Privacy Policy

1. Who we are (data controller)

Vinylr (“Vinylr”, “we”, “us”) is the controller responsible for the processing of your personal data. Vinylr is a social app for ranking albums and logging live concerts. For any privacy matter, you can reach us at privacy@vinylr.app.

2. Personal data we collect

We collect the following data, depending on how you use the App:

• Identification and contact: email address, name, nametag/handle, profile photo, and bio.
• Acquisition:your answer to “how did you hear about us?” (the acquisition source).
• Content and activity: rankings/ratings, comments, direct messages (DMs), concert photos and videos you upload, vinyl wishlist and collection, song of the day, and Backstage posts.
• Notifications:your device's push notification token.
• Technical data: IP address, session identifier, and usage logs.
• Approximate location:only if you grant it, to show you “nearby concerts.” We use your coordinates at the moment of the query; we do not build a location history.

Sensitive data. Vinylr does not deliberately request sensitive personal data. However, content you choose to post (for example, photos or comments) could reveal personal information; posting it is voluntary and at your own responsibility.

3. Purposes of processing

Primary purposes (necessary to provide the Service):

• Create, authenticate, and maintain your account and profile.
• Store and display your content and activity (rankings, concerts, photos, videos, comments, wishlist, and collection).
• Enable social features, direct messages, and the Marketplace.
• Send you transactional emails and push notifications for the Service.
• Show nearby concerts (if you grant location access).
• Ensure security, prevent fraud or abuse, and handle reports and moderation.

Secondary purposes (not necessary for the Service):

• Improve and develop new App features.
• Generate usage metrics and statistics.
• Send you marketing communications about Vinylr.

You can opt out of the secondary purposes without affecting the provision of the Service by sending your request to privacy@vinylr.app.

4. Third parties, processors, and international transfers

To operate the Service we share the strictly necessary data with providers acting as processors or recipients, some of which may be located outside Mexico:

• Supabase — authentication, database, and storage of images and videos.
• Vercel — backend/server hosting.
• Resend — transactional email delivery (confirmation, password reset).
• Expo / EAS — push notification delivery.
• Apple and Google — sign-in (login) when you choose those options.
• MusicBrainz, setlist.fm, Ticketmaster, Deezer, and Apple— sources of music and concert catalog data, cover art, and 30-second previews. We may send these sources minimal data such as an artist's name or, for nearby concerts, your approximate location.

We do not sell your personal data and we do not use it for third-party advertising. These transfers are those necessary to provide the Service. Where data is transferred outside Mexico, we rely on the necessity of the transfer to perform the Service you request, consistent with applicable law.

5. Your rights and how to exercise them

You have the right to access your data, rectify it when inaccurate, request its deletion when you consider it is no longer needed, and object to its processing for specific purposes. Under Mexican law these are known as the ARCO rights (Access, Rectification, Cancellation, and Opposition); they also correspond to GDPR-style rights of access, rectification, erasure, and objection.

To exercise them, send your request to privacy@vinylr.app stating: (i) your name and contact email; (ii) a clear description of the right you wish to exercise and the data involved; and (iii) any detail that helps us locate it. We may ask for information to verify your identity. We will respond within a maximum of 20 business days and, if the request is well-founded, we will give it effect within the following 15 business days, in accordance with the LFPDPPP.

6. Withdrawing consent

You can withdraw at any time the consent you have given us for the processing of your data, to the extent permitted by law, by writing to privacy@vinylr.app. Withdrawal may mean that we can no longer provide you with certain features or the Service as a whole.

7. Account deletion and data retention

We keep your data while your account is active. You can delete your account at any time from within the App, at Settings → Delete account. When you do, we permanently delete your account and the associated content (rankings, concerts, photos, videos, comments, wishlist, and collection, among others), with no possibility of recovery, except for residual technical backups or where we must retain certain information to comply with a legal obligation.

8. Cookies, technologies, and push notifications

The App uses session identifiers and similar technologies that are necessary for its operation and security. If you enable notifications, we store a push token to send them to you; you can disable them from your device settings at any time.

9. Children's data

Vinylr is not directed to children under 13, and we do not knowingly collect their data. Use by minors (as defined by applicable law) requires the consent and supervision of their parent or legal guardian. If we detect a minor's data without such consent, we will delete it.

10. Changes to this Privacy Policy

We may update this Policy. We will post the current version on this page with its update date and, where the changes are material, we will make reasonable efforts to notify you through the App.

11. Contact

For any privacy question or to exercise your rights: privacy@vinylr.app.