Privacy Policy

Account Information

When you create an account, we collect your email address and a password (stored as a secure hash — we never see your plaintext password). If you sign in with Google, we receive your name, email address, and profile picture from Google's OAuth service. During onboarding you choose a username that identifies your public profile.

Profile Information

You may optionally provide a display name, bio, location, and profile photo. If you choose to link your Discogs account, we store your Discogs username and Discogs user ID along with the timestamp of when you connected it.

Collection and Wantlist Data

When you add records to your collection or wantlist — manually or by Discogs import — we store the title, artist, year, genre, format, pressing/edition details, condition (media and sleeve), notes, estimated value, and cover art for each item. This is the core data that powers your collection catalog.

Listening Activity

When you log a spin or set a daily spin, we record the record, timestamp, and source (e.g. manual, daily spin, rotation). We also store your rotation shelves — curated lists of records you are actively listening to. This activity data is used to power your Taste Profile and listening history.

Taste Profile

We automatically compute a Taste Profile from your collection and activity. This includes your top genres, top decades, mood profile, archetype persona, uniqueness score, and a headline and tagline that describe your musical identity. The Taste Profile is stored and updated as your collection changes.

Social and Community Data

When you use social features, we collect data about your follows and followers, likes and comments on posts, direct messages (stored encrypted in transit), vibe posts and hashtags you create, and contact form submissions.

Uploaded Images

You may upload a profile avatar or a custom record cover image. These are stored in Supabase Storage and served from our CDN.

Technical Data

We automatically collect certain technical information including your IP address, browser type and version, device type, and timestamps of actions (such as when a record was added or a spin was logged). This data is used for security, debugging, and service improvement.

We use your information to:

• Provide and operate the service — authenticate your account, store and display your collection, compute your Taste Profile, and power social features.
• Personalize your experience — generate your music archetype, match you with Taste Twins, and surface personalized discovery recommendations.
• Display public content — if your profile is public, show your collection, spins, and posts to other users and in search engines.
• Communicate with you — send transactional emails (account confirmation, password reset) and respond to support inquiries. We do not send marketing emails unless you explicitly opt in.
• Improve the platform — analyze aggregate usage patterns, fix bugs, and develop new features. We do not build individual advertising profiles.
• Maintain security — detect and prevent fraud, abuse, and unauthorized access.

What we do not do: We do not sell your personal information to third parties. We do not use your data for behavioral advertising. We do not share your data with advertising networks.

VinVibe integrates with the following third-party services to provide its features. Each service is subject to its own privacy policy.

VinVibe profiles are public by default. This means your username, vinyl collection, Taste Profile, and public posts can be viewed by anyone — including search engines — unless you change your privacy settings.

You can switch your account to private mode in your profile settings at any time. When your account is private, your collection and posts are hidden from people who do not follow you, and your profile will not be indexed by search engines.

Your email address, password, and direct messages are never publicly visible regardless of your privacy setting.

VinVibe uses browser localStorage to store your Supabase authentication session token (a JSON Web Token). This token keeps you signed in between visits and is required for the app to function. It does not contain your password and is tied to your device and browser.

We do not use advertising cookies or cross-site tracking cookies. We do not integrate with third-party advertising networks that set cookies on your browser.

You can clear your localStorage at any time through your browser settings, which will sign you out of VinVibe.

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal profile data, collection, wantlist, spins, posts, messages, and uploaded images within 30 days of your deletion request. Some anonymized aggregate data (for example, the number of users who own a particular record) may be retained in our shared music database indefinitely, as it cannot be traced back to you.

To request account deletion, email us at vinvibeapp@gmail.com or use the account deletion option in your profile settings.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may ask us to correct inaccurate or incomplete personal information.
• Withdrawal of consent: You may withdraw consent to our use of your data. Withdrawing consent may mean we can no longer provide you with the service.
• Deletion: You may request that we delete your personal information, subject to limited exceptions required by law.

For EU/EEA users: If you are located in the European Union or European Economic Area, we process your data on the legal basis of contract performance (to provide you with the service you requested). You also have rights under the GDPR including the right to erasure and data portability. Contact us to exercise these rights.

For California residents: VinVibe does not sell personal information as defined by the California Consumer Privacy Act (CCPA). You may exercise your CCPA rights by contacting us.

To exercise any of these rights, email vinvibeapp@gmail.com. We will respond within 30 days.

VinVibe is intended for users 13 years of age and older. We do not knowingly collect or solicit personal information from children under the age of 13. If we become aware that a child under 13 has provided us with personal information without parental consent, we will delete that information as quickly as possible. If you believe a child under 13 has created an account, please contact us at vinvibeapp@gmail.com.

VinVibe is operated from Canada. If you access the service from outside Canada, your information may be transferred to and processed in Canada or other countries where our service providers (including Supabase) maintain servers. These countries may have privacy laws different from those in your jurisdiction. By using VinVibe, you consent to this transfer. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy wherever it is processed.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address associated with your account) or by displaying a prominent notice within the app at least 30 days before the changes take effect. Your continued use of VinVibe after the effective date of any changes constitutes your acceptance of the updated policy. The "Effective date" at the top of this page will always reflect the date of the most recent version.

If you have any questions about this Privacy Policy, want to exercise your rights, or have a concern about how your data is handled, please contact us:

You may also submit a complaint to the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe your privacy rights under PIPEDA have been violated.