Privacy Policy
This policy covers the VINALL app and vinall.xyz. VINALL is operated by Excus Ltd, the data controller for the personal data described here. We do not show advertising, and we never sell your data or share it for marketing.
What we collect
- Account. Your email address and an encrypted password, handled by Supabase Auth; we never see the password. If you sign in with Apple or Google, we receive the email address (or Apple’s private relay address) and the name they share, and no password.
- Your music and profile. The albums and songs you rate, with scores, notes, lists, diary entries, the answers you give on Today, comments and Community Choice picks. Your username, avatar, bio and anything else you add to your profile.
- Age group. Under 13, 13–17 or 18 and over. We never store your date of birth.
- Spotify imports (optional). If you upload your Spotify data, your browser adds up your plays and we store only how many times and for how long you played each track, in total and per day, for Replay. Individual plays are never uploaded, and nobody else can see these totals. To match an imported library, each track’s title, artist and Spotify link are sent to our server; matches are cached without anything that identifies you.
- Usage events and crash reports. Which questions were shown, answered or skipped (linked to your account, with no message content), and the error message and page address when something breaks.
- Notifications (only if you turn them on). On the website we store the address your browser provides for delivery; messages are encrypted and passed through your browser’s push service (Apple, Google, Microsoft or Mozilla), which cannot read them. Turning notifications off or logging out deletes that address. App reminders are scheduled on your phone and nothing is stored with us.
- Blocks and reports. Who you block, and what you report, why and who you are, so it can be reviewed. The other person is never told who blocked or reported them.
The app also keeps a working copy of your ratings, diary, game progress and Replay summaries on your device, along with your login session and theme, so it is fast and works offline. These are not tracking cookies and are not shared. Clearing the app’s or site’s data removes them; anything synced to your account returns when you sign in.
Who can see it
Public: your username, avatar, bio, ratings (unless set to Friends or Just me), lists, Today answers you have not marked private, comments, Community Choice picks, follows and followers, Groove memberships and leaderboard scores. Private: your email address, usage events, imported listening history and anything you mark private.
You can change who sees your ratings on your profile at any time. Friends means people you follow who follow you back. Friends and Just me keep your scores and notes out of the public Crate feed and album reviews, and switching away from Anyone removes what you had already posted there.
Services we use
Supabase stores the database and handles sign-in, in its EU region (eu-west-1). Vercel hosts the site on a global network. The other services below receive nothing that identifies you, except where stated. VINALL does not use Spotify’s services.
- Deezer supplies artwork, track listings, catalogue data and 30-second previews. Your searches and the names of albums and artists you open are sent to it. Apple supplies a few previews and covers Deezer lacks, on the same basis.
- YouTube plays some Community Choice picks in its own embedded player. Nothing loads from YouTube until you agree, and you can keep the Deezer preview instead. Once a video plays, YouTube’s privacy policy applies to that player. When you pick a moment, the song and artist name are sent to YouTube to find the video.
- Wikidata and MusicBrainz receive an artist’s Deezer ID to find their public streaming-chart page for Bid Wars and Collection values. kworb.net supplies those streaming totals. Discogs receives album and artist names when you start a Bid War in Score mode.
- MusicBrainz is also asked directly by your device for artists’ countries in Music Passport, so it sees your IP address and the artist names.
- jsDelivr delivers the code library the website uses to reach the database, and sees your IP address.
- Apple and Google sign-in, if you use them, confirm who you are and share your email address and name under their own privacy policies.
How long we keep it
Your account and content are kept until you delete your account. Usage events are deleted after 13 months and crash reports after 90 days; both stop being linked to you when your account is deleted. Reports about an account or post are kept with the decision after review, so moderation stays consistent; reports you filed are deleted with your account. A suspended account’s data is kept until it is deleted, so an appeal can be reviewed.
Deleting your account
Choose Delete my account on your profile. This immediately and permanently removes your ratings, Today answers, lists, Grooves, profile, avatar, imported listening history and login. There is no waiting period and it cannot be undone.
Age
You must be 13 or over to use VINALL. Under-13 accounts are signed out and closed; if you believe a child under 13 has an account, contact us and we will remove it. If you are 13–17, your ratings start visible to friends only, which keeps them out of the public feed. Please do not post anything that identifies where you live or go to school. VINALL has no direct messages, does not use your location and shows no advertising.
Legal basis and profiling
Under UK and EU data protection law, we rely on contract for your account and the music you rate, as the app cannot work without them, and on legitimate interests for usage events, crash reports and moderation records, which keep the app working and safe.
Replay, Music DNA, About You and Taste Match analyse your ratings and listening to describe your taste. The results are shown to you and, for Taste Match, to the person you are compared with, only where your ratings are public. They are not used for advertising, and no decision with legal or similarly significant effects is made from them.
Where it is held
The database and sign-in run in Supabase’s EU region. Vercel’s network is global, so a page may be served from outside the UK or EU. Both providers are bound by data processing terms.
Your rights
If you are in the UK or EU, you can ask to access, correct or erase your data, restrict how it is used, or object to uses based on legitimate interests. You can export your ratings at any time from Settings → Your ratings → Export, and deleting your account erases your data immediately. For anything else, email us and we will reply within one month.
To complain about how we have handled your data, email vinall.support@gmail.com, ideally with “Data protection complaint” in the subject, although any message that is clearly a complaint counts. We will acknowledge it within 30 days, investigate, keep you updated and tell you the outcome. You can also complain to the Information Commissioner’s Office, which usually expects you to contact us first.
Changes
If we change what we store or who can see it, we will update the effective date above and tell you in the app. Minor corrections may be made without notice.
Contact
Excus Ltd, registered in England and Wales (company number 17517058), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Email vinall.support@gmail.com for any privacy question or request.