Privacy Policy

1 · Controller

Philipp Schäfer, Brucknerstraße 4, 81677 München, Germany · Email: privacy@vinylist.studio.

2 · Scope & principle

This policy applies to the website vinylist.studio and the Vinylist app. Vinylist is built for data minimisation: no tracking, no advertising, no analytics tools.

3 · Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent you have given (Art. 7(3)). You have the right to lodge a complaint with a supervisory authority (Art. 77) – the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

4 · Website (vinylist.studio)

4.1 Hosting (bunny.net). The website is hosted via bunny.net and delivered through its content delivery network. bunny.net is operated by BunnyWay, informacijske storitve d.o.o. (Cesta Komandanta Staneta 4a, 1215 Medvode, Slovenia), which processes data on our behalf (commissioned processing, Art. 28 GDPR; a data processing agreement is in place). Processing takes place within the EU. Legal basis: legitimate interest in secure, fast delivery (Art. 6(1)(f)).

4.2 Server log files. When the site is accessed, the server automatically collects an anonymised (shortened) IP address, the date/time, the page requested, the volume of data transferred, the referrer and browser/operating-system information. Purpose: technical operation, security and error analysis. Legal basis: Art. 6(1)(f). Retention period: up to 3 days.

4.3 No cookies, no tracking, no external resources. The website is static: no cookies, no analytics/advertising services; fonts and scripts are loaded exclusively from our own website – delivered via the bunny.net CDN, which acts as a processor (Art. 28 GDPR) on our behalf. No third-party services are embedded (no Google Fonts, no external CDNs) and no data is transmitted to third parties.

4.4 Getting in touch. If you email us (hello@ / support@ / privacy@), we process your details to handle your request. Legal basis: Art. 6(1)(b) or (f).

5 · App (Vinylist)

5.1 Discogs connection. On your initiative, Vinylist connects to your Discogs account via OAuth and loads your collection data from Discogs. Processing takes place in the app on your device. Discogs is operated by Zink Media, LLC (d/b/a Discogs), Beaverton, Oregon, USA; their privacy policy applies. Their external data protection officer is HewardMills Ltd (London, United Kingdom), reachable at dpo@discogs.com. Legal basis: your consent / performance of a contract (Art. 6(1)(a)/(b)).

5.2 iCloud / CloudKit. Data entered or assigned in the app is stored via Apple’s CloudKit in your private iCloud and synchronised between your devices. Apple is responsible for iCloud; Apple’s privacy policy applies. We have no access to your iCloud data.

5.3 No servers of our own, no tracking. Vinylist runs no servers of its own, collects no usage statistics, embeds no advertising/analytics SDKs and passes no data to third parties – apart from the named services (Discogs, Apple) that you use yourself.

5.4 App Store (Apple). Downloads and purchases (e.g. Vinylist Pro) run through the App Store; Apple processes the associated data on its own responsibility.

6 · Data security

Transmission on the website is encrypted (TLS/HTTPS).

7 · Status

Last updated: June 2026. We will update this policy if our data processing changes.