Privacy Policy

1 · Controller

Philipp Schäfer, Brucknerstraße 4, 81677 München, Germany · Email: privacy@vinylist.studio.

2 · Scope & principle

This policy applies to the website vinylist.studio and the Vinylist app. Vinylist is built for data minimization: no tracking, no advertising, no analytics tools.

3 · Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent you have given (Art. 7(3)). You have the right to lodge a complaint with a supervisory authority (Art. 77) – the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

4 · Website (vinylist.studio)

4.1 Hosting (bunny.net). The website is hosted via bunny.net and delivered through its content delivery network. bunny.net is operated by BunnyWay, informacijske storitve d.o.o. (Cesta Komandanta Staneta 4a, 1215 Medvode, Slovenia), which processes data on our behalf (commissioned processing, Art. 28 GDPR; a data processing agreement is in place). Processing takes place within the EU. Legal basis: legitimate interest in secure, fast delivery (Art. 6(1)(f)).

4.2 Server log files. When the site is accessed, the server automatically collects an anonymized (shortened) IP address, the date/time, the page requested, the volume of data transferred, the referrer and browser/operating-system information. Purpose: technical operation, security and error analysis. Legal basis: Art. 6(1)(f). Retention period: up to 3 days.

4.3 No cookies, no tracking, no external resources. The website is static: no cookies, no analytics/advertising services; fonts and scripts are loaded exclusively from our own website – delivered via the bunny.net CDN, which acts as a processor (Art. 28 GDPR) on our behalf. No third-party services are embedded (no Google Fonts, no external CDNs) and no data is transmitted to third parties.

4.4 Getting in touch. If you email us (hello@ / support@ / privacy@), we process your details to handle your request. Legal basis: Art. 6(1)(b) or (f).

5 · App (Vinylist)

5.1 Discogs connection. On your initiative, Vinylist connects to your Discogs account via OAuth and loads your collection data from Discogs. Processing takes place in the app on your device. Your Discogs access is kept in your device’s Keychain and is only included in an encrypted device backup. Vinylist only reads from Discogs. Discogs is operated by Zink Media, LLC (d/b/a Discogs), Beaverton, Oregon, USA; their privacy policy applies. Their external data protection officer is HewardMills Ltd (London, United Kingdom), reachable at dpo@discogs.com. Legal basis: your consent / performance of a contract (Art. 6(1)(a)/(b)).

5.2 Artists’ country of origin (Wikidata). To tell “Original” from “First Press”, Vinylist looks up on Wikidata where the main artists in your collection come from. For this the app transmits only these artists’ Discogs artist numbers and the app’s name and version; as with any internet request, the server also sees your IP address. No titles, no Discogs username, no sign-in data and nothing else from your collection is transmitted; no account is needed. The lookup only runs while Vinylist loads data from Discogs, never in demo mode. Wikidata is operated by the Wikimedia Foundation, Inc., San Francisco, California, USA; processing may take place in the USA, and its privacy policy applies. Its EU representative is Bird & Bird GDPR Representative Ireland; privacy contact: privacy@wikimedia.org. Legal basis: performance of a contract / legitimate interest in classifying your pressings correctly (Art. 6(1)(b)/(f)).

5.3 iCloud / CloudKit. Data entered or assigned in the app is stored via Apple’s CloudKit in your private iCloud and synchronized between your devices. Apple is responsible for iCloud; Apple’s privacy policy applies. We have no access to your iCloud data.

5.4 No servers of our own, no tracking. Vinylist runs no servers of its own, collects no usage statistics, embeds no advertising/analytics SDKs and passes no data to third parties – apart from the services named above (Discogs, Wikidata, Apple).

5.5 App Store (Apple). Downloads and in-app purchases run through the App Store; Apple processes the associated data on its own responsibility.

6 · Data security

Transmission on the website is encrypted (TLS/HTTPS).

7 · Status

Last updated: November 2026. We will update this policy if our data processing changes.