Last updated: 2026-11-01
Honest Vinyl Scanner has no accounts, never asks for your location, and never sells your data.
What leaves your phone, and what we receive about it
| What | Why | Who gets it |
|---|---|---|
| The photo you scan | To read the record | OpenRouter, which passes it to Google (Gemini) to read |
| The text read off it (artist, title, catalogue number…) | To find the release in our catalogue, and its asking price | Our own server, and CDandLP (artist, title, catalogue number only) for an asking price |
| Android’s id for this app (no name attached) | To count scans for fair-usage limits | Our own server only |
| Whether you bought Pro | To unlock Pro features | Google Play, RevenueCat, and our server, which asks RevenueCat to lift your daily limit |
| Each step of a Pro purchase (started, paid, cancelled, pending, failed with an error code, a pending payment that later went through), with your app version and the app's id | To see whether buying Pro works | Our own server. A cancelled, pending, failed or later-completed step is also emailed to our own inbox (Gmail), without the app's id |
| A payment report for each Pro payment event (bought, renewed, refunded, auto-renew turned off or back on, plan changed, ended, billing problem): the product, price, currency, country, store, why it was cancelled or ended, and the Google Play order number. It has no name and no email, but the order number lets us find your order in Google Play, for example to refund it | To handle refunds and payment problems, and to keep our own business records | Not from your phone: Google Play tells RevenueCat, RevenueCat tells our server, and our server emails it to our own inbox (Gmail) |
| A message you send us, with the app's device id — and for a Bug report, your app version, platform, and the last error the app recorded | To answer you or reproduce the bug | Our support inbox (hosted by Google, Gmail) |
Buying Pro: Google Play takes the payment. We never see your card, your name or your email.
What we never take
| What | Why not |
|---|---|
| ✕ Your location / GPS | Never asked for. The app has no location permission at all. |
| ✕ Your name or email | There is no account. We only see your email if you email us. |
| ✕ Your contacts or photo library | We only ever see the one photo you scan. |
| ✕ Advertising & tracking ids | No ad SDKs, no analytics SDKs, no session replay. |
| ✕ Your collection & scan history | Stays on your phone. If you have Android Backup on, your own Google account keeps a private copy (we never see it). Export a CSV anytime from Collection. |
Honest Vinyl Scanner is operated by Ing. Dmytro Trofymchuk, an independent sole trader (OSVČ) registered in the Czech Republic under IČO 87837072. This is the data controller for the purposes of the EU General Data Protection Regulation (GDPR). Contact: [email protected].
We do not collect: your name, email, contacts, precise or coarse location (GPS is never requested — the app has no location permission), or any advertising identifier.
We do collect, only to make the app work:
your phone. No other app sees it, and it stays the same after a reinstall. It is used solely to apply fair usage limits on the identification service. It is not tied to your name, email, or any account, because there is no account.
identification providers below to look up the release. We do not keep a copy on our servers.
image to complete the lookup.
When you scan a record, the photo and read text are sent to one or more of the following services to identify the release and its market value. OpenRouter, Google, RevenueCat and Cloudflare are data processors acting on our instruction, not independent users of your data.
shipped app that model is Google's Gemini. We instruct OpenRouter to forbid the model provider from retaining your image for training (`data_collection: deny`). If one Google service is unavailable, OpenRouter may route the read to another Google service (Vertex AI or AI Studio) so the scan doesn't fail. It never leaves Google.
server, so we can look up what copies of it are being asked for. It does not receive your photo, your device id or your network address, so it receives no personal data about you.
active. While Pro is active, the app sends our server RevenueCat's anonymous purchase id, and our server asks RevenueCat whether it is active, to lift the daily limit. They see a purchase, not your scans.
We do not send your scans to Anthropic (an earlier version of this policy said we did — that was wrong; the app ships with the Gemini model). We do not contact MusicBrainz from a published build.
All requests to these providers are routed through our own proxy (Cloudflare Workers) so that API keys never live on your device. The proxy strips your device id before forwarding — the providers above never receive it. What the proxy does keep, against that device id, is a plain operational record of each request: which service was called, the response status, whether it was served from cache, and how long it took. We use it to enforce fair-usage limits and to see when something is broken. There is no advertising or analytics SDK anywhere in the app, and none of this is linked to a person — there is no account to link it to.
Your scan history, identified records, and saved collection are stored locally on your device (`expo-sqlite`) and are never uploaded to us. Nothing else leaves your device: only what the table at the top lists. If Android Backup is enabled on your device, Android keeps a private copy of this local data under your own Google account as part of your device backup — we have no access to it.
You can permanently delete everything Honest Vinyl Scanner has stored on your device at any time from Settings → Clear local data. This removes your saved collection and scan history immediately and cannot be undone. We hold no server-side copy of your collection or scans. Our server keeps only the records listed under "How long we keep it". All of them expire on their own except payment reports, which we delete at the end of the period stated there.
The app's Help & Contact screen sends whatever message you type to our support inbox, routed through our proxy (Cloudflare Workers) and delivered to a mailbox hosted by Google (Gmail). If you use Bug report mode, we also attach a small diagnostics block: your app version and platform, and the last error the app recorded (an event name and error message only) — not your scan history, not the photo you scanned, and not what you searched for. This is separate from, and does not change, the "your collection & scan history stays on your phone" promise below.
So we can tell whether the app is working for the people using it, each scan sends us one word for how it ended — for example that we pinned a pressing, offered a shortlist, or could not read the photo — and each error sends us the name of the thing that failed, your app version, and where in the app's code it failed (up to six code positions: a function name, a file name and a line number, never the error text). Each step of a Pro purchase sends the step's name, the app version and, when it failed, the purchase library's (RevenueCat) error code. That is the whole message. It never includes the photo, the record, what you searched for, or any text you wrote. It is tied only to the device id described above and reaches our own server only. One exception: a purchase step that was cancelled, is pending, failed, or later went through is also emailed to our own inbox, without the device id.
The app is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18.
If you are in the EU/EEA, you have the right to access, correct, or delete your personal data, to restrict or object to its processing, and to lodge a complaint with a supervisory authority (in the Czech Republic, the Úřad pro ochranu osobních údajů, uoou.gov.cz). Your collection and scans live on your phone, and Settings → Clear local data deletes them. Request records, error reports and purchase steps are keyed to the app's device id, not to your name. To ask about them, write from the app's Help & Contact screen: that message carries the device id, so we can find them. They cannot be removed one by one, and they are deleted automatically after 3 months. Payment reports are keyed to your Google Play order number (it starts with GPA.): include it in your request and we will find and delete the report, unless we still need it for a refund or a payment dispute.
Why we may use it (GDPR art. 6). Scans, the price lookup, Pro and support messages: to provide the app you asked for (contract). Fair-usage limits, abuse protection, request records, error reports and purchase steps: our legitimate interest in keeping the service working and fair. Payment reports: our legitimate interest in handling refunds and payment problems and in keeping our own business records. Where we rely on legitimate interest, you can object at any time from Help & Contact, and we will stop unless we must keep the data for a refund or dispute.
How long we keep it. Fair-usage counters: 2 days. Request records, error reports and purchase steps (tied to the app's device id): up to 3 months, then deleted automatically. Payment reports: until the end of the third year after the year of the payment, then deleted. Cached price lookups (keyed by the record, not by you): up to 400 days. Support messages: until the issue is resolved, or sooner if you ask. Your network address (IP) is used for up to a minute of rate limiting and is not stored by us. Cloudflare's logs may keep it for a few days for security and troubleshooting.
Where it goes. Cloudflare (our server and email routing), Google (Gemini, which reads your photo), OpenRouter (routes the photo to Gemini), RevenueCat (Pro purchases, and the payment reports it sends to our server) and Google Play (Pro purchases). Some of them are in the United States. Our inbox (support messages and payment reports) is a Gmail account. Google holds it under its own terms and privacy policy (https://policies.google.com/privacy), as it does for any Gmail user. The other vendors process data on our instruction under data processing terms that include the EU standard contractual clauses, and we rely on the EU–US Data Privacy Framework where the vendor is certified.
We may update this policy as the app changes. Material changes are listed in the app's release notes and dated at the top of this page.
Questions about this policy: [email protected]