Privacy Policy
1. Overview
Wax & Spindle is a third-party Discogs client for vinyl collectors. This policy explains what limited data is processed when you use the app and by whom.
The short version: your collection data lives on your device. The only data sent to external services is crash reports, and those contain no personal identifiers.
2. Authentication
Wax & Spindle uses Discogs OAuth 1.0a to connect to your Discogs account. The OAuth flow opens Discogs in an in-app browser — you log in directly on Discogs, not inside the app.
Once authorised, Discogs provides an access token. That token is stored in the iOS keychain on your device only. The app never sees, stores, or transmits your Discogs username or password.
3. Your Collection Data
Your collection, wantlist, and marketplace data is fetched from the Discogs API using your access token and cached locally on your device using SQLite. This data:
- Never leaves your device
- Is never uploaded to any server controlled by this app
- Is never shared with third parties
- Is not accessible to the app developer
Uninstalling the app permanently deletes all locally cached data.
4. Crash Reporting
Wax & Spindle uses Firebase Crashlytics (Google LLC) to receive crash reports. When the app crashes, a report is automatically sent to Google containing:
- Device model (e.g. iPhone 15 Pro)
- iOS version
- App version
- Crash stack trace
No personal identifiers, no Discogs data, and no collection information are included in crash reports.
Firebase's privacy policy is available at firebase.google.com/support/privacy.
5. Permissions
The app requests the following device permissions:
| Permission | Purpose | Required |
|---|---|---|
| Camera | Barcode scanner — look up records by scanning their barcode | Optional — only requested when you open the scanner |
| Network | Discogs API (collection sync, search, marketplace) and Firebase Crashlytics | Required |
6. Third-Party Services
| Service | Purpose | Privacy Policy |
|---|---|---|
| Discogs API | Collection, wantlist, search, marketplace data | discogs.com/about/privacy |
| Firebase Crashlytics | Crash reporting | firebase.google.com/support/privacy |
No advertising networks, analytics platforms, or social media SDKs are integrated.
7. Data Retention and Deletion
Your locally cached collection data is deleted when you uninstall the app. You are in full control:
- Delete cached data: Uninstall the app
- Revoke Discogs access: Visit your Discogs account settings and remove the app's authorisation — this immediately invalidates the stored access token
Crash report data is retained by Google per their Firebase data retention policy.
8. Children
Wax & Spindle is not directed at children under the age of 13. We do not knowingly process personal data from children.
9. Changes to This Policy
If this policy changes materially, the updated version will be published on this page with a revised effective date. Continued use of the app after changes constitutes acceptance of the updated policy.
10. Contact
For privacy questions or concerns, contact: support@vivianlobo.com