was taken, is not kept. When you delete a photo, we delete it from our storage; a copy cached by your browser or our content delivery network can remain for up to a day. We may review and remove uploaded photos to enforce our Terms of Service.

Email Service

We use SMTP2GO to send email. Your email address is shared with SMTP2GO solely for the purpose of delivery. We send two kinds of email:

• Account emails — password reset links, replies to messages you send us, and notices about your account. These are part of the service and cannot be turned off while you have an account.
• Product news and offers — occasional emails about new features and Vinyl Catalog+ offers. You can opt out at any time, either from the unsubscribe link in any such email or from Settings → Profile. We honor it immediately, and opting out never affects your account emails.

We keep a record of which addresses have unsubscribed, so that we don't email them again, and we record that a given message was sent to you and when. Vinyl Catalog itself adds no tracking pixels to its emails; SMTP2GO, as our delivery provider, may record delivery events such as bounces under its own privacy policy.

Apple Sign In

If you use Sign in with Apple, we receive and store only your Apple user identifier and, if you choose to share it, your email address. We verify your identity through Apple's authentication servers. Apple's privacy policy governs data on their end.

5. Data Storage and Security

Your data is stored in a MySQL database. We use industry-standard security measures including:

• Encrypted password storage (bcrypt hashing)
• HTTPS encryption for all data in transit
• Token-based API authentication (Laravel Sanctum)
• Per-user data isolation — you can only access your own collection
• Uploaded photos are resized and saved again without their embedded camera data, and stored under long, unguessable addresses

6. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your collection data is private to your account. Photos you upload are shown only to you and to a household partner you have chosen to link with — never to your followers or to other users. We share data with third-party services only as described in Section 4 (to provide core functionality such as billing, email delivery, and album data). We may disclose information if required by law or to protect the safety of our users.

7. Cookies and Local Storage

We use:

• Session cookies — to keep you logged in and maintain your session
• CSRF tokens — to protect against cross-site request forgery
• Local storage — to remember your appearance preferences (dark/light mode)

We do not use tracking cookies or third-party analytics cookies.

8. Your Rights

You have the right to:

• Access — View all data associated with your account through the app
• Update — Edit your profile information and collection data at any time
• Export — Download your collection data as a CSV file (available to Vinyl Catalog+ subscribers)
• Delete — Delete your account and all associated data (collection, photos you uploaded, activity history, folders, wishlist, ratings and play history) through the account settings, or by emailing us. Everything in that list is removed permanently and cannot be recovered. See Delete Your Account for the exact steps.

What We Retain After a Deletion

When you delete your account, we keep a single record of the deletion itself for security and fraud prevention. It contains your email address, display name, handle, country, the platform you signed up on, the number of albums you had, whether you had a Vinyl Catalog+ subscription and where it came from, and the dates you signed up and deleted. Nothing else about your account is kept, and this record is never used for marketing or shared with anyone. Delete Your Account lists it in full and explains how to ask us to remove that record too.

9. Children's Privacy

Vinyl Catalog is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us.