Privacy Policy

Last updated: October 2026

1. Introduction

This Privacy Policy explains what information VinylAI ("we," "our," or "us") collects when you use the VinylAI app on iPhone, iPad, Mac and Android ("App"), the VinylAI Market, and the website at vinylai.app ("Website"), how we use it, and the choices you have.

You can use every feature of the App without an account. Without one, your collection stays on your device.

2. Information We Collect

Your collection

Records, collections, purchase prices, conditions and notes you enter are stored on your device. They reach our servers only if you create an optional account (below).

Optional account and sync

Email address: used to sign in with a 6-digit code. There is no password and no name or profile picture.
Library backup: the records, collections, prices, conditions and notes you keep in the App, so they can be restored and synced between your devices. Photos stay on the device.
Signed-in devices: the device type (for example "iPhone" or "Mac"), platform and sign-in dates, so you can see and remove them. We never store your device's name.
Sign-in codes: stored only in a scrambled (hashed) form and valid for 10 minutes.

Photos you submit for identification

When you ask the App to identify a record from a photo, the photo is sent to our server and forwarded to an AI service that returns the artist, title and catalog details. We do not keep the photo. We keep a fingerprint (hash) of the image and the identification result for up to 7 days, so the same photo is not processed twice. The questions you type in the AI chat are processed the same way.

VinylAI Market

Listings you publish (description, price, country and city, photos) are public.
Messages between buyers and sellers are stored so the conversation can continue.
The App identifies you in the Market with an identifier it creates on your device. If you use the Market on the Website, you sign in with your email address.

Record Studio

Designs you choose to publish are public. Designs you do not publish stay on your device.

Automatically collected information

Usage and device data: features you use, app version, device type, operating system and language, through Firebase Analytics.
Advertising identifier (iPhone and iPad only): collected only if you allow tracking in the system prompt. The Mac app does not track you.
Notifications: if you allow notifications, a push token, your language and your time zone, so notifications arrive in your language at a reasonable local time.

Purchases

Subscriptions are bought through the App Store or Google Play. We never see your payment details. Our subscription provider, RevenueCat, receives an anonymous identifier created by the App and the store receipt. Your subscription is tied to your Apple ID or Google account, not to your VinylAI email address.

Music services

If you connect Spotify, the App uses your Spotify authorisation to show and control playback. Apple Music playback runs on your device through Apple's MusicKit.

3. How We Use Your Information

To provide the App, including identifying records, valuing your collection, and backing it up and syncing it if you have an account
To send the sign-in codes you request, and the notifications you have allowed
To run the Market and keep it safe (moderating listings and preventing fraud)
To understand how the App is used and improve it

We do not sell your personal information, and we do not use your photos or library to train AI models.

4. Service Providers

We share data only with the providers that run parts of the service for us:

Hosting provider: hosts our servers. The App's server, including account and sync data, is located in the United States.
UniOne: delivers sign-in code emails. It receives your email address.
OpenRouter: routes photo identification and AI chat requests to the AI model providers Google and OpenAI. They receive the photo or question, never your email address or account.
Google Firebase: provides analytics and push notification delivery (together with Apple Push Notification service).
RevenueCat: manages subscriptions.
Cloudflare: provides network delivery and protection for our website and API.
Discogs: supplies catalog and price data. Our server sends it search terms and record identifiers, never your personal information.
Spotify: only if you connect your Spotify account.

We may also disclose information when required by law or to protect our rights and users.

5. International Transfers

Our servers are in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. We rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses in our providers' data processing terms.

6. Retention

Account and backup data: kept until you delete your account. Deletion removes it from our live systems immediately. Our single rolling backup is overwritten within 24 hours, and deleted accounts are never restored from it.
Accounts left empty: an account that has no records and no signed-in device is deleted after 30 days.
Sign-in codes: 10 minutes.
Email delivery logs: 30 days, with the address stored in hashed form.
Photo identification results: up to 7 days, without the photo.
Market listings and messages: kept while the listing or conversation exists.

7. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal data, and to object to processing.

Delete your account: go to Settings → Account & Sync → Delete account in the App. The collection on your device is kept unless you choose to remove it. Deleting your account does not cancel a subscription. Manage subscriptions in your App Store or Google Play account.
Export your data: export your collection from the App at any time. If you have an account, you can also download what we store about you from the Account & Sync screen.
Notifications and tracking: turn them off at any time in your device's settings.

To exercise any other right, contact us (section 13). You may also complain to your local data protection authority.

8. Cookies

Our Website uses essential cookies for functionality and analytics cookies to understand how visitors use our site. You can manage cookie preferences through your browser settings.

9. Security

Data is encrypted in transit (TLS). Session tokens and sign-in codes are stored only in hashed form, and access to our servers is restricted. No method of transmission or storage is completely secure.

10. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this Privacy Policy. We will notify you of significant changes in the App.

12. AI Assistants (ChatGPT)

VinylAI is also available as an app inside AI assistants such as ChatGPT ("Vinyl Record Scanner - VinylAI"). This section covers that use. Everything else in this policy applies as well.

What we receive

The photo you attach in ChatGPT (a cover, label or runout) and the text you give the plugin to search with, such as a catalog number, a runout etching or a barcode.
If you sign in to save records: your email address and the records in your VinylAI collection. The plugin reads only your collection and your email address, and adds a record only when you ask it to.
ChatGPT's own identifier for you, kept only as a one-way hash, so that we can count users and apply fair-use limits.

Why we use it

To read the text on your photo and match it to our catalog of records.
To save records to your VinylAI collection and show your collection back to you, so that it syncs with the VinylAI app.
To keep the service working and safe: counting calls and limiting abuse.

Who receives it

OpenRouter, our AI routing provider, which passes the photo to AI models from Google and OpenAI to read the text on it. This is the same provider the VinylAI app uses. Only the photo is sent: never your email address, your account or your collection.
OpenAI, which runs ChatGPT. It handles what you type and attach in ChatGPT under its own privacy policy, and it receives the answers the plugin returns, including your collection records when you ask to see them.
Our servers, located in the United States, and the providers listed in section 4, such as the email provider that delivers your sign-in code.
We do not sell your data, and we do not use your photos or your collection to train AI models.

How long we keep it

Photos: processed in memory only, never written to disk, and dropped when the request ends.
The text read from a photo: cached against a fingerprint (hash) of the image for up to 7 days, so the same photo is not read twice. The photo itself is not kept.
Call logs: the tool used, the time, the result status, and your account or the hashed ChatGPT identifier. They contain no photos, no text and no search terms, and are deleted after 90 days.
Collection records and your account: kept until you delete your account. A ChatGPT connection that goes unused for 30 days expires.

Your controls

Disconnect VinylAI in ChatGPT: open ChatGPT settings, go to your connected apps and disconnect Vinyl Record Scanner - VinylAI. ChatGPT can then no longer see your collection or add to it.
Delete your account in the VinylAI app (Settings, then Account & Sync, then Delete account), or write to [email protected]. We answer within 30 days, and deletion removes all your records and all ChatGPT connections.
The plugin never deletes or edits records. Do that in the app.
Your other rights, such as access and export, are described in section 7.

13. Contact Us

If you have questions about this Privacy Policy or your personal data, please contact us through our contact page.