GrailVinyl

Privacy Policy

Last updated: 2026-06-13 · Operated by GrailVinyl LLC, Washington

Data we collect

Always

• Anonymous analytics events via Firebase Analytics: app open, feature used (e.g. "scan", "crate session"), result counts, screen views, app version, iOS version, device model, country. These events do not include user-typed queries, transcripts, photos, or Discogs handles.
• Crash reports via Firebase Crashlytics: stack trace, iOS version, device model, app version, anonymous install ID.

Only if you connect Discogs

• Discogs OAuth token, stored in the device keychain. Used solely to fetch your collection from Discogs on your behalf. Removed when you disconnect.
• Cached collection metadata (release IDs, folder assignments), stored locally so the app can show "you already own this" without re-querying Discogs every time.

Never

• The Apple advertising identifier (IDFA).
• Contacts, location, calendar, health data.
• The contents of your voice transcripts or photos.
• Your Discogs username, real name, or email.
• Audio recordings.

Third-party data sources

GrailVinyl reads metadata from these public sources directly from your device. We do not proxy your requests through a server.

• Discogs — release data, pressings, prices.
• MusicBrainz — recording metadata.
• Cover Art Archive — high-resolution cover scans.
• Last.fm — your scrobble (listening) history, read to show what you play. If you connect Last.fm and enable scrobbling, your vinyl plays are also sent to your own Last.fm account. We never see your Last.fm password.

iCloud sync (your data stays in your iCloud)

If you sign in to iCloud and use GrailVinyl on more than one device, your personal collection data — store visits and their photos, acquisitions, Crate sessions, and release notes — syncs across your devices through your own iCloud private database (Apple CloudKit). This data lives in your iCloud account. GrailVinyl LLC never receives it, cannot read it, and does not store it on any server of ours. Deleting the app or signing out of iCloud removes the local copy; the iCloud copy is managed through your Apple ID / iCloud settings.

Affiliate links

Some "buy" and "listen" buttons are affiliate links (for example, Amazon Associates and partner retailers/streaming services). If you tap one and make a purchase, GrailVinyl LLC may earn a commission, at no extra cost to you. Tapping a link opens that retailer or service; we don't share your personal data with them beyond the standard referral tag in the link. The app shows a disclosure next to these links.

Data retention

• Local app data (cached covers, search history, Discogs collection snapshot) is kept until you delete the app or use in-app "Reset" controls.
• Firebase Analytics events: 2 months (Google's default).
• Crashlytics: 90 days.

Children

GrailVinyl is rated 4+. We do not knowingly collect personal information from children. The app does not require an account.

Your rights

• Stop analytics — uninstall the app. (We already don't track, this is belt-and-suspenders.)
• Disconnect Discogs — Settings → Discogs → Disconnect. The OAuth token is removed from your device immediately.
• Delete all local data — uninstall the app. iOS removes the entire app sandbox, including the keychain.
• EU / UK / California residents — you have the right to request access to, correction of, or deletion of any personal data we hold. Because we don't store personal data on a server, there is effectively nothing to retrieve — but you can still email us.

Changes

If we update this policy, we'll change the "Last updated" date above and surface the change in the next app update's release notes.

Contact

Questions? Email [email protected].