Privacy Policy
Last updated 26 October 2026
Kollektion (“we”, “us”) helps you visualize, value and organize your media collection. This policy explains what personal data we process, why, and the choices and rights you have. Questions: tony@d9cd.net.
What we process
- Account — your email address and sign-in credentials, display name and optional profile photo.
- Discogs connection — your Discogs username and the access tokens you authorise (or a personal access token you provide), so we can read and update your Discogs collection on your behalf.
- Your collection — the releases, folders, grades, wantlist and “watch” choices synced from Discogs; and details you add yourself: notes, purchase price/date/location, play counts and storage/inventory locations.
- Photos you upload of your items and your profile photo.
- Valuations we compute from public marketplace prices.
- Notifications — if you turn on alerts, a device token so we can send push notifications.
- Billing — if you subscribe, your plan and subscription status and a customer/subscription reference. Card details are handled entirely by our payment provider; we never see or store them.
- Technical — standard logs (e.g. IP address, request data) needed to run and secure the service. If something goes wrong in the website or the app, we record an error report (what failed, the page, your browser or device type, and your account if you are signed in), and keep it for 30 days.
Why we process it (lawful bases)
- To provide the service (performance of our contract with you) — running your account, syncing and showing your collection, valuations, inventory and labels.
- Legitimate interests — keeping the service secure, preventing abuse, and improving it.
- Consent — AI condition grading (sending photos for analysis) and push notifications happen only when you opt in. You can withdraw consent at any time.
- Legal obligation — e.g. tax/accounting records for payments.
AI condition grading
If you choose to have a record graded from photos, those photos are sent to our AI provider (Anthropic) to estimate the media and sleeve condition. This happens only when you ask for it. The result is a suggestion you review and can override — it is not a guarantee of condition or value.
Who we share it with (sub-processors)
We don’t sell your data. We share it only with the service providers needed to run Kollektion:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and storage of your account data |
| Vercel | Application hosting |
| Cloudflare (R2) | Storage of your uploaded photos and avatar |
| Anthropic | AI condition grading of photos you submit (opt-in) |
| Stripe | Payments and subscription management (merchant of record, via Stripe Managed Payments) |
| Resend | Sending transactional email (e.g. receipts, alerts) |
| Apple | Delivering push notifications (APNs), if you enable them |
| Discogs | Your own connected account — we exchange collection data with Discogs at your request |
International transfers
We and our providers are based in, or process data in, the United States, so your data may be transferred and processed there. Where required, transfers rely on appropriate safeguards (such as Standard Contractual Clauses).
How long we keep it
We keep your data for as long as your account is active. When you delete your account, we permanently delete your collection data, photos, metadata and device tokens, and cancel any subscription. Some limited records (e.g. payment/tax records) may be retained where the law requires.
Your rights
You can, at any time:
- Access & portability — download a copy of your data from Settings → Privacy & data.
- Erasure — permanently delete your account and all its data from the same place.
- Rectification — correct your details in Settings, or edit your collection in the app.
- Withdraw consent — turn off AI grading or notifications at any time.
Depending on where you live (e.g. the EU/UK or certain US states) you may also have the right to object to or restrict processing, and to complain to your data protection authority. To exercise any right, email tony@d9cd.net.
Cookies, local storage & analytics
We use only essential cookies needed to keep you signed in, and your browser’s local storage to remember things you’d expect the app to remember — your theme, recent searches, and cached collection data — so it loads quickly. None of this is used for advertising or cross-site tracking.
We measure aggregate, anonymous usage and performance (for example, how many people viewed a page) to keep the service fast and reliable. This analytics is cookieless and doesn’t identify you or track you across other sites. Because we set no non-essential cookies, no consent banner is required — and if your browser sends a Global Privacy Controlor Do Not Track signal, we don’t record any analytics at all.
Children
Kollektion isn’t intended for children under 16, and we don’t knowingly collect their data.
Changes
We’ll update this policy as the service evolves and revise the “last updated” date above.