Privacy Policy

Last updated: October 1, 2026

Spindl (“Spindl,” “we,” “us”) helps people catalogue and manage their personal music collections. Spindl is operated by Yumiwi LLC, a company based in Florida, USA, which is responsible for your personal data. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to the Spindl apps for iOS and Android and to spindlmusic.com.

1. Information we collect

Account. Your email address and a password, or — if you sign in with Google or Apple — the name, email address and picture they share with us (Apple may give us a private relay address instead of your real one). Passwords are handled by our sign-in provider and stored only as a secure hash; we never see them.
Profile. The username, display name, picture, country, city, currency, language and favourite genres you choose to add.
Your collection. The records you add or import and the details you enter: formats, pressings, conditions, notes, purchase prices, estimated values, storage locations and similar.
Photos you add. Cover photos you take or upload for records in your collection, and photos of record shops you submit to the shop directory.
Scans. When you identify a record by photo, the photo is sent for recognition (see section 4) and is not stored by us; we keep a record of the scan and its result. When you identify a song that is playing, audio is captured only while you hold the button and is used solely to find a match.
Social activity. Who you follow and who follows you, reviews you write, messages you send, and any reports or blocks you make.
Purchases. Your plan, subscription status, AI-scan balance and purchase history. Payments are processed by Apple, Google or Stripe; we never receive your card number.
Diagnostics. Crash and error reports from the app, linked to your account ID (not your name or email), and a short technical trail of the last steps before a crash. On the website, and only if you accept analytics cookies, aggregated usage statistics.
Location, only when you ask. If you use the record-shop finder, we use your device location (with your permission) or the postcode you type to find nearby shops. We do not save your location to your account. Postcode lookups are cached without any link to who searched.

2. Why we use it, and on what basis

To provide Spindl — your account, collection, scans, recommendations, social features and purchases. This is necessary to perform our agreement with you.
To keep Spindl secure and working — preventing abuse and fraud, fixing crashes and improving features. This is our legitimate interest in running a reliable service.
With your consent — website analytics cookies, device location and optional features you switch on. You can withdraw consent at any time.
To meet legal obligations — for example keeping payment records for tax and accounting.

We send service emails such as sign-in codes, receipts, renewal reminders and important account notices. We may also send occasional news and offers; every one of those has an unsubscribe link, and unsubscribing never stops the service emails. We do not sell your personal data, and we do not show ads or use advertising trackers.

3. Service providers

We use a small number of providers to run Spindl. Each processes data only as needed for its task and under its own privacy policy:

Supabase — sign-in, database and photo storage. Our database is hosted in the European Union (Ireland).
Netlify — hosting for our website and servers.
Apple, Google and Stripe — payments made in the iOS app, the Android app and on our website. RevenueCat checks app-store receipts and tells us which plan you are on; it receives a purchase identifier and your Spindl user ID.
Google (Gemini) and OpenAI — the AI features described in section 4.
Sentry — crash and error reports from the app, hosted in the EU (Germany).
Google Workspace — delivery of our emails.
Discogs, MusicBrainz, the Cover Art Archive and Wikipedia — music information and cover images (see section 5).
Apple ShazamKit — identifying a song that is playing, only when you ask. Apple Music (MusicKit) — playback through your own Apple Music subscription, only if you choose; we do not receive your listening history.
Apple Maps, Google Maps, Google geocoding and OpenStreetMap (Nominatim) — the shop map, directions and turning a postcode into a place.
Google and Apple — optional sign-in.
Google Analytics — website usage statistics, loaded only after you accept analytics cookies.
TikTok, YouTube (Google) and Instagram (Meta) — we publish Spindl's own posts to Spindl's own accounts on these platforms and read back those posts' statistics. This uses only Spindl's accounts: we never connect to, read from or post to your social accounts, and none of your Spindl data is sent to them. Use of YouTube is subject to the YouTube Terms of Service and the Google Privacy Policy.
Amazon Associates and eBay Partner Network — some “Buy” links are affiliate links. If you tap one, that site knows you came from Spindl and we may earn a commission at no extra cost to you. We receive only aggregated commission reports, not your purchases.

4. AI features

Spindl uses AI in three places. Each sends the minimum needed, and none sends your name or email address:

Identify by cover. The photo you take is sent to Google Gemini to read the sleeve and suggest matching releases.
Album notes. The short stories and facts shown on an album are written by OpenAI from the album’s title, artist and public reference text (mostly Wikipedia). No information about you is sent. Each text is saved and shown to everyone who opens that album.
Recommendations. To suggest records, OpenAI receives a summary of your taste: your most-collected artists, genres, styles and decades, and the albums you already own so they are not suggested again.

Under the API terms of both providers, the content we send is not used to train their models. We may switch to a comparable provider (Anthropic is our backup); if we do, this list will be updated. AI can be wrong: identifications, pressing suggestions and album notes are suggestions to check, not facts we guarantee.

5. Where music data and images come from

Catalogue. Spindl’s own catalogue of releases is built from the public data that Discogs and MusicBrainz publish for anyone to reuse, and is stored on our servers.
Live lookups. Some searches, such as a barcode or catalogue number we don’t yet have, are looked up with Discogs from our servers. Only the search itself is sent, not who you are.
Cover images. Many cover images load directly from Discogs’ or the Cover Art Archive’s image servers. When they do, your device connects to those servers, which can see your IP address and device type under their own privacy policies. Some cover images are stored by us.
Your photos are stored by us, in our storage, and shown as your privacy settings allow (section 6).
Prices. Estimated values are based on Discogs marketplace data. Data provided by Discogs. This application uses Discogs’ API but is not affiliated with, sponsored or endorsed by Discogs. “Discogs” is a trademark of Zink Media, LLC.

6. What other collectors can see

Your collection is private unless you choose otherwise.

Private profile (the default). Only collectors whose follow request you have approved can browse your records.
Public profile. If you switch your profile to public, any collector can browse your records and follow you without approval. You can switch back at any time.
What a viewer sees. Only the records you own — never your wishlist — and only descriptive details: title, artist, release, year, format, genre, style, country and cover image.
Never shared with anyone. Estimated values, purchase prices, condition grades, notes and storage locations, on public and private profiles alike.
Always visible. Your username, display name, profile picture, how many records you own, and your follower and following counts.
Reviews you write about an album or a shop are public, with your display name and picture.
The activity feed. Records you add can appear in the feeds of collectors who follow you.
Messages are visible to the collector you send them to.

You can report or block another collector from any review or conversation; a blocked collector’s content is hidden from you immediately.

7. How long we keep data, and deleting your account

We keep your data while your account is open. You can delete individual records at any time.
Cancelling a subscription does not delete anything. Your whole collection stays and you can keep opening and editing it; if it is larger than the free plan’s limit, you can’t add more records until you subscribe again (see our Terms).
Deleting your account (in the app: Settings → Delete account) immediately removes your profile, collection, the photos you uploaded, your follows, messages, reviews and notifications. A shop you submitted stays in the directory without your photo.
We keep payment and purchase records as required for tax and accounting, and usage records of AI features with your account link removed.
Crash reports expire automatically at our crash-reporting provider, and copies in our routine database backups are overwritten on a rolling schedule.

8. Security

Data travels over encrypted connections (HTTPS). Passwords are stored only as secure hashes by our sign-in provider. Database rules make your private data accessible only to your own account, and your collection visible to others only as your privacy settings allow (section 6). Staff access to administration tools requires two-factor authentication. No system is completely secure, but we work to protect your data and will notify you and the authorities where the law requires if a breach affects you.

9. Children

Spindl is not directed to children. You must be at least 13 years old to use it, or older where the law of your country requires — for example, 14 in Spain. We do not knowingly collect data from children below that age; if you believe a child has given us data, contact us and we will delete it.

10. Your rights

Depending on where you live, you can ask to access, correct, export or delete your data, to restrict or object to processing, and to withdraw consent you have given. Email us at the address below; we will answer within one month. You can also complain to your data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

11. International transfers

Our database is in the European Union. Some providers listed in section 3 process data in the United States or other countries. Where the law requires it, those transfers rely on the safeguards in the providers’ data-processing terms, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

12. Changes to this policy

When we update this policy we change the “Last updated” date above. For significant changes we tell you in the app or by email before they apply.

13. Contact us

Questions about this policy or your data? Email hello@spindlmusic.com. Spindl is operated by Yumiwi LLC, Florida, USA.