Privacy

Last updated 8 September 2026

VINALL is a small independent site for rating music and keeping track of what your records mean to you. This page says plainly what it stores and who can see it. There is no advertising on VINALL and your data is never sold or shared for marketing.

What is stored

Your account — the email address you sign up with, and an encrypted password. Handled by Supabase Auth; we never see your password.
Your music — the albums and songs you rate, your scores, notes, lists and diary entries.
Your lore — the answers you tap on Today, plus any optional note you add.
Your profile — username, avatar, bio, and anything else you choose to fill in.
Listening history you import — optional, and only if you choose it. If you upload your own Spotify streaming history, VINALL adds up how many times you played each track and when you first and last played it, and keeps that. The individual plays are added up in your browser and are never uploaded; only the per-track totals are stored. Nobody else can see any of it, and you can remove it on your profile without touching anything else.
Usage events — which questions were shown, answered or skipped, so we can tell whether the app is any good. These are tied to your account but contain no message content.
Crash reports — if something breaks, the error message and page address are recorded so it can be fixed.
Blocks and reports — if you block someone, we store the fact that you blocked them. If you report something, we store what you reported, why, and who you are, so it can be reviewed. The person you block or report is never told who did it.

Stored on your device

VINALL keeps a working copy of your ratings, your diary entries and your game progress in your browser’s own storage, so the app is quick and still shows your crate if the connection drops. It also stores a login session and the theme you have equipped. None of this is a tracking cookie and none of it is shared with anyone. Clearing your browser data for this site removes all of it; anything already synced to your account comes back when you sign in.

What other people can see

VINALL is partly social, so some of this is public by design:

Public: your username, avatar, bio, ratings, lists, and lore answers you have not marked private.
Private: your email address, your usage events, any listening history you imported, and anything you mark private.

Your ratings visibility can be changed on your profile.

Other services

Supabase stores the database and handles logins (EU region).
Vercel hosts the site.
Spotify provides album artwork and catalogue information. Browsing VINALL does not tell Spotify who you are.
kworb.net provides public streaming totals used by the Bid Wars game. No personal data is sent there.

Deleting everything

Go to your profile and choose Delete my account. This permanently removes your ratings, lore, lists, grooves, profile, avatar, any listening history you imported, and your login. It cannot be undone, and there is no waiting period.

Age

You must be 13 or over to use VINALL. If you are under 18, please do not post anything that identifies where you live or go to school. If you believe someone under 13 has an account, contact us and it will be removed.

How long it is kept

Your account and your music — for as long as you have an account. Deleting your account removes them straight away.
Usage events and crash reports — kept while they are useful for fixing and improving the app, and not tied to you once your account is gone.
Reports — kept after a review is finished, because a record of what was decided is the only way to be consistent about it.

Why we are allowed to store it

If you are in the UK or EU, the legal bases are: contract for your account and the music you rate, since the app cannot work without them; and legitimate interests for usage events, crash reports and moderation records, which exist to keep the app working and safe. There is no advertising, no profiling and no automated decision-making.

Where it is held

The database and logins are in Supabase’s EU region (eu-west-1). Hosting is Vercel, whose network is global, so a page request may be served from outside the UK or EU. Both are bound by their own data-processing terms.

Your rights

If you are in the UK or EU you can ask for a copy of your data, ask for it to be corrected, ask for it to be erased, or object to the uses based on legitimate interests. Deleting your account erases it immediately; for anything else, get in touch and you will get an answer within one month. If you are not happy with the response you can complain to the Information Commissioner’s Office.

Contact

Email spam30492@gmail.com.