Privacy Policy

Draft for review. Not legal advice — have someone qualified read it before the app is published.

Last updated: 29 October 2026

The short version

Your collection, your photographs and the records you scan stay on your phone. Reading spines and checking a sleeve against your shelf and wantlist happen on the device, so they work with no signal; naming a sleeve the phone cannot, cover art and previews need one.

Two things send part of your collection to us: your account, which keeps a copy of your shelf so it follows you to any device you sign in on — nothing is sent until you sign in, and while you are signed in changes go up as you make them — and Send matching data, which helps the app recognise records on shelves other than the one it was built on. Send matching data is on while the app is in beta testing (TestFlight and Google Play testing) and off in the released app; you can switch it either way in Settings. A photograph leaves your phone only when you choose to send it: with Look closer, the photo of a sleeve or centre label the app could not name, sent to Google's Gemini AI only when you tap Look closer. If the app crashes, a report of the fault is sent so it can be fixed. Looking up album details, cover art and previews asks Discogs, Deezer and Apple about that album, as described below. Where the app offers Name any sleeve, a sleeve is sent to be named as numbers worked out from its photo — an image fingerprint, and the positions and shapes of points on the cover — never the photo itself.

The app also sends us anonymous usage counts — that a dig was finished, that the app buzzed for a record you have, that the Premium page was opened — under a random number made on your phone, never your name, account or records. They help us see whether the app works for people, are deleted after 90 days, and you can turn them off in Settings ("Usage counts", below).

If you subscribe to Premium, Apple or Google takes the payment — we never see your card — and RevenueCat, which manages subscriptions for us, keeps the purchase under your account's identifier (see "Premium purchases", below).

If you join the early-access mailing list on our website, we keep your email address to write to you about the beta and the launch, until you unsubscribe (see "The mailing list on our website", below).

What stays on your device

• Photographs. Every frame the camera takes is processed on the phone and either kept as your own spine image or deleted. No photograph is uploaded, except the photo of a sleeve or label you tap Look closer on (below).
• Your shelf. The records you have identified, their order, and the notes and corrections you make.
• Cover art. Only the web address of an image is stored, never a copy.

What leaves your device

• Record identifiers, when you look up details or a cover is fetched. Opening an album asks Discogs for its tracklist and pressings, and a record Deezer has no cover for has its cover asked of Discogs. Discogs receives the identifier of the record, and their privacy policy applies to that request.
• Nothing but the request, when the record index is updated. Records are identified against an index of the Discogs catalogue kept on the phone; on Android it is downloaded from Google Play with the app. At most once a day while the app is open, the phone asks our website (Firebase Hosting, Google) whether there is a newer monthly update to the index, and downloads it if there is. The request carries nothing about you or your shelf; Google's servers record the address it came from, as they do for any request.
• Artist and album names, when cover art is fetched or previews play. Deezer receives the name of the album being looked up: for its cover, and for which of its tracks are played most, so ▶ Hear it can start on a well-known track rather than an intro.
• Artist and album names, when you play a preview. Pressing ▶ Hear it asks Apple's iTunes Search for that album's 30-second previews, and the previews stream from Apple. Apple receives the artist and album name and the address the request came from; nothing about you or your shelf. Apple's privacy policy applies to those requests.
• Your shelf, only if you sign in to an account. Artist, title, year, how the record was identified, and its position. Stored with Firebase (Google) in your account, so that the same shelf is shown on any device you sign in on and comes back to a new phone. While you are signed in, each change you make on a device is sent to the account on its own; signing out stops that, and deleting your account removes the copy. With Premium, your dig journal is kept in the account with it: each dig's times and the shop you typed, and for each record flipped, the text read off it, what it was named and whether you added it, wanted it or passed on it — never its photo.
• Your email address, only if you sign in with one. An account made with an email and password keeps that address in Firebase Authentication (Google), so you can sign in on another phone and reset a forgotten password. The password is held by Firebase in hashed form; we never see it. The address is used only for the emails that go with an account — one to activate it by confirming the address when it is created, or when you change it to a new one (with a note to the old one), and a password reset when you ask for one — and never for anything else. Keeping your shelf in an account needs one you sign in to, with Google, Apple, Discogs or an email address; the app no longer makes a private account for it. A private backup made by an earlier version of the app stays where it is until you sign in, when it moves into your account, or delete it.
• Your Google account's details, only if you sign in with Google. Google tells Firebase Authentication (Google) which Google account you chose: an identifier for it, its email address, its name and a link to its profile picture. The identifier is what finds your account again on another device. The address and name are used only to show you which account you are signed in with, and the address is never emailed. Google's privacy policy applies to the sign-in itself; we never see your Google password.
• Your Apple Account's details, only if you sign in with Apple (offered on iPhone only). Apple tells Firebase Authentication (Google) an identifier for your Apple Account, used to find your account again, and an email address: your own, or, if you choose Hide My Email, a random address that Apple forwards to you and that you can turn off at any time. The first time only, Apple also gives the app the name you choose to share, which is kept with the account to show you which one you are signed in with. We never see your Apple Account password, and the address is never emailed. Deleting your account in the app also removes the app from your Apple Account's list of apps using Sign in with Apple.
• Your Discogs username, only if you sign in with Discogs. Signing in with Discogs keeps an account in Firebase Authentication (Google) whose identifier is made from your Discogs user number, with your Discogs username as its name, so that signing in with the same Discogs account on another device finds the same account. To learn who you are, the app sends the access token it holds from connecting Discogs to our server, which asks Discogs whose it is and nothing else. The token is never logged, and is kept only as "Your Discogs connection, kept with your account" (below) says; your Discogs password never reaches the app or us.
• Which account your Discogs account signs in to. So that one person has one account, however they sign in, our database (Google Cloud Firestore) keeps a link from your Discogs user number to the account "Continue with Discogs" opens, with your Discogs username and when the link was made. If you are signed in with Google, Apple or an email address and connect Discogs, the app links your Discogs account to that account, the same way — asking Discogs whose the connection is, as above — and from then on signing in with Discogs on any phone opens it. If you had already signed in with Discogs on its own, that account's shelf and dig journal are moved into the account it is now linked to, and the Discogs-only account is deleted. Only our server reads or writes the link. Disconnecting Discogs on a phone leaves it in place, since it is a way into your account rather than the phone's connection; deleting your account removes it.
• Your Discogs collection and wantlist, only if you connect Discogs. Connecting goes through our server, which asks Discogs on the app's behalf: Discogs shows you its own page to allow it, and the access it grants goes to the app, which keeps it on the phone. From then on, reading your collection and wantlist and adding to or removing from them go through our server too, which signs each request with the app's own Discogs key and passes it on. Each one carries the access token, your Discogs username and the records concerned, and none of it is logged or kept from the request. Discogs' privacy policy applies to what Discogs holds.
• Your Discogs connection, kept with your account, only if you connect Discogs while signed in. In versions of the app that do this, the Discogs access token (the token and its secret that Discogs gives the app when you allow it) is kept with your account in our database (Google Cloud Firestore), with your Discogs username and user number, so that every device you sign in on is connected to Discogs without going through Discogs' page again. Signing in with Discogs keeps it the same way. It is encrypted (AES-256) with a key that only our server holds, in Google Cloud Secret Manager, and only our server reads or writes it, to give it back to devices signed in to your account. It is used only to sync your own Discogs collection and wantlist, and is never logged or shared. Disconnecting Discogs in the app deletes it from your account, which disconnects every device; signing out removes it from that phone; deleting your account deletes it.
• Numbers worked out from the photo of a sleeve, when Dig asks our naming service to name it ("Name any sleeve", free and unlimited for everyone, in versions of the app that have it). The phone works out two things from the photo: an image fingerprint, three lists of numbers that sum up how the sleeve looks (7.5 KB); and the positions of up to 1,000 distinctive points on the cover, each with a short code describing the shapes around it (ORB keypoints, about 47 KB as sent), so the service can check its answer against the covers it knows. About 58 KB in all is sent — never the photo itself, and never the text read off it — to our naming service on Google Cloud, with your account's identifier. Dig asks about a sleeve the phone could not name by its barcode, its text or your own covers; with Premium it asks as soon as the photo is read, to answer sooner, and the answer is used only if the phone cannot name the sleeve itself. The service answers with the record whose cover matches, if one does, and forgets what was sent: it is not stored or logged. Naming is not counted against any allowance. What is kept is a count of requests, one number per account per month under a scrambled key, so that an account being used by a script can be stopped; it is deleted automatically about two months later. The account is the one you sign in to if you have one, and otherwise a private one used only for this. Google's servers record the address a request came from, with its time and size, in their logs, as they do for any request; those logs are kept for 30 days.
• Requests to the Cover Art Archive, occasionally, when a sleeve is being named. The naming service normally checks its answer itself. When it cannot, the phone fetches the candidates' covers from the Cover Art Archive (run by MetaBrainz on the Internet Archive), which receives the request like any web request, including the phone's address. The covers are compared on the phone and deleted straight away.
• Matching data: on during beta testing, otherwise only if you turn it on. See the next section.
• Usage counts, unless you turn them off. See "Usage counts" below.
• Anonymous counts of your shelf, wants and favourites, only if you join the collector network. See "The collector network" below.
• The photo of one sleeve or label, only when you tap Look closer. See "Look closer" below.
• Whether this phone has Premium, and your purchases if you subscribe. See "Premium purchases" below.
• A crash report, if the app crashes or hits an error it cannot recover from. Where in the app's code it failed and the error's message, with the phone's model, its operating system version, the app's version, and a random identifier for this installation of the app. Sent to Firebase Crashlytics (Google) so the fault can be found and fixed, and kept for 90 days. It carries no name, account or photograph and is not linked to your account, though an error's message can occasionally include the name of the record the app was working on at the time.

There is no advertising, no tracking across apps or websites, and no analytics company: the usage counts below are sent only to us.

Matching data

On while the app is in beta testing (TestFlight and Google Play testing), and off in the released app unless you switch on "Send matching data" in Settings. You can turn it off at any time, and that choice is kept. When it is on:

• After each sweep: for every spine read, whether the app named a record, how it did so, and its two highest match scores, with which kind of phone it was and the thresholds the app was using. These are numbers — not the text read off the spine, and not the records it considered. They are added into running totals when they arrive and are not kept one sweep at a time.
• Each time you name a record by hand: the text read off its spine, the artist, title and year you chose, how you chose it, and whether the phone is an iPhone or Android. This describes a record in your collection. It is kept for 90 days with the month it was sent rather than the time, then deleted automatically.
• Where it goes: our server on Firebase (Google), signed in with an anonymous account used only for this — not the account you sign in to, and never your name or email. Google's servers record the address a request came from in their logs, as they do for any request.
• What it is for: improving how records are recognised, and nothing else. It is not shared or sold.
• Taking it back: because it is not stored against you, what was already sent cannot be found to delete it. Turning the switch off stops anything more being sent.

Usage counts

On unless you turn off "Share anonymous usage counts" in Settings. They tell us how many people open the app again, finish a dig, get a buzz or look at Premium — so we can see what works and fix what does not — and nothing about who you are or what is on your shelf.

• What is sent: a note that one of these happened, and when: the app was opened (and whether it was the first time on this phone); the welcome cards were finished or skipped; a dig was started or ended; the app buzzed for a record you have or want, the first time only; a sweep was matched; Discogs was connected; the Premium page was opened, a free trial started, a subscription was bought or purchases were restored; Look closer was used; something was shared from the app; and the note asking for a rating was shown, and whether you chose "Leave a rating" or "Not now".
• With those, and nothing more detailed: for a dig, how many finds it had and how many of them buzzed, in ranges such as "5 to 19"; how its records were named (sleeve, label, barcode or typed); Look or Add; and how long it took, in ranges. For a sweep, how many spines it read and named, in ranges. Which door the Premium page was opened from, yearly or monthly for a trial or purchase, and whether a restore found anything. Whether Look closer named the sleeve, and what kind of thing was shared. And with every batch: iPhone or Android, the app's version and update, which release channel it came from, and whether Premium is on — never which account has it.
• Never sent: record names, artists or titles, anything read off a sleeve, spine or label, photos, your shelf or wantlist, the shop you typed, where you are, your account, your Discogs username, your email, or any advertising identifier. Every value is one of a short list of fixed words; there is no free text, and our server throws away anything that is not on the list.
• The random install id: the first time it needs one, the app makes a random number and keeps it on the phone, so that two days' counts from the same phone can be told apart from two phones — which is how we know whether people come back. It is not your account, your Discogs account, or the crash reporter's identifier, nothing links it to them, and we never try to work out whose it is. Turning the switch off deletes it from the phone; turning it back on makes a new one.
• Your IP address: our server uses the address a request came from, in its memory and in a scrambled form for a few minutes, to limit how often one phone or one network can send. It is never written down: not stored with the counts, and not logged by us. As with any request, Google's servers record it in their own logs, kept for 30 days.
• When it is sent: at most once a minute while the app is open, and when you leave it; held on the phone when there is no signal, for up to a week. Nothing is sent until you have accepted the terms.
• Where it goes: our server on Firebase (Google Cloud Firestore, in the EU: Belgium and the Netherlands), which only our server and Mack can read.
• How long: each batch is deleted automatically 90 days after it arrives.
• What it is for: counting how the app is used, for us, and nothing else. It is not shared, not sold, not combined with anything from anyone else, and not used for advertising or to build a profile of you. The legal basis is our legitimate interest in knowing whether the app works for the people using it; the switch is how you object, at any time.
• Turning it off: Settings → "Share anonymous usage counts". Nothing more is sent, and whatever was waiting on the phone is deleted with the random id. What was already sent is kept under that id until its 90 days are up; since nothing links the id to you, we cannot find it to delete it sooner.

The collector network, only if you join it

In versions of the app that have it, an album's page can say how many Crate Cruiser collectors have it on their shelf, how many want it and how many call it a favourite. Those counts come only from people who have joined the collector network, in Settings or from an album page. Joining is free and optional, needs an account you sign in to, and asks your year of birth once: the network is for people aged 16 and over, and only whether you are is kept (as "over 16: yes" on your account), never the year. If you join:

• What is counted: for each album on your shelf, one more shelf it is on; for each album on your wantlist, one more person who wants it; for each album you heart, one more favourite. Each album is counted by its Discogs master number. Three switches under the one you joined with let you leave your shelf, your wants or your favourites out; all three are on when you join.
• What is kept: on your account (Firebase, Google), your choice and the three switches, and — while your wants count — the list of albums on your wantlist as master numbers only, which our server reads to count them. Nothing else about a want or a record is kept for this, and nothing about where you are. Your hearts are kept on your account as your own list, so they follow you to another phone, whether or not you join.
• What anyone else sees: a count per album — "on 312 shelves · 48 want it · 12 favourites" — and under five, "a few". Nobody, member or not, can read your shelf, your wantlist or your favourites, and no count says which account it came from. There is no profile yet; when there is one, what it shows will be your choice.
• Discogs: records you brought onto your shelf from your Discogs collection are counted like any other, with this consent and always free. Only the master number is used, never Discogs' own counts, images or marketplace data.
• Leaving: one tap in Settings. Our server then takes your shelf, wants and favourites out of every count and deletes the list of wants it held, within a day at most (usually seconds). Deleting your account does the same.

Look closer, only when you tap it

When the app cannot name a sleeve, or cannot read a record's centre label, Premium offers Look closer. For the app's launch it is also free for a short time to anyone, with a smaller allowance; the app says so while it is. Nothing is sent until you tap it, and each tap sends one photo.

• What is sent: the photo the app kept of that sleeve or label, made smaller (at most 1024 pixels across). Not the text read off it, your shelf, your location, your name or your email.
• Signed in: with the account you sign in to if you have one, otherwise with an anonymous account the app makes for this. It is checked to see that you have Premium, or that the free launch offer is still open, and to count your looks: with Premium, that day and that month; during the free offer, that day and in all. The counts are kept under a scrambled form of the account, the day's deleted within two days, the month's early the next month, and the free offer's within two months of its end. Before showing Look closer, the app asks our server, with the same account, whether the free offer is open and how many free looks are left; nothing else is sent with that question.
• Where it goes: our server on Firebase (Google), which passes the photo to Gemini, an AI model made by Google, on Google Cloud's Vertex AI in the European Union, to say which record it shows — for a label, also what is printed on it: the company, the catalogue number, the country and the year — and returns that to your phone. The phone looks the name up in its own index and shows it as a "Maybe" for you to confirm, and checks what was read against the album's pressings itself. Google processes the photo for us under its Google Cloud terms, which do not allow it to be used to train its models; it may keep it for a limited time to check for misuse, as those terms describe.
• What we keep: nothing. The photo is not stored. Our server records only how large the request was, how long it took and whether a name came back — not the photo, not the name, and not the account.
• Taking it back: there is nothing kept to delete. Not tapping Look closer is all it takes.

Premium purchases

Premium is a subscription bought in the App Store or on Google Play. Buying or restoring it needs an account you sign in to (Google, Apple, Discogs or an email address), so that Premium is kept with the account and works on any phone you sign in on.

• Payment: Apple or Google takes the payment, under its own terms and privacy policy. We never see your card or bank details, your billing address, or your Apple Account or Google password.
• RevenueCat: RevenueCat, Inc. checks purchases with the stores and keeps track of subscriptions for us, as our service provider. Each time the app starts, it asks RevenueCat whether this phone's App Store or Google Play account has Premium, so that a purchase is recognised, and one interrupted last time is finished. It asks under a random id that RevenueCat's code makes on the phone or, once you are signed in, under your account's identifier — the random id Firebase gave your account, not your name or email address. With each request RevenueCat receives the phone's platform and system version, the app's version, the phone's language and store country, and the address the request came from. Once you buy, it also receives the store's receipt or transaction history for this app's subscriptions: which plan, its price and currency, and the dates of the purchase, free trial, renewals, cancellation, expiry and any refund. It never receives your shelf, your photos or your email address. RevenueCat's privacy policy describes how it handles this.
• What our server keeps: one record per account that has had Premium, in our database (Google Cloud Firestore, in the EU: Belgium and the Netherlands), written by our server from what RevenueCat reports: whether Premium is on and until when, which plan and which store, whether it will renew, whether it is in the free trial, whether it was a test purchase or given rather than bought, and when the record last changed. Beside that, a short history, kept so we can honour the free trial, handle refunds and count how they are used: when a free trial started, was cancelled, turned into a paid subscription or ended without one, and when a refund was made or reversed, with RevenueCat's reference for the refund. Your account also carries a flag saying whether it has Premium, so our services can tell without looking anything up. Only our server reads these; the app asks the store. If we give you Premium rather than you buying it, we also note who it was for, until when, and why.
• On your phone: the store's last answer (whether Premium is on, until when, and the plan), so that Premium works with no signal.
• What it is for: giving you the Premium you paid for, on every phone you sign in on, and handling cancellations and refunds. Not for advertising, and not sold.
• How long: for as long as your account exists. They are deleted when you delete your account: our record of your purchases, the note of why Premium was given (if it was), your Look closer counts, and RevenueCat's record of you as a customer. Deleting your account does not cancel the subscription, which Apple or Google bills: cancel it in the App Store or Google Play, or it renews. Apple and Google keep their own record of the purchase, under their terms; Restore purchases on a new account finds it there.

The mailing list on our website, only if you join it

Our website (vinyl-organizer.web.app) has a form to join an early-access mailing list. It is separate from the app: joining does not make an account, and nothing on the list is linked to the app, your shelf or your account.

• What we keep: the email address you type; which phone you said you use, if you chose one (iPhone, Android or both); your browser's language setting; that you joined on the website; and the exact wording you agreed to, with the date and time. Stored in our database (Google Cloud Firestore, in the EU: Belgium and the Netherlands), which only our server and Mack can read.
• Why, and on what basis: to email you about early access to the beta and about the app's launch, and for nothing else. The legal basis is your consent, given by ticking the box, which you can withdraw at any time.
• What we do not do: no tracking on the website or in the emails, and the list is never sold, shared or used to sign you up to anything else.
• Keeping bots out: the server counts sign-ups from each network address per day. It keeps only a scrambled form of the address with the day, never the address itself, and deletes the count within two days.
• How long: until you unsubscribe, and at most two years from when you joined, after which it is deleted automatically.
• If the list moves to an email service: to send the emails, the list may be moved to a mailing-list service that sends them for us under a data processing agreement. This policy will name it before that happens, and we will ask you to confirm your address, by a link in an email, before you are sent anything else.
• Leaving the list: every email will have an unsubscribe link. At any time, write to makes@mackbrowne.com (or reply to any email from the list) and your address is deleted, not just marked. You can also ask for a copy of what we hold about you.

Permissions

• Camera — to read record spines, sleeves and labels, and to scan barcodes. Frames are processed on the device; only a sleeve's or label's photo you tap Look closer on is sent anywhere.

Your choices

• Use the app without an account. Everything on the phone works without one — scanning, identifying records, Dig by barcode, label or name, and your wantlist on the phone. Keeping your shelf in an account, and syncing with Discogs, need one. Dig names sleeves by their covers as often as you like, with or without one.
• Sign out at any time: your shelf stays on the phone and nothing more is sent until you sign in again.
• Have an account without giving an email address, by signing in with Discogs, or with Apple and its Hide My Email.
• Turn "Send matching data" off (in the released app it starts off). Everything works the same either way.
• Turn "Share anonymous usage counts" off. Everything works the same either way.
• Stay out of the collector network, or leave it with one tap. The album pages, your shelf, your wantlist and your favourites work the same either way; only the counts stop including yours.
• Name sleeves by hand, or by their text or barcode, which never leaves the phone. Without Premium, a sleeve's fingerprint and keypoints are only sent for a sleeve none of those named.
• Delete your shelf from inside the app at any time.
• Delete your account, which removes the copy of your shelf and dig journal held in it, the link from your Discogs account, the Discogs connection kept with it, and the email address, Discogs username and other details the account held, however you signed in. Your Google, Apple or Discogs account itself is not touched. Your Premium purchase records are deleted with it, but a Premium subscription is not cancelled: cancel it in the App Store or Google Play (see "Premium purchases").

Children

Not directed at children under 13, and no age information is collected, except that joining the collector network (above) asks your year of birth once and keeps only whether you are 16 or over.

Contact

Email makes@mackbrowne.com.