Privacy Policy

Spinlog is a personal, non-commercial project run by James Doro, an individual based in Lebanon, who is responsible for your data. You can reach us at contact@spinlog.org, with or without an account, or through the Contact page when you're logged in.

• Account details: your email address, a password (stored only in scrambled, hashed form), your username, display name, bio and, if you add one, your profile photo.
• Your collection: the records you add or import, including title, artist, year, label, country, format, edition, condition, comments, optionally price, currency, shop and purchase date, and optionally photos of your own copies.
• Imported files: if you import a collection from a file exported from Discogs, the file is read in your browser, and only the records you confirm are saved.
• Friendships: who you've sent requests to, and who your friends are.
• Comments you write on your own or your friends' records (which you can edit or delete), likes you give your friends' records (which you can remove), and the notifications generated by comments, likes and friend activity.
• Daily Spin: your answer to each daily music question, whether it was right, the points you earned, and your streak.
• Messages you send us through the Contact page.

We don't run advertising or analytics trackers, and we don't collect your location. We only ask for what the app needs: an email to log in and a username so friends can find you. Everything else is optional.

Like any website, our hosting and database providers automatically record technical data such as your IP address and browser type in their server logs, to keep the service running and secure.

The Crate Guide lists record shops, markets and collectors chosen by the administrators, with contact details those places make public, such as a shop's phone number or Instagram account. If you're listed and want your entry changed or removed, contact us and we'll do it.

• Any logged-in user can find you by username and see your username, display name and profile photo, so they can send a friend request.
• Accepted friends can see your collection, wishlist, bio, photos and general statistics such as your top artist.
• Anyone with the link, if you switch on your public profile. It is off by default. When on, visitors without an account can see your profile photo, name, bio and statistics, and, if you choose the full shelf, your records, covers and wishlist. You can switch it off at any time. We ask search engines not to list public profiles, but we can't control what people do with a link you share.
• Prices, shops, purchase dates and your private notes are never shown on a public profile. They are hidden from friends by default, and you can choose to share prices and shops with friends in your profile settings.
• Comments on a record are visible to the record's owner and to the owner's accepted friends. The owner can delete any comment on their records.
• Likes: the owner of a record can see who liked it. The owner's accepted friends see how many likes it has, but not who gave them.
• Daily Spin: you and your accepted friends can see each other's points, number of correct answers, number of days played and whether you have played today, on the Daily Spin leaderboard. Nobody can see which answer you picked. Everyone sees the same overall statistic of how many players got a question right.
• Your collector level is based on the number of records you own, plus bonus points earned in Daily Spin (never more than your number of records). Your level name and progress are shown to your accepted friends and, if you switch on your public profile, to anyone who opens it. Your Daily Spin answers and points are not shown there.
• Notifications are visible only to the person they are for.
• Photos you upload are stored as links that anyone who has the exact link can open, like any image on a web page. Don't upload anything you wouldn't want seen.
• Your email address is never shown to other users.
• The administrators of Spinlog can read messages sent through the Contact page, together with the sender's username and email address, so they can reply.

We use your data to run the service: logging you in, showing your collection, connecting you with friends, showing comments, likes, notifications, your collector level and the Daily Spin leaderboard, and answering your messages. We don't sell your data, share it with advertisers or use it to profile you.

• To provide the service you signed up for (your account, collection, friends and the features you use): this is necessary to perform our agreement with you, the Terms of Use.
• To keep the service secure and fix problems (server logs, preventing abuse): our legitimate interest in running a safe service.
• To answer your messages: our legitimate interest in replying, or your request.
• Your public profile is only shown because you switched it on, and you can switch it off at any time.

Spinlog is built on third-party providers that store or process data on our behalf: Supabase (database, login and file storage) and Vercel (which hosts the website). They only process your data to provide their service to us. Account emails, such as the link to confirm your email address or reset your password, are sent from no-reply@spinlog.org through our email provider, which receives your email address for that purpose only. We don't send newsletters or marketing emails.

These providers store data on servers outside Lebanon, and possibly outside your country, for example in the European Union or the United States. Both providers offer data processing terms that include safeguards for international transfers, such as the European Commission's standard contractual clauses.

When you search for a cover or a release, or look up a barcode, the title and artist you typed, or the barcode number, are sent to MusicBrainz. Release details come from MusicBrainz, and cover images are loaded from the Cover Art Archive, so your browser connects to that service to display them. We don't send those services your account details.

When you scan a barcode with your phone, the camera image is processed on your device and is never uploaded or stored. Only the number read from the barcode is used. On browsers that can't read barcodes themselves, a small reader program is downloaded from a public code delivery network, which can see your IP address like any website you visit.

We only use cookies and browser storage that the app needs to work, such as keeping you logged in, and to remember your preferences. There are no advertising or analytics cookies. The Cookie Policy lists every item.

We keep your data while your account exists. When you delete your account, we immediately and permanently delete your login, profile, collection, wishlist, uploaded photos, friendships, comments, likes, notifications, Daily Spin answers and messages from our database and storage. Backups kept by our providers may take a short time to clear. Server logs kept by our providers are deleted automatically after a limited period set by each provider.

You can:

• edit your name, bio and photo, and edit or delete any record, at any time,
• edit or delete your own comments at any time,
• remove a like you gave at any time,
• switch your public profile on or off,
• switch price sharing with friends on or off in your profile,
• remove friends to end their access to your collection,
• delete your account yourself at any time from your profile (Edit profile, then Delete account),
• ask us to export your data or correct anything through the Contact page (choose “Privacy or data request”), or by email if you can't log in.

Depending on where you live, you may also have the right to access the data we hold about you, have it corrected or erased, receive a copy in a portable format, restrict or object to how we use it, and withdraw any consent you gave. We'll answer requests within one month. You can also complain to the data protection authority where you live or, in Lebanon, to the Ministry of Economy and Trade, although we'd appreciate the chance to fix things first.

Access to your data is enforced in the database itself, not just in the app, so other users and visitors can only read what you've allowed. No online service is perfectly secure, but we take reasonable steps to protect your information.

The service isn't intended for children under 13, and we don't knowingly collect their data. If you think a child has signed up, contact us and we'll remove the account.

If we change this policy in a meaningful way, we'll update the date above and, where appropriate, tell you in the app.