Privacy Policy

VinylPeek: Scan & Identify · Last updated November 6, 2026

VinylPeek identifies vinyl records, CDs and cassettes from a photo or barcode and shows their market value. This policy explains what data the app uses and why. In short: there are no accounts, no ads and no tracking, and we never receive your collection.

Data stored on your device

• Your collection, wantlist, scan history, photos you take, currency and language settings.
• If you connect Discogs, the Discogs access token is kept in the iOS Keychain.

We never receive this data. Backups you export are files you control; we don't see them. To fetch sharper cover images, the app may send our server the Discogs release ID of records shown on screen.

iCloud

• iCloud copy. On iPhone, the app saves a copy of your Collection and Wishlist in your own iCloud account, so you can restore them on a new phone or after reinstalling. It holds artist, album, release, format, year, genre, condition, price and cover address. Your scan history and photos are not in it. The copy is stored and handled by Apple under your iCloud terms; we have no access to it. To delete it and stop saving it, turn off the iCloud copy switch in Settings → Backup. Delete all data in Settings also deletes a copy that phone saved or restored.
• Device backups. If you back up your iPhone to iCloud or a computer, the backup includes the app's data on the device, as it does for other apps.

Data processed to identify records

• Photos you scan are sent to our server, which forwards them to Google's Gemini AI (a third-party AI service provided by Google LLC) to recognize the release. The app asks for your explicit permission before the first photo is sent, and you can withdraw it anytime in Settings → Privacy; barcode scanning and search keep working without it. We use images only to answer that request and don't store them. Under its terms for the paid Gemini API, Google doesn't use them to train its models, but it does keep requests and responses for a limited time to detect abuse and meet legal requirements.
• Barcodes you scan and the recognized release are looked up in the Discogs database to find the pressing and market prices. Barcodes are not sent to Gemini.
• Search queries and release lookups are sent to our server and passed on to Discogs.
• App check. The app uses Apple's App Attest service to show our server that it is a genuine copy. That sends Apple and our server a random key made for this purpose on your iPhone. It has nothing to do with your name or Apple account, and we use it only to count genuine copies. It stays in our server's memory and is gone when the server restarts.
• Our server is hosted by Render (render.com), and requests reach it through Cloudflare. Both handle your IP address to deliver each request and may keep it in their technical logs under their own terms. Our code uses it only for in-memory rate limiting against abuse, cleared within a day. We don't write it to our logs or link it to you.

Discogs account (optional)

If you choose to connect Discogs, the app talks to Discogs directly using your authorization to read your username and add records to your Discogs collection. That data is governed by the Discogs Privacy Policy. You can disconnect at any time in Settings.

Subscriptions

Purchases are handled by Apple. We use RevenueCat to check whether your subscription is active. RevenueCat receives an anonymous app user ID and your purchase history from Apple, never your name, email or payment details. See the RevenueCat Privacy Policy.

Crash reports

When the app crashes or hits an error, we use Sentry to receive a diagnostic report (device model, iOS version, app version and the technical error). Reports don't include your photos or collection. Sentry sees your IP address when a report arrives, and the app tells it not to store the address. See the Sentry Privacy Policy.

Exchange rates

To show prices in your currency, the app downloads public exchange rates from Frankfurter (frankfurter.dev). No personal data is sent.

What we don't do

• No account or sign-up; we don't collect your name, email or contacts.
• No advertising, no tracking across apps or websites, no selling or sharing of data.
• No location data.

Your choices

You can delete any record, turn off photo recognition by Google Gemini and disconnect Discogs in Settings, and manage or cancel subscriptions in your Apple Account settings.

Deleting the app removes your collection, history and settings from the device. An iCloud copy stays in your iCloud account unless you turn it off in the app before deleting the app. iOS can keep Keychain items after that: the count of free scans used this month, so that reinstalling doesn't reset the free plan, and your Discogs token if you didn't disconnect first. The count never leaves your device.

We keep no personal data on our own server, so there is nothing to export from it. RevenueCat keeps your anonymous ID and purchase history, and Sentry keeps crash reports. Email us if you want these deleted and we'll help.

How long we keep data

• Photos, barcodes and searches: not stored on our server after the request is answered. Google keeps photos for a limited time, as described above.
• Crash reports: kept by Sentry for a limited time (up to 90 days), then deleted.
• Subscription records: kept by Apple and RevenueCat as long as needed for billing and legal obligations.
• Everything on your device stays until you delete it or the app. The iCloud copy stays until you turn it off in the app.

Legal bases (EEA/UK users)

We process photos with Gemini based on your consent, which you can withdraw at any time. Subscription status is processed to perform our contract with you. Crash reports and abuse prevention rely on our legitimate interest in keeping the app working and secure.

International transfers

Our providers (Google, Render, Cloudflare, RevenueCat, Sentry, Discogs) may process data in the United States and other countries. Where required, they rely on safeguards such as the EU Standard Contractual Clauses.

Your rights

Depending on where you live (for example under the GDPR or California law), you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. We do not sell or share personal information for cross-context behavioral advertising. To make a request, email us; you can also complain to your local data protection authority.

Children

VinylPeek is intended for people aged 18 and over. It isn't directed at children and doesn't knowingly collect their data.

Changes

If this policy changes, we'll update this page and the date above.

Contact

Questions or requests: iaro.pavlv97@gmail.com