Groovefolio Back to Groovefolio

YOUR DATA, EXPLAINED

Privacy policy

Effective date: September 28, 2026.

Groovefolio is developed by Hunter Goller. This policy explains how the Groovefolio Android app (application ID app.groovefolio), its API at api.groovefolio.app, and the public website at groovefolio.app handle information. For privacy questions or requests, contact support.groovefolio@gmail.com.

1. At a glance

Groovefolio helps you organize vinyl records, log listens, view listening statistics, and discover records in your own collection. You do not need a Groovefolio account.

Your collection and listening history are stored on your device. Groovefolio does not upload them to a Groovefolio server or provide cloud synchronization or automatic collection backup. Optional Discogs features use the developer-operated Groovefolio server through Cloudflare. That server processes your requested lookups and imports and stores the information needed to maintain and protect your connection; it does not keep a copy of your local collection or listening history. Barcode scanning uses Google ML Kit, which processes camera images on your device and sends technical metrics to Google as described below.

Groovefolio does not sell personal information or use it for targeted advertising. Groovefolio does not display ads. The app does not include advertising SDKs or a separate developer-operated behavioral analytics or crash-reporting service.

2. Information stored and used on your device

Groovefolio stores information needed to provide its features, including:

Selected artwork is copied into app storage. Groovefolio does not upload your selected photos or scan your photo library. Downloaded artwork is also stored locally.

The developer cannot remotely view, restore, or delete information held only on your device.

3. Optional Discogs features and the Groovefolio server

When you choose Connect, the app registers an installation with the Groovefolio server. This does not create a username/password account or use your Android advertising ID. The server stores a random installation identifier, a hash of the bearer token, creation/expiry information, and any revocation status. The installation identifies requests from that app installation.

You authorize Discogs in your browser. Discogs sends the authorization result to the Groovefolio server, which stores your verified Discogs username, numeric account identifier, and encrypted OAuth access credentials linked to the installation. Groovefolio does not receive your Discogs password. Short-lived authorization records hold transaction identifiers, state/token hashes, status, expiry, and encrypted temporary credentials until the flow ends or expires.

The app sends search terms, barcode values, release identifiers, or collection-page requests to api.groovefolio.app over HTTPS. The server forwards the relevant request to Discogs using your connection and returns the result. During an import, the server processes the Discogs collection and release information in transit; it does not persist a copy of that collection or a search history in its database. Selected records are saved on your phone. Local edits, listening history, selected photos, and NFC mappings are not uploaded or synchronized to Discogs.

Artwork is fetched by the phone from Discogs image-serving infrastructure. Discogs receives request information from the Groovefolio server for proxied API calls, and normal connection information, including your device's IP address, when your browser visits Discogs or your phone requests artwork.

The server also handles request counts and time windows to limit misuse. For installation-registration protection, it processes the client IP address and stores a hash derived from it with rate-limit counters, rather than storing the raw address in that table. A hashed IP address is not guaranteed to be anonymous. The private server dashboard uses aggregate API-call counts and server-health measurements, not your collection, search terms, tokens, or listening history. Application HTTP access logging is disabled by default.

Cloudflare provides the API's HTTPS proxy, tunnel, and traffic protection. It processes requests passing through that service, including their contents and network metadata, and may retain security/traffic logs such as IP addresses, timestamps, URLs and browser/client information. Security features may use cookies when applicable. This processing supports delivery, availability, and abuse prevention, not Groovefolio advertising. See Cloudflare's Privacy Policy.

Discogs operates independently under its Privacy Policy. Its authorization website may use cookies and other browser technologies under that policy.

You can use manual record entry and local features without connecting Discogs. A successful Disconnect in Settings deletes this installation's Discogs credentials, account identity and pending authorization flows from the active Groovefolio database. It leaves the Groovefolio installation record/token and rate-limit records in place. Disconnect requires a working connection to the server; retry if it fails. It does not delete your Discogs account or imported local records, revoke Discogs' own application grant, or disconnect other app installations. Manage or revoke that grant separately in Discogs Settings → Applications.

4. Barcode scanning and Google ML Kit

Camera access is used when you choose to scan a record's barcode. Barcode recognition runs on your device using Google ML Kit through the app's scanner component. Camera frames are not saved by Groovefolio or uploaded for recognition. The decoded barcode value is sent through the Groovefolio server to Discogs when the app searches for matching releases.

Google ML Kit sends technical data to Google for diagnostics and usage analytics. This includes device and operating-system details, app/package versions, an SDK installation identifier, performance measurements, scanner configuration, input/output sizes, feature versions, event types, and error codes. With automatic zoom enabled, it also collects a generated scan-session identifier, zoom changes, and estimated barcode bounding-box coordinates.

Google states that ML Kit processes input images and recognition results on-device, while technical metrics are transmitted over HTTPS. The SDK may also contact Google for maintenance information and updates. See ML Kit's privacy information, its Android data disclosures, and the Google Privacy Policy.

You can decline or revoke camera permission and enter records manually instead.

5. NFC tags and notifications

If you choose to link an NFC tag, Groovefolio reads the tag identifier, stores its association with a record locally, and writes a Groovefolio link containing that record's local identifier to the physical tag. The link does not contain your Discogs credentials or listening history. NFC scans and play logging are handled locally.

A physical NFC tag can be read by someone with a compatible reader. Deleting app data or a record does not erase the physical tag; erase or rewrite the tag separately if you want to remove its contents.

If you allow notifications, Groovefolio can display locally generated confirmations of NFC plays. These can contain a record title, artwork, and play details. Their visibility depends on your Android notification and lock-screen settings. These confirmations are not delivered through a Groovefolio push-notification server.

You can manage camera and notification permissions in Android Settings and disable NFC through your device settings. Core manual collection and play-logging features remain available without these permissions.

6. Support messages

When you email support, the developer receives your email address and whatever you choose to include, such as your name, message, screenshots, device model, or app version. This information is used to respond, investigate problems, maintain the app, and address privacy requests. Support messages are handled through Google's Gmail service under the Google Privacy Policy.

Please do not send passwords, authorization tokens, or information unrelated to your request. Groovefolio does not automatically attach your collection or listening history to support emails.

Support correspondence is retained while handling your request and afterwards only for as long as reasonably needed for related follow-up, resolving disputes, or meeting applicable legal obligations. You can request deletion by emailing the support address. If information must be retained for a legal reason, the developer will explain the applicable limitation.

7. Website and external links

The public Groovefolio website is hosted on GitHub Pages. GitHub states that it logs visitors' IP addresses for security purposes, whether or not they are signed into GitHub. See GitHub Pages data collection and the GitHub Privacy Statement.

The website does not provide access to your app collection or listening history. The website code does not include advertising trackers or third-party visitor analytics. Cloudflare supplies DNS for the domain; when a page is served through Cloudflare's proxy or security features, Cloudflare also processes that traffic as described in section 3.

If you follow an external link from the app or website, the destination receives normal web-request information and operates under its own privacy policy. This includes links to Discogs, retailers, and help resources. Simply opening such a link does not upload your local collection or listening history.

8. Retention and deletion

Local app information remains on your device until you remove it or clear the app's storage. You can delete a record within Groovefolio; this also removes its associated play history and local NFC association. The app attempts to remove its stored artwork copy as part of record deletion. Clearing all app storage removes remaining app-managed files and preferences.

To remove all locally held Groovefolio data, use Android Settings to clear Groovefolio's storage or uninstall the app. This does not notify the Groovefolio server or immediately delete its records, original images in your photo library, information held by service providers, support correspondence, or data written on physical NFC tags. Disconnect Discogs successfully before uninstalling when possible.

Groovefolio disables Android automatic backup for its app-private data and does not provide a Groovefolio cloud backup. Uninstalling, clearing storage, losing your phone, or moving to another device can permanently lose your collection and listening history.

Server retention works as follows:

For deletion of server-held data beyond Disconnect, or if you no longer have the app, email support.groovefolio@gmail.com. Describe the request and, if relevant, your Discogs username. Do not send passwords or bearer/OAuth tokens. The developer may need to verify ownership and may not be able to match an unlinked installation from an email address alone. Any information that must be retained for a legal or security reason will be explained.

Discogs, Google, GitHub, and Cloudflare handle their own records under their respective policies. Requests about Groovefolio's use of these providers can also be sent to the developer. There is no Groovefolio username/password account, but server-held installation and Discogs connection data still exist as described above.

9. Security and your choices

Groovefolio uses app-private storage for local records, secure device storage for installation bearer tokens, encrypted server-side Discogs OAuth credentials, and HTTPS for public API and artwork requests. Server-side token hashes and access controls protect installation authorization. Local collection storage is not a separately password-protected or app-encrypted database. Protect your device with its security and screen-lock features. No storage or transmission method is completely secure.

You can choose whether to connect Discogs, use the camera, select artwork, link NFC tags, or enable notifications. To request deletion of support emails and attachments held by the developer, contact support.groovefolio@gmail.com. Collection and listening data are stored on your device and must be deleted through the app or Android Settings. Questions about support information, or requests to access or correct it, can also be sent to this address. Depending on where you live, additional privacy rights may apply. The developer will handle requests in accordance with applicable law and may need to verify that the request concerns your information.

Third-party providers may process information in countries outside your own. Their privacy policies explain their processing locations and applicable protections.

10. Children

Groovefolio is a general-audience vinyl collection app and is not directed to children under 13. The developer does not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Groovefolio, contact support.groovefolio@gmail.com so the developer can investigate and remove it as appropriate.

11. Changes and contact

This policy will be updated when Groovefolio’s data practices change, with the revised effective date identified. Material changes will be communicated through the app or website as appropriate, with any additional notice or consent required by law. New data-handling practices will be disclosed before they are introduced.

Developer: Hunter Goller — Groovefolio
Privacy and support: support.groovefolio@gmail.com
Website: groovefolio.app