Privacy Policy

Last updated: July 2026

Vinyl is a music ranking app that lets you rank songs, albums, artists, and live shows, share your taste with friends, and message people you follow. This policy explains what data we collect, how we use it, and your rights.

What we collect

• Account information — email address or phone number used to create your account, plus your username and display name
• Profile content — profile photo you upload
• Live show photos — photos you upload to live shows you've ranked, and the location associated with each photo (from the photo's embedded GPS data if present, or otherwise the venue's location) so it can be plotted on the Map feature
• Precise location (optional) — if you grant location permission, your device's current location is used only to center the Map feature near you and to show a "you are here" marker; it is not stored on our servers and the map works without it
• Music data — songs, albums, artists, and live shows you rank; scores you give; genre and artist preferences from onboarding
• Social content — comments you post, accounts you follow, likes you give, and live show tags
• Messages — direct messages you send and receive, including text, GIFs, and shared rankings, profiles, or lists. Message content is stored on our servers and is visible only to the participants in that conversation.
• Invite data — phone numbers or email addresses you enter when inviting friends, used only to send that specific invite and match the referral if they sign up
• Device identifiers — push notification token, used only to deliver notifications you've enabled

How we use it

All data is used solely to provide Vinyl's core functionality: your rankings, your social feed, direct messages, music recommendations, notifications, and the Apple Music integration when you choose to connect your account. We do not sell your data, share it with advertisers, or use it for any purpose outside the app.

Live show photos and the map

Photos you upload to a live show are visible to people who follow you or, if your profile is public, to anyone using the app — including on the Map feature, which shows live show photos plotted by location, along with the show, artist, venue, and your ranking for that show. You can delete any photo you've uploaded at any time, which removes it from our servers and from the map immediately. You can also report photos posted by other users; a photo reported by three or more distinct users is automatically hidden pending review.

Third-party services

• Supabase — database and authentication infrastructure. Your data is stored on Supabase servers.
• Twilio — phone number verification (one-time codes) and invite SMS delivery. Phone numbers are transmitted to Twilio only when you use phone-based features.
• Apple Music — music catalog search, metadata, and chart data, provided via the Apple Music API using app-level credentials. If you choose to connect your Apple Music account (optional, used for importing existing playlists or creating new playlists from your rankings), Vinyl receives a Music-User-Token from Apple, stored securely on your device, that lets us read your library or add playlists on your behalf. We never receive your Apple ID password and only access your library when you initiate an action. When you create a playlist from a ranking, we record the playlist name, filters used, song count, and resulting playlist URL in our database so the source list's owner can see playlists made from their list. Use of Apple Music data is governed by Apple's terms.
• iTunes Search API — fallback music metadata and audio preview URLs.
• Setlist.fm API — live show / concert data for ranking live performances.
• GIPHY — GIF search and selection in messages and comments. When you use the GIF picker, your search query is sent to GIPHY's API to return results. GIPHY may collect data about these requests in accordance with their own privacy policy. GIFs you send are stored as URLs referencing GIPHY's servers.
• OpenStreetMap, OpenFreeMap, and Nominatim — the Map feature's tiles and location search. When you search for a place on the map, your search text is sent to Nominatim (OpenStreetMap's geocoding service) to return matching locations. Map tile requests and place searches do not include your Vinyl account information.

Contacts

If you choose to access your contacts to invite friends, Vinyl reads contact names, phone numbers, and email addresses only to pre-fill the invite form. This data is never stored on our servers and is not used for any other purpose.

Data retention and account deletion

Your data is stored as long as your account exists.

You can permanently delete your account at any time, in the app, by going to Settings → Account → Delete Account. You'll be asked to confirm twice before deletion proceeds. Deletion is immediate and cannot be undone — once you confirm, the following are permanently removed from our servers:

• Your profile (username, display name, avatar, bio)
• Your rankings, lists, and head-to-head comparisons
• Your follows and follow requests, in both directions
• Your direct messages and conversations
• Your comments and likes
• Your live show photos, both from our servers and from storage
• Your invite credits and invite history
• Your notification preferences and push token
• Your authentication record (email/phone)

Deletion happens entirely in the app — no website visit, email, or customer service contact is required.

Children's privacy

Vinyl is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

Security

We use industry-standard security practices including encrypted connections (HTTPS), secure authentication, and row-level security on our database. No method of transmission over the internet is 100% secure, but we take reasonable measures to protect your data.

Changes to this policy

We may update this policy from time to time. We'll update the date at the top of this page when we do. Continued use of the app after changes constitutes acceptance of the updated policy.

---