Spinbound helps you track the vinyl records you've pre-ordered — what's on order, where it is, and when it's coming. This policy explains what we collect, why, who processes it, and the choices you have. Spinbound is operated by Lane Becker.
What we collect and why
Account information. When you create an account with Sign in with Apple or an email and password, we store the email address associated with your account and a user identifier. If you use Sign in with Apple's "Hide My Email," we only ever see Apple's private relay address. This authenticates you and keeps your data yours.
Your records and order details. We store the artist, album, edition, shop, order number, tracking number, expected, ordered, and arrived dates, and any notes you add for each record you're tracking.
Forwarded order emails (optional). If you set up email forwarding, order receipts you forward to your personal Spinbound address (<handle>@in.spinbound.app; a generated u_<random> handle is the default) are received and processed to extract order details. Alongside the extracted details, we keep the email's subject line, sender address, and a message identifier so you can confirm what was added and see it in your activity history. Because the store writes the subject line, it may include your name. We may also save a product image from the email to use as provisional album artwork until official cover art is found. Spinbound processes the message body transiently but does not retain the full raw body. If the built-in parser cannot read an order email, a bounded excerpt may be sent to Anthropic as described below. We do not intentionally extract or store shipping or billing addresses or payment details as Spinbound fields, but forwarded receipt text may contain them while it is being processed. We only process mail you send to your Spinbound address; we do not read your inbox.
Push notification token. If you enable notifications, we store the Apple Push Notification service (APNs) device token so we can tell you when a record ships, is out for delivery, arrives, or needs your attention.
Operational metadata and diagnostics. We keep minimal records needed to run the service reliably, including inbound-email events, de-duplication keys, and internal usage counters that enforce cost and rate limits. The app also files diagnostic reports when something fails, such as repeated save conflicts or a tap that produces no response. These reports can include error stack traces, a short buffer of the app's recent internal operations, a structural description of the control you tapped (never the words displayed on screen), the app version, and your device's browser user-agent string. They are filed only after a failure, are rate limited, are read only by us, and are deleted after 180 days or when you delete your account.
Recognition signals (how Spinbound gets smarter). So that receipts from a store one person has taught Spinbound to read can be recognized automatically for everyone, we keep an account-linked server-side log of structural signals about how order emails are processed: which store's domain an email came from, the shape of its layout (format markers, never the email text), whether our reading was confirmed or corrected, and coarse timing such as the number of days between ordering and shipping. When you confirm or correct an album's artist, that album-and-artist name pair may join a shared catalog used to identify the same release for other users. The raw log is otherwise deleted after 180 days, and when you delete your account it is purged immediately. Shared catalog facts describe stores and releases and do not contain your name, email address, order numbers, or collection. When you delete your account, any opaque former-account identifier attached to candidate-store trust metadata is also scrubbed at deletion.
We do not collect location, contacts, browsing or search history, or advertising identifiers. We do not build an analytics profile of how you use the app. The failure-only diagnostic reports described above exist solely so we can identify and fix faults.
Who processes your data
Spinbound relies on a few services to operate. We share only what each needs to do its job:
- Supabase — database, authentication, and file storage in the United States, protected by row-level security so each account can access only its own data.
- Apple — Sign in with Apple and the Apple Push Notification service.
- Cloudflare — email routing for forwarded orders and hosting for the Spinbound website.
- Anthropic — when a built-in parser or lookup needs a fallback, Spinbound may send a bounded portion of a forwarded email (its sender, subject, and message text, plus labels Spinbound derives from it, such as the sender's domain and whether the email passed its authentication checks; for a manual forward whose original sender can't be recovered, the sender is you), text you enter for a natural-language add, record/release/order metadata, candidate matches, or bounded store-page text to Anthropic's Claude models (currently Claude Haiku, via the Anthropic API). Anthropic processes these inputs and outputs solely to provide the feature. Spinbound uses Anthropic's standard commercial API: your inputs and outputs are not used to train Anthropic's models, and Anthropic automatically deletes them from its backend within 30 days (with limited exceptions where Anthropic must retain longer to enforce its Usage Policy or comply with law). Spinbound does not submit your content to any Anthropic feedback or model-improvement program. See Anthropic's current model-training policy and retention policy.
- EasyPost and FedEx — tracking numbers are sent to EasyPost, or directly to FedEx for FedEx shipments, to look up live carrier status.
- MusicBrainz and the Cover Art Archive — album-artwork lookups search MusicBrainz by artist and title, then fetch the matching cover from the Cover Art Archive; they do not include your account information.
- Discogs — searches by album title help identify an album's artist and check album titles; they do not include your account information.
- Apple iTunes and Deezer — release-date lookups use artist and title metadata and do not include your account information.
- Record stores (currently Rough Trade and Newbury Comics) — release-date lookups search these stores' public websites by artist and title; they do not include your account information.
We do not use advertising networks or third-party analytics SDKs, and we do not share your data with data brokers.
The website
The Spinbound website at spinbound.app has a waitlist form. When you submit it, we store the email address you enter, a source label identifying which form you used, and your browser's user-agent string. We use these only to email you about the TestFlight launch and to detect abuse of the form. We do not add you to another list or share the entry. The site uses no third-party analytics, advertising, or trackers, and its fonts are served from our own domain. To leave the waitlist, email privacy@spinbound.app and we will delete your entry.
Data retention and deletion
We keep your records while your account is active. Arrived records are archived as collection history rather than automatically deleted. Records you remove in the app, such as a cancelled order, are also archived rather than erased: they leave your feed but stay with your account as history until you delete your account.
You can delete your account from within the app at Settings → Delete account. This permanently removes the account and its tenant-scoped database data — including your records, forwarding address (except as described below), device tokens, inbound event history, and diagnostic reports — and also purges your raw recognition signals, scrubs any former-account identifier from candidate-store trust metadata, and removes the receipt-derived cover images tied to your account. If you signed in with Apple, deleting your account also revokes Spinbound's Sign in with Apple authorization with Apple, so the app can no longer use that sign-in. Your forwarding handle is permanently retired, so it can never be issued to anyone else and mail sent to it is not delivered to anyone. To enforce that, we keep a hash of the handle indefinitely and store nothing with it: no account ID, email address, or date. A hash is not encryption: someone with access to our database could recover a retired handle by guessing (every generated handle can be recovered this way), but a retired handle routes no mail and is not connected to any other data in our live database. Deleting your Spinbound account does not change your email provider's settings, so remember to remove the forwarding rule from your email account too. Shared store/release facts (which contain no account, name, order, or collection data) may remain. If a record is ever removed from your account entirely, the receipt-derived cover image tied to it is purged by a daily cleanup. You can contact privacy@spinbound.app to request deletion of any residual artifact.
Security
Data is transmitted over encrypted connections using HTTPS/TLS. A correctly configured native build stores your login session in the iOS Keychain; a native build that cannot access secure storage is treated as a release failure. Access to your database records is restricted by per-account row-level security, and server-side keys that can bypass those restrictions are never included in the app.
Children
Spinbound is not directed to children under 13, or under 16 where applicable, and we do not knowingly collect data from them.
Changes to this policy
If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.
Contact
Questions or requests about your privacy: privacy@spinbound.app.