WaxGoblin Privacy Policy
Effective October 20, 2026
WaxGoblin is a vinyl collection manager: an Android app, a server (the "API") and an optional Raspberry Pi display. This policy explains what information it handles and what happens to it. Questions: support@waxgoblin.com.
What we collect
- Account details: your email address and your password. The password is stored only as a one-way hash; we cannot read it.
- Your collection: the records you save (title, artist, label, catalog number, the year of the pressing and the year the album was first released, barcode, format, speed, condition, genres, cover image link, and the notes and storage location you type in). A storage location is free text you write yourself, for example the shelf a record is on; we do not interpret it.
- Sign-in and email tokens: the codes used to keep you signed in, verify your email address and reset your password.
We do not collect your location, contacts, photos, advertising ID or analytics data, and the app contains no ads or trackers.
Camera
The app asks for camera access only to scan a record's barcode. Camera images are read on your phone and are never uploaded or stored. You can type the barcode digits instead.
How we use it
To run your account and show you your collection, to email you verification and password-reset links, and to look up a scanned barcode. We do not sell your information or use it for advertising.
Who else handles it
- Railway hosts the API and its database.
- Cloudflare hosts this website. Like any web host, it sees the address and requests of people who visit these pages. The sign-in on the account deletion page goes straight to our API, not through the website's host.
- Resend delivers our emails, so it receives your email address and the message.
- Discogs receives the barcode you scan, to look up the record's details. It is not told who you are.
We share information with no one else, except where the law requires it.
Storage on your device
The app keeps your sign-in tokens in your phone's secure storage (Android Keystore). They are removed when you sign out or delete your account. If you use the optional Raspberry Pi display, it keeps its sign-in tokens in its web browser's local storage, so it stays signed in after a restart, until the display is signed out or you delete your account. Anyone who can touch the display can view and edit your records on it.
Keeping and deleting your data
We keep your data until you delete your account. You can delete it inside the app or at waxgoblin.com/delete-account. Deletion removes your account and your whole collection immediately. Copies in the hosting provider's backups, if any, disappear as those backups are replaced in the normal course.
Security
Traffic to the API is encrypted (HTTPS) and passwords are hashed. No system is perfectly secure, so choose a password you do not use elsewhere.
Children
WaxGoblin is not directed at children under 13, and we do not knowingly collect their information.
Changes
If this policy changes, the new version will be posted here with a new effective date.