Privacy Policy

1. Who we are

Wax Spinner (“we,” “us,” or “our”) is a social platform for vinyl record listeners, available at waxspinner.com, operated by Intergalactic Robots. This policy explains what personal data we collect, why we collect it, and your rights regarding that data.

For privacy-related questions, contact us at Contact us.

2. What data we collect

• Account data: your email address, username, and password (stored as a bcrypt hash -- we never see your plaintext password).
• Profile data: optional display name, bio, and avatar image synced from your Discogs profile.
• Discogs collection data: if you connect your Discogs account, we import your vinyl collection records (title, artist, label, year, cover art URL) and store them on our servers.
• Activity data: spins you post, comments you write, and likes you give.
• Usage data: standard server logs including IP addresses and request metadata, retained for up to 30 days for security purposes.

We do not collect payment information. We do not run third-party advertising.

3. How we use your data

• To operate and provide the Wax Spinner service
• To display your profile, spins, and activity to other users
• To send transactional emails (account confirmation, password reset)
• To detect and prevent fraud and abuse

We do not sell your data. We do not share your data with third parties except as described below.

4. Third-party services

• Supabase: our database and authentication provider. Data is stored on Supabase infrastructure in the US. See Supabase's privacy policy.
• Vercel: our hosting provider. See Vercel's privacy policy.
• Discogs: if you connect your Discogs account, your collection data is fetched via the Discogs API. We store only the data needed to power the service. See Discogs's privacy policy.

5. Cookies

We use a single session cookie to keep you logged in. We do not use advertising cookies or third-party tracking cookies. No cookie consent banner is required for this type of strictly necessary cookie under GDPR.

6. Your rights (GDPR)

If you are in the European Economic Area or UK, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (via your Settings page)
• Erase your data -- you can delete your account at any time from Settings, which permanently removes all your data from our systems
• Object to processing of your personal data
• Portability -- request a copy of your data in a machine-readable format

To exercise any right, email us at Contact us. We will respond within 30 days.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymized aggregate data (e.g. total spin counts) may be retained indefinitely.

8. Children

Wax Spinner is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, contact us at Contact us and we will delete the account promptly.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the “Last updated” date above and, where appropriate, by email. Continued use of Wax Spinner after changes constitutes acceptance of the updated policy.