Vinyl app — last updated: 14 June 2026
This policy explains what personal data the Vinyl application (“the app”) collects, why, who it is shared with, how long it is kept, and your rights.
The Vinyl app is published by Etienne Chevalier (“Zhiween”), the controller of your data. Hosting: Hetzner Online GmbH (Germany, European Union). For any question about your data: privacy@zhiween.com.
| Data | When / why |
|---|---|
| Email address | When you create an account, for one-time-code (OTP) authentication and to link your collection to you. |
| Google sign-in (optional) | If you choose “Continue with Google”: we receive your (verified) Google email address and a Google account identifier, solely to authenticate you. It's an alternative to OTP, not required. |
| Display name (nickname) | To identify you to your friends inside the app. |
| Discogs token | If you provide it: stored server-side to run Discogs searches on your behalf (covers, tracklists). Optional. |
| Your collection | The records you add (title, artist, year, genre, cover, collection/wishlist status, favorites). |
| Friends | The friend requests and friendships you create, for the social features. |
| Reactions | The emojis you leave on your friends' records. |
| Push notification token | If you enable notifications, to alert you (e.g. “a friend added a record”). |
| Chosen avatar | The profile icon you select (a reference, not a personal photo). |
| Technical data | IP address and request logs on the server, timestamps, for the operation and security of the service. |
On first launch, an anonymous “guest” account is created automatically (with no email) so you can use the app immediately. Until you create an account with an email, no directly identifying data is collected. We do not use advertising or third-party marketing trackers.
We do not sell your data. It is processed by the following providers, solely to operate the service:
| Provider | Role | Data involved |
|---|---|---|
| Hetzner (Germany, EU) | Server and database hosting | All service data |
| Backblaze (B2) | Off-site database backups, encrypted before upload | Encrypted database backup (the provider only holds encrypted data) |
| Resend | Sending emails (OTP codes) | Email address |
| Google (Firebase Cloud Messaging) / Expo | Delivering push notifications | Push token + notification content |
| Google (Sign-In) | “Continue with Google” sign-in (if you use it) | Your Google email address + Google account identifier |
| Discogs | Searches run on your behalf with your token | Your search queries |
| MusicBrainz | Fallback search (no token) | Your search queries |
| Sentry (EU) | Crash and technical error detection (diagnostics) | Technical diagnostic data (device model, app version, error stack trace) — no personal identifier |
The app also offers links to third-party services (YouTube Music, Spotify) to listen to a track. These links open a search in the relevant service: we do not send them any personal data. Their use is subject to their own privacy policies.
Hosting and email sending take place within the European Union. Some providers (Google/FCM, Discogs, MusicBrainz, Backblaze) may process data outside the EU; such transfers are covered by the appropriate safeguards under the GDPR. Off-site backups are encrypted before any transfer.
Traffic between the app and the server is encrypted (HTTPS). Access to the server is restricted and protected. As no method is foolproof, we cannot guarantee absolute security.
Under the GDPR, you have the right to access, rectify, erase, restrict and port your data, and to withdraw your consent. You can:
You may also lodge a complaint with your local data protection authority (in France, the CNIL — www.cnil.fr) if you believe your rights are not respected.
The app is not intended for children under 15. We do not knowingly collect data from children under that age.
This policy may change. In the event of a significant change, we will update the date at the top of this page and, where necessary, notify you in the app.