Privacy Policy | VinylBox

VinylBox is operated by Daven Gomes trading as VinylBox (“VinylBox”, “we”, “us”, or “our”).

This Privacy Policy explains how we collect, use, store, disclose, and protect information when you use the VinylBox mobile app, website, services, account features, subscription features, Discogs integration, album scanning features, and related services.

If you have any questions about this Privacy Policy or your personal information, you can contact us at:

Daven Gomes trading as VinylBox
Unit 137633, PO Box 7169
Poole, BH15 9EL
United Kingdom
Email: contact@vinylbox.app

1. Summary

VinylBox helps users catalogue, organise, scan, value, and manage vinyl records, CDs, cassettes, and other music-related items.

Depending on how you use VinylBox, we may process information such as your account details, collection data, Discogs account information, album scan information, private cover images, subscription status, app usage data, crash logs, and support messages.

Discogs connection is optional. If you connect Discogs, VinylBox accesses Discogs through the Discogs API to provide the features you choose to use. Discogs remains responsible for your Discogs account and data held by Discogs.

Album-cover photos submitted for scanning are used to identify albums or releases. We do not store photos submitted only for scanning after the scan has been processed. If you use VinylBox without Discogs sync, we may store a private cover image for items in your VinylBox collection so your collection can be displayed in the app.

We do not sell your personal information for money. We may use analytics, crash reporting, subscription management, advertising attribution, and other service providers to operate and improve VinylBox, as described below.

2. Who this policy applies to

This Privacy Policy applies to users of VinylBox and visitors to our related websites or support channels.

VinylBox is not intended for children under 13. If you are under 13, you must not use VinylBox. If you are under the age of majority in your country or region, you should use VinylBox only with permission from a parent or guardian.

3. Information we collect

The information we collect depends on the features you use.

3.1 Account and authentication information

When you create or use a VinylBox account, we may collect and process:

your VinylBox account identifier;
your authentication status;
your Sign in with Apple identifier;
your email address, if you choose to share it with us through Sign in with Apple;
anonymous or session-based account identifiers before full account creation;
account settings and preferences;
login/session information;
account creation, login, and activity timestamps;
information needed to secure, operate, and manage your account.

We use Supabase Auth and related backend services to help provide account, authentication, database, and storage features.

Anonymous or session-based accounts are intended to support temporary app usage before full account creation. They may not provide permanent storage or cross-device sync unless you create an account.

3.2 Discogs information

If you choose to connect your Discogs account, VinylBox may collect and store information needed to connect to Discogs and provide Discogs-related features, including:

Discogs authentication token and secret;
Discogs username;
Discogs user ID;
Discogs account preferences, such as currency or region settings;
Discogs collection, wantlist, folders, inventory, listings, orders, messages, marketplace information, and related metadata;
information returned by the Discogs API when you use Discogs-connected features.

We may retrieve, cache, or store a copy of some Discogs-derived information so VinylBox can display, sync, search, back up, or improve Discogs-connected features. Discogs remains responsible for data stored by Discogs.

You can disconnect Discogs in VinylBox. When you disconnect Discogs, we delete the Discogs access token and secret stored by VinylBox. Disconnecting Discogs does not delete your Discogs account or data held by Discogs.

3.3 Collection and catalogue information

When you catalogue items in VinylBox, we may collect and process information such as:

albums, releases, artists, titles, barcodes, catalogue numbers, labels, formats, years, genres, styles, and identifiers;
collection and wantlist items;
folders, tags, lists, notes, comments, ratings, and custom fields;
media condition, sleeve condition, purchase date, purchase price, sale price, estimated value, and related collection metadata;
scan history and match results;
whether an item was added manually, through barcode scanning, album-cover scanning, Discogs sync, import, or another feature;
metadata needed to sync, display, organise, search, export, or back up your collection.

If you use VinylBox without Discogs sync, your collection data may be stored by VinylBox using our backend providers.

If your collection is stored on Discogs, VinylBox may query Discogs to display and manage that information, but Discogs controls the Discogs account and data held by Discogs.

3.4 Album-cover scanning, camera, and photos

VinylBox may allow you to scan album covers, take photos, or choose photos from your device to help identify albums or releases.

When you use album-cover scanning:

the photo you provide is processed to identify the album or release;
the photo may be sent to our service providers for image analysis, safety checks, and matching;
we do not store photos submitted only for scanning after the scan has been processed;
we do not store scan-generated image analysis data tied to you after it has been used for the matching request, unless necessary for security, abuse prevention, debugging, or legal reasons;
scan results may be used to show possible album or release matches.

If you use VinylBox without Discogs sync, we may store one private cover image for items in your VinylBox collection so your collection can be displayed in the app. These stored cover images are private by default and are not public unless you choose to use a sharing or public-profile feature.

If you use Discogs sync, we generally do not store your uploaded album-cover photos for your collection. Instead, VinylBox may display images and data available through Discogs or other metadata sources.

We may use automated checks to detect, block, or reject images that appear to contain illegal, harmful, abusive, or otherwise prohibited material. We do not generally use human review for album-cover scanning images, but we may review limited technical, account, or support information where necessary for security, abuse prevention, legal compliance, or support.

3.5 Subscription and purchase information

VinylBox offers subscriptions and other paid features through Apple’s in-app purchase system.

Payments are handled by Apple. We do not receive your full payment card details.

We may process subscription and purchase-related information, including:

product identifiers;
subscription status;
trial, renewal, cancellation, expiry, and entitlement status;
transaction or receipt identifiers;
country, currency, price, and offer information where available;
purchase and subscription events used for analytics, entitlement management, customer support, fraud prevention, and advertising attribution.

We use RevenueCat to help manage offerings, subscriptions, entitlements, purchase analytics, and related subscription functionality. Apple handles payment processing and refunds according to Apple’s terms and policies.

3.6 Analytics and app usage information

We use analytics to understand how VinylBox is used, improve features, fix problems, measure performance, and make better product decisions.

Analytics information may include:

app launches, screen views, feature usage, taps, scans, searches, sync activity, and subscription funnel events;
device type, operating system, app version, language, region, and general technical information;
pseudonymous or internal user identifiers;
account or subscription state where relevant to product analysis;
aggregated or statistical usage information.

We may use analytics providers such as Mixpanel, RevenueCat, and similar service providers.

We try to avoid sending unnecessary personal information to analytics providers. We do not intentionally send Discogs authentication tokens, Discogs secrets, uploaded album photos, private notes, or full payment details to analytics providers.

3.7 Crash reporting, diagnostics, and security logs

We use crash reporting and diagnostics tools to understand and fix crashes, bugs, errors, performance problems, and security issues.

This information may include:

crash logs;
stack traces;
error messages;
app state or diagnostic breadcrumbs;
device model, operating system, app version, language, and region;
timestamps and technical identifiers;
server logs, IP address, request metadata, and security events.

We may use providers such as Sentry and similar service providers for crash reporting and diagnostics.

3.8 Advertising and attribution information

We may use advertising and attribution providers to understand how our advertising performs and to measure return on advertising spend.

Depending on your device settings, consent choices, and applicable law, this may include:

install and app-open attribution;
campaign, ad network, and referral information;
subscription or purchase events;
device identifiers, advertising identifiers, or vendor identifiers where permitted;
approximate region, device type, operating system, and app version;
event data needed to measure ad performance.

We may use providers such as AppsFlyer, Meta, Google, Apple, and similar advertising or attribution partners.

We do not sell your personal information for money. We may share limited identifiers, device data, and event data with advertising and attribution partners to measure advertising performance, subject to your App Tracking Transparency choice, device settings, and applicable law.

If Apple’s App Tracking Transparency prompt is shown, you can choose whether to allow tracking. If you deny tracking, we will limit tracking according to Apple’s rules and your device settings.

3.9 Support communications

If you contact us for support, we may collect and process:

your email address;
your name if provided;
your message;
screenshots, logs, or attachments you choose to send;
account, subscription, device, app version, or diagnostic information needed to help with your request.

We do not currently send email marketing. We may send transactional or service-related messages, such as replies to support requests, account-related notices, important service updates, privacy notices, or legal notices.

3.10 Push notifications

VinylBox may offer push notifications in the future. If we do, notifications will be controlled by your device settings and any in-app notification preferences we provide.

Push notification information may include device notification tokens and notification preferences. You can disable push notifications in your device settings.

3.11 Public or shareable features

VinylBox may add features that allow you to make parts of your collection, profile, lists, or listings public or shareable.

These features will be optional. If you choose to use them, the information you choose to share may be visible to other people. Do not make information public unless you are comfortable with others seeing it.

3.12 Website cookies and similar technologies

Our website uses a small number of cookies and similar technologies, such as your browser’s local storage and session storage:

to remember your choices on the site, such as your cookie choice and whether you dismissed the language suggestion;
where you allow it, or where the law does not require your consent, to measure how visitors find VinylBox and how our advertising performs, using providers such as Google. This includes noting, for the rest of your visit, that you arrived from one of our ads. We store only that fact, not any click identifier, and we do not use it to personalise ads.

Links to the App Store carry the name of the page and button you used, so Apple can tell us, in aggregate, how many people download VinylBox from our website.

Visitors in Europe are asked before measurement cookies are used. You can change your choice at any time in Cookie settings at the bottom of any page, or by clearing your browser’s storage for vinylbox.app. Session storage is cleared when you close the tab; your cookie choice stays on your device until you clear it.

4. How we use information

We use information for the following purposes:

to provide, operate, maintain, and improve VinylBox;
to create and manage accounts;
to authenticate users;
to connect to Discogs when you choose to do so;
to catalogue, sync, display, organise, export, and manage collections;
to provide barcode scanning, album-cover scanning, image analysis, and matching features;
to store private cover images where needed for non-Discogs collection features;
to provide Discogs seller tools, listings, orders, messages, and marketplace management features through the Discogs API;
to process subscriptions, manage entitlements, and provide paid features;
to provide customer support;
to analyse app usage and improve the app;
to diagnose crashes, errors, and performance problems;
to secure the app and prevent fraud, abuse, spam, illegal activity, or misuse;
to measure advertising performance and attribution;
to comply with legal obligations and enforce our terms.

5. Legal bases for processing

If UK or EEA data protection law applies, we rely on the following legal bases:

Contract

We process information where necessary to provide VinylBox and its features, including account creation, collection storage, Discogs integration, scanning, subscription entitlements, support, and app functionality.

Legitimate interests

We process information where necessary for our legitimate interests, including improving VinylBox, understanding usage, fixing bugs, securing the service, preventing abuse, measuring performance, and managing our business, provided those interests are not overridden by your rights and interests.

We rely on consent where required, including for certain device permissions, App Tracking Transparency choices, optional sharing features, or other processing where consent is legally required.

Legal obligation

We process information where necessary to comply with legal, regulatory, tax, accounting, consumer protection, security, or law-enforcement obligations.

We may share information with the following categories of recipients.

Service providers

We use third-party service providers to operate, secure, analyse, and improve VinylBox. These may include providers for hosting, authentication, database storage, file storage, analytics, crash reporting, advertising attribution, subscription management, image recognition, AI-assisted image analysis, customer support, security, and logging.

Examples may include Apple, RevenueCat, Supabase, Discogs, Mixpanel, Sentry, AppsFlyer, Meta, Google, Jina, and similar providers, depending on the features you use and the services we use at the time.

Discogs

If you connect Discogs, we share information with Discogs through the Discogs API as needed to provide the Discogs-connected features you choose to use. Discogs’ own privacy policy and terms apply to Discogs accounts and Discogs-controlled data.

Apple and RevenueCat

Subscription payments are handled by Apple. We use RevenueCat to manage subscription offerings, entitlements, purchase status, and related analytics.

Advertising and attribution partners

Where permitted by your device settings, App Tracking Transparency choice, and applicable law, we may share limited event, device, subscription, and attribution information with advertising and attribution partners to measure advertising performance.

Legal, safety, and business reasons

We may disclose information if we believe it is reasonably necessary to:

comply with law, legal process, or regulatory requests;
enforce our terms;
protect the rights, safety, and security of users, VinylBox, or others;
detect, prevent, or investigate fraud, abuse, security issues, or illegal activity;
respond to disputes or legal claims;
support a business transfer, merger, acquisition, restructuring, or sale of assets, subject to appropriate safeguards.

7. Discogs-controlled data

Discogs is a separate service. If your collection, wantlist, inventory, listings, orders, messages, marketplace activity, or account information is stored by Discogs, Discogs controls that data.

VinylBox may query, display, manage, or sync Discogs data through the Discogs API when you connect Discogs and use Discogs-connected features.

Deleting your VinylBox account or disconnecting Discogs does not delete your Discogs account, Discogs collection, Discogs listings, Discogs orders, Discogs messages, marketplace history, or any other data controlled by Discogs. To manage or delete data held by Discogs, you must use Discogs’ own account, privacy, and support tools.

8. Retention

We keep information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods vary depending on the type of information and how you use VinylBox.

Account and collection data

If your VinylBox collection is stored by VinylBox, we keep it while your account is active or as needed to provide the service.

If you delete your VinylBox account, we delete or anonymise the account data and collection data we control, unless we need to retain limited information for legal, security, fraud-prevention, accounting, backup, or dispute purposes.

Discogs tokens

If you disconnect Discogs or delete your VinylBox account, we delete the Discogs access token and secret stored by VinylBox, unless we need to retain limited information for legal, security, or abuse-prevention reasons.

Album-cover scan photos

We do not store photos submitted only for album-cover scanning after the scan has been processed.

If you use VinylBox without Discogs sync, we may store private cover images for items in your VinylBox collection until you delete the item, remove the image, delete your account, or the data is otherwise deleted under this policy.

Inactive accounts

If you use VinylBox without Discogs sync, or if you use an anonymous or session-based account, we may delete or anonymise your account and collection data after 180 days of inactivity.

“Inactivity” generally means that you have not opened the app, signed in, synced, scanned, edited your collection, or otherwise used VinylBox during that period.

Where we have a valid email address for you, we may send a notice before deleting inactive account data. We may not be able to contact anonymous users or users who have not provided an email address.

We do not intend to delete active paid subscription account data solely for inactivity while your subscription remains active, except where required for security, legal, operational, or abuse-prevention reasons.

Backups

Deleted data may remain in encrypted backups for up to 60 days before those backups are overwritten or deleted in the ordinary course of business. We do not use backup copies for active product, marketing, or analytics purposes.

Analytics, diagnostics, and logs

Analytics, crash, diagnostic, security, and server log data may be retained for as long as reasonably necessary to understand usage, improve the app, fix bugs, maintain security, prevent abuse, resolve disputes, and comply with legal obligations. We may aggregate or anonymise this data.

9. Account deletion and your choices

You can request deletion of your VinylBox account in the app.

When your VinylBox account is deleted, we delete or anonymise the account information and collection data that we control, including stored VinylBox collection data, private cover images stored by VinylBox, and Discogs access tokens stored by VinylBox, unless we need to retain limited information for legal, security, fraud-prevention, accounting, backup, or dispute purposes.

Deleting your VinylBox account does not automatically cancel your Apple subscription. You must manage or cancel subscriptions through your Apple account or App Store settings.

Deleting your VinylBox account does not delete your Discogs account or data controlled by Discogs. You must manage or delete those directly with Discogs.

You can also:

disconnect Discogs in the app;
manage camera and photo permissions in your device settings;
manage App Tracking Transparency choices in your device settings;
manage subscriptions through your Apple account or App Store settings;
contact us at contact@vinylbox.app with privacy questions or requests.

10. Your privacy rights

Depending on where you live, you may have rights to:

access personal information we hold about you;
correct inaccurate information;
delete information;
restrict or object to certain processing;
receive a copy of your information;
withdraw consent where processing is based on consent;
complain to a data protection authority.

To make a request, contact us at contact@vinylbox.app.

We may need to verify your identity before responding. Some information may be exempt from deletion or access where we need to retain it for legal, security, fraud-prevention, accounting, dispute, or other legitimate reasons.

If you are in the United Kingdom, you have the right to complain to the UK Information Commissioner’s Office. We encourage you to contact us first so we can try to resolve your concern.

11. International transfers

We are based in the United Kingdom, but VinylBox and our service providers may process information in the United Kingdom, the United States, the European Economic Area, and other countries.

Where required, we use appropriate safeguards for international transfers, such as contractual protections or other lawful transfer mechanisms.

12. Security

We use reasonable technical and organisational measures designed to protect personal information, including access controls, encryption where appropriate, secure service providers, and monitoring for security issues.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

You are responsible for keeping your device, Apple account, Discogs account, and any login credentials secure.

13. Third-party services and links

VinylBox may integrate with or link to third-party services, including Discogs, Apple, subscription providers, analytics providers, advertising providers, image analysis providers, and support channels.

This Privacy Policy does not apply to third-party services that we do not control. Their own privacy policies and terms apply.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will take reasonable steps to notify you, such as by updating the app, posting a notice, or updating the “Last updated” date above.

Your continued use of VinylBox after an updated Privacy Policy becomes effective means we will process information as described in the updated policy, where permitted by law.

15. Contact

For privacy questions or requests, contact: