VinylScape

Privacy Policy

Last updated June 2026. VinylScape is a personal project operated by Carlos Rego (NullMind), based in Portugal (EU/GDPR).

This policy explains what VinylScape collects, why, how it is protected, and the rights you have over it. It is written to be read, not to hide behind jargon. If anything here is unclear, ask and it will be explained plainly.

Who runs VinylScape

VinylScape is an independent, self-hosted project run by Carlos Rego (NullMind), based in Portugal. For data-protection purposes the operator is the data controller. VinylScape is not affiliated with, endorsed by, or sponsored by Discogs or Last.fm. For any privacy request or question, contact privacy@vinylscape.net.

What we store

  • Account data you provide: email, username, display name, an encrypted password hash (never the password itself), and your language, theme, and profile preferences.
  • Discogs data, when you connect your account: your collection and wantlist (artist, title, year, format, label, catalog number, cover image, rating, date added) and the marketplace prices we look up for those releases. Connecting uses Discogs OAuth; the access tokens are encrypted at rest and are never shown to anyone. If you enable write-back, actions you take in the app (such as adding a record) are sent to your Discogs account on your behalf.
  • Last.fm data, when you add your username: your public scrobble history (track, artist, album, timestamp), read through the public Last.fm API. We do not need or store your Last.fm password.
  • Activity you create in the app: matches between scrobbles and records, manual confirmations, wishlist entries and price alerts, notifications, and any feedback messages you send us.
  • Limited technical data needed to run the service: sync timestamps and basic server logs (which may include your IP address and browser type) kept for security and debugging. We do not build advertising or behavioural profiles.

What we do with it

We use it only to power your own dashboard: matching scrobbles to records you own, computing plays, value, listening stats, and the wishlist price alerts you opt into. We do not sell your data, share it with advertisers, or use it for any purpose beyond running the app for you.

Legal basis (GDPR Article 6)

  • Performance of a contract: storing your account and the data needed to provide the dashboard you signed up for.
  • Consent: connecting Discogs, adding your Last.fm username, enabling write-back, making your profile public, and opting into price alerts. You can withdraw consent at any time by disconnecting the source or changing the setting.
  • Legitimate interests: keeping the service secure, preventing abuse, and fixing problems, balanced against your rights.

Public profiles

If you choose to make your profile public, the collection, listening stats, and top genres shown on it become visible to anyone with the link, and to the compare feature. This is off by default and you can turn it off at any time in Settings, which makes the profile private again.

Third-party sources and processors

Data comes from Discogs and Last.fm under their respective terms; their handling of your data on their platforms is governed by their own privacy policies. To run the service we also rely on a hosting provider (servers and backups), and a content-delivery and security layer in front of the site. These providers process data only as needed to host and protect VinylScape and are not permitted to use it for their own purposes.

Where it lives and how it is protected

Data is stored in a private database on a server in the EU and backed up alongside it. Passwords are stored only as salted hashes, third-party tokens are encrypted at rest, and the site is served over HTTPS. Access is restricted to the operator for maintenance only.

International transfers

Processing happens within the EU/EEA wherever possible. If any provider processes data outside the EEA, that transfer relies on an adequacy decision or Standard Contractual Clauses.

Email and notifications

We send transactional email only (such as account verification, password reset, and important service notices) and the in-app notifications you enable. There is no marketing email.

Cookies

We use a session cookie to keep you signed in, a small cookie to remember your language, and one to remember your theme. These are strictly necessary or preference cookies. There are no third-party tracking or advertising cookies.

Your rights (GDPR)

You have the right to access, correct, export (portability), restrict, object to, and delete your data. Much of this is self-service: you can edit your profile, export, and delete your account from Settings, which permanently removes your account and all associated collection, scrobble, play, wishlist, and notification records (the deletion cascades). Disconnecting Discogs or removing your Last.fm username stops further syncing of that source. For anything you cannot do in-app, email the address above and we will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority; in Portugal this is the CNPD (cnpd.pt).

Automated decisions

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Scrobble-to-record matching is an automated convenience and you can review or override it.

Retention

We keep your data while your account is active. When you delete your account, the data is removed promptly; residual copies in routine backups age out on the normal backup rotation (typically within 30 days). Server logs are kept only for a short period for security and debugging.

Children

VinylScape is not directed at children and is intended for users aged 16 or older. We do not knowingly collect data from children. If you believe a child has created an account, contact us and it will be removed.

Changes

If this policy changes materially, the "last updated" date above will change and, where appropriate, you will be notified in-app. Continued use after an update means you accept the revised policy.

Contact

Questions or requests about your data: privacy@vinylscape.net.

← Back to home