Privacy Policy

Last updated: 29 September 2026

Groovv is a vinyl collection app for iOS and Android, made by one collector in Melbourne, Australia. This policy explains what information Groovv collects, why, who it's shared with, and the choices you have. We've tried to write it in plain English. If anything is unclear, email support@groovv.app.

In this policy, "Groovv", "we", "us" and "our" mean Alec Wren, trading as Groovv (ABN 21 411 738 449), who operates the Groovv apps (the "App") and the website at www.groovv.app and its subdomains (the "Website"). For the purposes of the EU and UK GDPR, we are the data controller.

1. The short version

  • Your collection is private by default. Nothing is visible to other people unless you switch it on.
  • We don't sell your personal information, and we don't use it for advertising.
  • We use a small number of trusted services to run Groovv (listed in section 5). Some of them are outside Australia.
  • We publish and may share aggregated, de-identified statistics about vinyl collecting, such as the most-collected genres or pressings. These never identify you or show your individual collection.
  • You can see, correct, export or delete your data. Deleting your account removes your collection, photos and profile.

2. Information we collect

2.1 Your account

  • Email address, if you sign up with email and password. Passwords are stored securely hashed by our authentication provider. We never see them in plain text.
  • Name, email address and an account identifier from Apple or Google, if you use Sign in with Apple or Google Sign-In. If you choose Apple's "Hide My Email", we receive a private relay address instead of your real one.
  • Profile details you choose to add: username, display name and profile photo.
  • Settings and preferences, such as your profile visibility, your currency and notification choices.

2.2 Your collection and wantlist

This is the heart of Groovv, and it's information you add:

  • Records in your collection and Wantlist, including the specific pressing, number of copies and priority level (Grail, Hunting, Someday).
  • Details about your copies: media and sleeve condition grades, grading history, price paid and its currency and date, where you bought it, notes, tags, crates, shelf order and custom fields.
  • Condition photos and captions you attach to a grade, and any custom cover photos.
  • Listening and care logs: plays, cleans, the dates you log them (including past dates you enter) and your gear log (cartridge, stylus and belt changes).
  • Estimated values we calculate for your records from market data.

2.3 Discogs

If you connect your Discogs account:

  • We store the authorisation tokens Discogs gives us, so we can import and sync on your behalf.
  • We import your Discogs collection, folders, custom fields, ratings and wantlist.
  • Sync is one-way. Groovv reads from Discogs and never writes to, edits or deletes anything in your Discogs account.

You can disconnect Discogs at any time in Settings. You can also revoke Groovv's access from your Discogs account settings.

2.4 Scanning

  • Barcode scans read the barcode number on the device and look it up in the Discogs database. No image leaves your device.
  • AI cover scans send a photo of the album cover to Google's Gemini service, which identifies the record. We don't store the photo. Google doesn't use it to train its models, and keeps it only for a limited period to detect misuse of its service. We keep only the result: the identified release.

2.5 Social and sharing features

If you choose to use them:

  • Your profile visibility (Public, Followers only or Private) and who you follow and who follows you.
  • Your share page and shared crates, including the fields you choose to show or hide.
  • Blocks and reports you make, and reports made about your profile or content.

2.6 Purchases

  • If you buy Groovv Pro or a Collection Report, Apple or Google processes the payment. We never receive your card or bank details.
  • We receive your purchase and subscription status (for example, which plan you have, trial status and renewal dates) through RevenueCat, so Pro works on every device you sign in to.

2.7 Collection Report

When you order a Collection Report, we use your collection data, values, condition grades and condition photos to generate a PDF. We then email it to the delivery email address you give us. This defaults to your account email, but you can change it (and you'll need to if you signed in with Apple's Hide My Email).

2.8 Information collected automatically

  • Device and app information: device model, operating system version, app version, language and region.
  • Crash reports (through Firebase Crashlytics): when the App crashes, we receive a stack trace and technical details (device model, OS version, available memory and disk space, whether the device is jailbroken or rooted) plus a random installation identifier and your Groovv account ID (a random ID, never your email or name), so we can match a crash to a support request. These help us find and fix bugs.
  • App usage analytics (through Google Analytics for Firebase): which screens and features are used, sessions and their length, app opens and updates, in-app purchases, search terms you enter, device model, OS version and your approximate location (country or city, worked out from your IP address). These are linked to a random app installation ID (and, on iOS, Apple's vendor identifier), not to your name, email or collection. We use them to understand what's working and what to improve.
  • Push notification tokens, if you allow notifications, so we can deliver them to your device.

2.9 On the Website

The Website uses Google Analytics 4 to measure how many people visit, which pages they read and how they found us. It records your approximate location (country or city), browser, device type and pages viewed, and uses cookies to recognise return visits. We don't use it to identify you, and we don't use advertising cookies.

  • If you're in the EU, EEA, UK or Switzerland, we don't set analytics cookies unless you accept them in the cookie banner. Until you do, Google may receive basic cookieless signals (for example, that a page was viewed), which can't be linked to you.
  • Everywhere else, analytics cookies are on by default.

Wherever you are, you can change your choice at any time with the Cookie settings link at the bottom of every page. You can also block cookies in your browser settings or use Google's opt-out browser add-on.

2.10 What we don't collect

  • Your precise location
  • Your contacts or address book
  • Your browsing history outside Groovv
  • Advertising identifiers such as Apple's IDFA or Google's Advertising ID (we don't run ads, and we don't track you across other companies' apps or websites)

3. How we use your information

We use your information to:

  • Run Groovv: store and sync your collection, work out values, power your stats, listening history and recaps, and make everything available across your devices and offline.
  • Identify records from barcodes and cover photos.
  • Import from and sync with Discogs when you ask us to.
  • Run the social features you switch on: your public profile, share page, the Collectors directory, follows and Taste Match.
  • Generate and deliver Collection Reports you order.
  • Manage Pro: check your subscription status and restore purchases.
  • Send notifications you've opted in to, such as your monthly recap. We keep these sparse.
  • Contact you about your account, for example about security, purchases or important changes to Groovv or this policy.
  • Keep Groovv safe: prevent abuse, review reports and enforce our terms.
  • Fix and improve Groovv, using crash reports and app usage analytics.
  • Produce aggregated, de-identified statistics about vinyl collecting (see section 4.3).

Taste Match and the Collectors directory

To show a match percentage between collectors and rank the Collectors directory, Groovv compares the styles, decades and records in collections. This happens automatically. It only involves collectors whose profiles are visible (Public, or Followers only for people who follow them), and it only affects what you see in the App. It isn't used to make any decision that has a legal or similarly significant effect on you. If your profile is Private, your collection isn't included in other people's matches or the directory.

Legal bases (EU and UK users)

Where the GDPR applies, we rely on:

  • Contract: to provide the App and the features you ask for, including purchases and Collection Reports.
  • Consent: for push notifications, making your profile or share page visible, connecting Discogs and analytics cookies on the Website. You can withdraw consent at any time in Settings or your browser.
  • Legitimate interests: for crash reporting, app usage analytics, security, abuse prevention and producing aggregated, de-identified statistics. We've weighed these against your privacy and kept them minimal.
  • Legal obligation: where we have to keep records, such as for tax.

4. What other people can see

4.1 Your profile

Every account starts Private. You can change this in Settings:

  • Private: only you can see your collection. You don't appear in the Collectors directory.
  • Followers only: people who follow you can see your profile and collection.
  • Public: anyone using Groovv can see your profile, crates and collection. If you have 10 or more records, you may appear in the Collectors directory with a taste summary (for example "1970s · Soul · Funk") and a match percentage.

Condition photos are always private to you. You can block or report any profile.

4.2 Your share page

Your share page (share.groovv.app/yourusername) is off by default. When you turn it on, anyone with the link can see it, including people without Groovv, and search engines may index it. You choose which fields appear. Condition, price, notes, plays, tags and value can each be hidden. If you turn on Show Wantlist, your Wantlist shows covers, titles, artists and years only.

Share cards you create and post (for example to Instagram Stories) are shared by you, under that platform's own privacy policy.

4.3 Community statistics

Groovv Pulse (share.groovv.app/pulse) and reports we publish, such as studies of vinyl collecting trends, use aggregated, de-identified data. Examples are how many copies of a pressing are collected across Groovv, or which decades are most played. We may also share or license statistics like these to record labels, record stores and others in the music industry. These statistics never include your name, contact details, username, photos or notes. We only publish figures when enough collectors are involved that no individual can be picked out.

5. Services we use

We share information with these providers only as needed to run Groovv. They process it on our behalf under their own security and privacy commitments.

  • Supabase: Database, sign-in, file storage and server functions. Receives your account, collection data and photos. Location: India (AWS Mumbai region).
  • Google (Gemini): Identifying album covers. Receives cover photos from AI scans. Location: United States and other Google locations.
  • Google (Firebase Crashlytics): Crash reporting. Receives crash details, device info and installation IDs. Location: United States.
  • Google (Google Analytics for Firebase): App usage analytics. Receives usage events, device info, approximate location and installation IDs. Location: United States.
  • Google (Firebase Cloud Messaging) and Apple Push Notification service: Delivering notifications. Receives your push token and the notification content. Location: United States.
  • Apple (Sign in with Apple, App Store): Sign-in, app distribution and payments. Receives sign-in and purchase details. Location: Apple locations worldwide.
  • Google (Google Sign-In, Google Play): Sign-in, app distribution and payments. Receives sign-in and purchase details. Location: Google locations worldwide.
  • RevenueCat: Managing subscriptions and purchases. Receives your Groovv account ID and purchase status. Location: United States.
  • Discogs: Record database, search, import and sync. Receives search queries, barcodes and (if you connect Discogs) your Discogs authorisation. Location: United States.
  • Resend: Sending Collection Reports and account emails. Receives your email address, the email content and the report link. Location: United States.
  • Webflow: Hosting the Website. Receives standard web request data. Location: United States.
  • Google Analytics: Website analytics. Receives website usage data (see section 2.9). Location: United States.

We also look up Spotify and Apple Music links for records and fetch currency exchange rates. These lookups use record details and currency codes only, not information about you.

Privacy policies: Supabase · Google · Apple · RevenueCat · Discogs · Webflow · Resend

We may also disclose information if the law requires it, to protect the rights and safety of Groovv or others, or to a buyer or successor if Groovv is ever sold or restructured. In that case, this policy would continue to apply to your information.

6. Where your information is stored

Groovv is run from Australia, but your data is stored in and processed from other countries. Your account and collection data are stored with Supabase in India (AWS Mumbai region). Some of the services above process data in the United States and elsewhere. We take reasonable steps to make sure these providers protect your information to a standard comparable to Australian and GDPR requirements. For EU and UK users, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

A copy of your collection is also kept on your device so you can view it offline.

7. How we protect your information

  • All data is encrypted in transit (TLS) and at rest.
  • Database access is locked down with row-level security, so each account can only reach its own private data.
  • Condition photos are stored in a private storage bucket that only you can access.
  • We strip location and camera data (EXIF) from photos you upload.
  • Collection Report and photo export download links are private and expire.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and the relevant regulator as the law requires.

8. How long we keep it

  • Account, collection and photos: While your account is active.
  • After you delete your account: Permanently deleted within 30 days, including photos and your public profile. Encrypted backups are overwritten as they cycle out.
  • AI scan photos: Not stored by us. Google keeps them briefly for abuse monitoring.
  • Crash reports: 90 days (Firebase Crashlytics).
  • App usage analytics: Event data 2 months; user-level data 14 months (Google Analytics for Firebase settings).
  • Collection Report download links: Expire after a limited time, then removed. You can regenerate a report from the App.
  • Photo export links: 30 days.
  • Website analytics: Event data 2 months; user-level data 14 months (Google Analytics settings).
  • Website cookie choice: Stored in your browser until you change it or clear your browser data.
  • Purchase records: As long as tax and accounting law requires.
  • Aggregated, de-identified statistics: May be kept indefinitely, because they don't identify you.

9. Your choices and rights

You can do most of this directly in the App:

  • See and correct your information: everything you've added is visible and editable in the App.
  • Change your visibility: switch between Public, Followers only and Private at any time, and turn your share page on or off.
  • Export your data: download your photos as a ZIP. Pro members can also export a CSV of their collection.
  • Disconnect Discogs in Settings.
  • Turn off notifications in Settings or your device settings.
  • Delete your account in Settings. This deletes your collection, photos and profile.

You can also email support@groovv.app to:

  • ask for a free copy of all the personal information we hold about you, in a portable format (you don't need Pro for this)
  • ask us to correct, delete or restrict the use of your information
  • object to how we use it, including for aggregated statistics
  • ask any question about this policy.

We'll respond within 30 days. We may need to confirm your identity first.

Australia

We handle personal information in line with the Australian Privacy Principles. If you're unhappy with how we've handled a request or complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

EU, EEA and UK

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. You can also complain to your local data protection authority. We'd appreciate the chance to sort things out first.

California

We don't sell or "share" personal information for cross-context behavioural advertising, as those terms are defined in California law. You have the right to know what we collect, to request deletion or correction, and not to be discriminated against for using these rights.

10. Children

Groovv isn't intended for anyone under 13, or under the minimum age for consenting to data processing in your country, if that's higher. We don't knowingly collect information from children under these ages. If we learn we have, we'll delete it.

11. Changes to this policy

When Groovv changes, this policy will too. We'll update the date at the top. If a change is significant, such as a new use of your information, we'll let you know in the App or by email before it takes effect.

12. Contact

Groovv
Alec Wren, trading as Groovv
Melbourne, Victoria, Australia

Email: support@groovv.app
Website: https://www.groovv.app