LEGAL

Privacy Policy

Version 1.1 · Effective September 26, 2026

This Privacy Policy explains how GroovyShelves (“we”, “us”) process personal data when you use the GroovyShelves website, installed web app and supported mobile app experiences.

We aim to collect only the information needed to provide, secure and improve the service. This policy is intended to give you a clear understanding of what happens to your personal data before you use GroovyShelves.

1. Controller and contact

GroovyShelves is operated by Jeff Sundin in Sweden, who is the controller for the personal data described in this policy.

For privacy questions or requests, contact groovyshelves@proton.me. You can also use the account controls described below to download a self-service export of core account data or delete your account. You may contact us if you want to exercise a data-protection right that is not fully covered by the self-service controls.

2. Personal data we process

Depending on which features you use, GroovyShelves may process the following categories of personal data:

• Account and authentication data: email address, username, internal user ID, authentication provider information, account creation and update timestamps, sign-in information, password-recovery state and security/session-related data needed to authenticate your account. Passwords are handled by Supabase Auth; GroovyShelves does not store or display your plain-text password.
• Profile data: display name, profile image, biography, favourite artist and genre, collecting information, grail-record information and other profile fields you choose to provide.
• Collection and wishlist data: albums you add, shelves, ordering, pressing and condition information, Discogs release references, cover selections and related collection metadata.
• Community data: ratings, reviews, review likes, follows, community activity and interactions with other members.
• Progress and achievement data: level and XP-related progress, unlocked achievement keys and categories, XP awarded for achievements, unlock timestamps and the achievement you choose to display on your profile.
• Presence data: information used to show whether an account is online or when it was last active where that feature is enabled in the service.
• Notifications and push data: notification preferences, in-app notifications, web push subscription endpoints and cryptographic subscription keys, browser/user-agent information, device platform, mobile push device tokens, app version and delivery success or failure information.
• Watchlist and marketplace data: watched albums, price limits, currencies, selected marketplaces, sale-type preferences, marketplace identifiers, matching-listing history and alert status.
• Product feedback data: bug reports and feature suggestions you submit, including the feedback type, title and description, the GroovyShelves page from which it was submitted, and your account ID when you are signed in. Bug reports also include a browser identifier and viewport size to help reproduce technical problems. A short-lived pseudonymised connection fingerprint is used only to limit abusive repeated submissions.
• Moderation and safety data: reports you submit, public illegal-content notices, reporter name and email where required or voluntarily provided, exact reported URLs, legal explanations, good-faith declarations, report reasons and details, references to reported content, moderation status, decision reasons, moderator notes, account-restriction history, restriction duration or expiry, legal or policy bases, redress information and a limited snapshot of reported content where needed to investigate a report. For the public illegal-content notice form, GroovyShelves also creates a short-lived pseudonymised connection fingerprint used only to limit abusive repeated submissions.
• Authentication and transactional email data: recipient email address, message type and content, delivery status, retry/error information and delivery-provider identifiers used for account confirmation, password recovery, notice receipts, content-removal notices and account-moderation emails.
• Legal records: the version and server-side timestamp of Terms of Service acceptance and other records needed to document the legal relationship between you and GroovyShelves.
• Technical and anti-abuse data: IP address, browser/device information, request metadata, error and security information that may be processed automatically by GroovyShelves’s hosting, backend, security and delivery providers when you connect to the service. For username/email login abuse prevention, GroovyShelves derives a short-lived pseudonymised fingerprint from the connection IP address using a server-side secret; the raw IP is not stored in the GroovyShelves login-rate-limit table.

GroovyShelves does not ask you to provide special-category personal data such as health information, religious beliefs, political opinions or biometric data. Please do not include sensitive personal information in free-text profile fields, reviews or reports unless it is genuinely necessary.

3. Where the data comes from

Most personal data comes directly from you when you create an account, build your collection, edit your profile, write a review, follow another collector, configure notifications or create a watchlist alert. Public illegal-content notice data comes directly from the individual or organisation submitting the notice and does not require a GroovyShelves account.

Some data is generated when you use GroovyShelves, for example login timestamps, community activity, notification delivery status and presence information. Social information can also arise when another member interacts with your account, for example by following you or liking a review.

Album, artist, artwork, pressing and marketplace information may come from third-party music and marketplace data sources. GroovyShelves does not treat ordinary catalog metadata about records and artists as personal data about you merely because you add an album to your collection.

4. Why we process personal data and our legal bases

• Provide your account and the core GroovyShelves service: to authenticate you, store your library and wishlist, provide shelves, profiles, ratings, reviews, follows, community features, watchlists and requested account functions. The legal basis is performance of our contract with you under Article 6(1)(b) GDPR.
• Provide optional push notifications: to send the categories of mobile or browser push notifications you actively enable. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw that consent at any time by disabling push notifications in GroovyShelves and, where relevant, in your browser or device settings.
• Operate in-app notifications and requested alerts: to tell you about account interactions and watchlist events you have asked the service to track. Depending on the feature, the legal basis is performance of our contract with you or our legitimate interest in providing a functional social service under Article 6(1)(f) GDPR.
• Respond to product feedback and improve the service: to investigate bug reports, assess feature suggestions and improve GroovyShelves. The legal basis is our legitimate interest in maintaining and improving the service under Article 6(1)(f) GDPR. Where a bug report is necessary to provide a feature you use, Article 6(1)(b) may also apply.
• Protect GroovyShelves and its members: to prevent abuse, investigate reports, receive and assess notices of suspected illegal content, communicate notice outcomes, enforce rules, diagnose security incidents, prevent fraud and maintain service integrity. The legal basis is our legitimate interests under Article 6(1)(f) GDPR. Where processing is necessary to comply with a legal obligation, including applicable notice-and-action duties, Article 6(1)(c) GDPR also applies.
• Keep legal and accountability records: to record Terms acceptance, document moderation decisions and establish, exercise or defend legal claims. The legal basis is our legitimate interests under Article 6(1)(f), performance of our contract under Article 6(1)(b), and Article 6(1)(c) where a legal obligation applies.

Where we rely on legitimate interests, we consider the necessity of the processing and the impact on members. You can object to processing based on legitimate interests as described under “Your rights”.

Information required to use the service: an email address, username, password, confirmation that you are at least 18 years old and acceptance of the current Terms of Service are required to create a GroovyShelves account. If you do not provide them, an account cannot be created. Other profile fields, ratings, reviews, push notifications, Watchlist settings and product feedback are optional, although a requested feature cannot work without the information necessary for that feature. The public illegal-content form requires the information shown as required in the form, except where the form provides an identity exemption for notices concerning suspected child sexual abuse or exploitation.

5. What other GroovyShelves members can see

GroovyShelves is a social collection service. Signed-in members may be able to see member-visible information such as your username, display name, profile image and profile fields, collection, wishlist, shelves, ratings, reviews, community activity and presence information where those features are displayed.

Your email address, authentication credentials, push subscription data, device tokens, private notification preferences and private watchlist settings are not intended to be shown to other GroovyShelves members.

GroovyShelves currently restricts member profile and library information from signed-out visitors through its application and database access controls, except for profile image files. Profile images are served from a public Supabase Storage bucket for efficient CDN delivery; anyone who has the direct image URL can retrieve that image file. Other profile and library data remains subject to GroovyShelves’s application and database access controls. Content you deliberately share outside GroovyShelves, or information copied by another person, may of course exist outside our control.

6. Service providers and third-party services

We use service providers to operate GroovyShelves. They process data only to the extent needed for the relevant service and subject to their applicable contractual and data-protection obligations.

• Supabase: authentication, database, storage and server-side Edge Functions. GroovyShelves’s primary Supabase project is configured in an EU region, while Supabase and its subprocessors may process data in other locations where permitted by their data-processing terms.
• Cloudflare: DNS, security, delivery and hosting of the public web application and its static assets through Cloudflare Workers and Static Assets. Cloudflare Turnstile is also used on production login and signup forms to reduce automated abuse. Cloudflare may process ordinary connection, browser/device and security information needed to provide those services.
• Google Firebase Cloud Messaging: delivery of Android/mobile push notifications when you enable that feature. A device token and notification delivery information may be processed for this purpose. GroovyShelves does not enable Firebase Analytics in the Android app.
• Browser push services: if you enable push notifications in an installed web app, the browser creates a push subscription that is routed through the push service associated with that browser or platform. The subscription endpoint and cryptographic subscription keys are stored by GroovyShelves only for delivery of the notifications you enable.
• Resend: delivery of authentication and transactional emails, including account-confirmation and password-recovery emails sent through Supabase Auth and notice or moderation emails sent by GroovyShelves. Resend may process the recipient email address, message content and delivery/log information needed to send and troubleshoot those messages. Resend states that customer data is stored in the United States, that email and log data on Free, Pro and Scale plans is retained for 30 days while the account is active, and that its DPA includes Standard Contractual Clauses and other applicable transfer safeguards.

GroovyShelves also uses or links to third-party catalog, artwork and marketplace services, including TIDAL, Discogs, Cover Art Archive, MusicBrainz data, Wikipedia/Wikimedia, Tradera and eBay. These services are used to find or display music metadata, artwork, external information or marketplace listings.

TIDAL artwork: GroovyShelves uses TIDAL as an artwork source. TIDAL catalog matching is performed server-side through a GroovyShelves Supabase Edge Function using limited record-catalog information such as artist name, album title, release year and catalog identifiers. GroovyShelves does not send your GroovyShelves email address, account ID or profile information to TIDAL for those artwork lookups. Limited TIDAL match information, such as TIDAL album identifiers, links, artwork URLs, match status and verification timestamps, may be stored in GroovyShelves’s Supabase database so that repeated lookups can be reduced and matches can be re-verified.

When remotely hosted artwork is displayed in your browser, the host serving that image — including TIDAL or its delivery infrastructure for TIDAL-sourced artwork — may receive ordinary connection information such as your IP address, browser headers and request information. Wikipedia/Wikimedia requests and other third-party resources may likewise involve direct browser requests. If you follow an external link, including a TIDAL link, the destination service processes your visit under its own privacy policy. TIDAL describes its own processing in its Privacy Notice.

MusicBrainz identifiers used by GroovyShelves are currently derived from a locally stored MusicBrainz data dump rather than from live MusicBrainz API requests.

7. International transfers

Some providers and third-party services operate internationally. This means personal data or technical connection data may in some situations be processed outside Sweden or the European Economic Area.

Where GroovyShelves transfers personal data to a processor outside the EEA, we rely on an applicable transfer mechanism such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses together with any supplementary measures that are required. Resend’s current documentation states that its customer data is stored in the United States and that EEA transfers are covered by its DPA/SCCs and participation in the EU-U.S. Data Privacy Framework. You may contact us for more information about safeguards relevant to a particular transfer.

8. How long we keep data

We keep personal data only for as long as it is needed for the purposes described in this policy, subject to legal requirements and the need to establish, exercise or defend legal claims.

• Account, profile, collection, wishlist, shelf, rating, review and follow data: normally kept while your account exists and removed when your account is deleted, unless a limited item must be kept for a legal reason.
• Notifications: automatically removed after 180 days from their last update.
• Community activity feed records: automatically removed after 180 days.
• Marketplace alert match history: automatically removed after 90 days. Current watchlist configuration remains until you remove it or delete your account.
• Push subscriptions and device tokens: kept while needed to deliver push notifications and removed when you disable the relevant subscription, delete your account, or the subscription/token is removed as invalid.
• Login abuse-prevention fingerprints: the pseudonymised fingerprint used by the username/email login rate limiter is automatically removed after 48 hours.
• Terms acceptance records: kept as part of the account’s legal history while the account exists and removed with the account under the current account-deletion process.
• Product feedback: open feedback is kept while it remains relevant to development and support. Feedback marked resolved or declined is automatically removed after 730 days. The pseudonymised connection fingerprint used for rate limiting is automatically cleared after 48 hours. Feedback linked to an account is removed if that account is deleted.
• Moderation reports and related snapshots: kept only for as long as reasonably necessary to investigate and document the report, protect members and the service, handle repeat abuse, and establish, exercise or defend legal claims. They are reviewed for deletion or anonymisation when those purposes no longer require identifiable data.
• Public illegal-content notices: open notices are kept while they are being assessed. Once a final outcome has been recorded, the notice is normally deleted after 730 days unless a longer period is reasonably necessary for a legal obligation, regulatory matter or legal claim. The pseudonymised connection fingerprint used for rate limiting is automatically cleared after 48 hours.
• Member content reports: open reports are kept while they are being reviewed. Reports with a final resolved or dismissed outcome are normally deleted after 730 days unless a longer period is reasonably necessary for a legal obligation, regulatory matter or legal claim.
• Moderation audit records: manual account and content moderation actions, including internal moderator notes and ban/unban history, are normally kept for up to 1,095 days so GroovyShelves can apply rules consistently, investigate repeated abuse and review past moderation decisions.
• Moderation email queue records: pending records are kept while delivery is still required. Successfully sent GroovyShelves queue records are automatically removed after 30 days. Resend currently states that email and log data on its Free, Pro and Scale plans is retained for 30 days while the Resend account is active.

9. Account deletion and data export

GroovyShelves provides self-service privacy controls in Settings. You can download an export covering core account, profile, library, contribution, social, Watchlist, notification, Terms-acceptance, submitted-report, product-feedback, presence and achievement data, and you can permanently delete your account. The self-service file is not intended to replace every possible GDPR access request; you can contact groovyshelves@proton.me if you need access to personal data not included in that file, subject to applicable rights and exemptions.

Account deletion removes the authentication account, profile image and account-linked database records configured to be deleted with the user, including the collection, wishlist, shelves, ratings, reviews, likes, Watchlist settings, notification preferences, push registrations, achievements and Terms acceptance records. Some moderation or legal-accountability records can be retained for their stated retention period where necessary, with the deleted account reference removed where the database is configured to do so. Deletion cannot remove information that another person has independently copied or information that must lawfully be retained for a limited period for legal reasons.

For security reasons, the self-service export does not include active session tokens, JWTs, push endpoints or cryptographic keys, push device tokens, short-lived abuse fingerprints, internal delivery queues or private moderation-administration records. Those exclusions do not limit any data-protection right you may have under applicable law.

10. Your data-protection rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

• receive information about how your personal data is processed;
• access your personal data and receive a copy of it;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting processing that was lawful before withdrawal; and
• lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority.

Some rights are not absolute. For example, we may need to retain limited information where required by law or where necessary to establish, exercise or defend legal claims.

11. Automated decisions and profiling

GroovyShelves may calculate collection statistics, community rankings, similarity indicators or other informational results from activity in the service. GroovyShelves does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects on you within the meaning of Article 22 GDPR.

12. Security

We use technical and organisational measures intended to protect personal data, including authentication, database access controls, row-level access policies, restricted write access for profile-image storage, public read-only CDN delivery of profile images, restricted privileged operations and encrypted network connections. No online service can guarantee absolute security, and we review safeguards as GroovyShelves develops.

If a personal-data breach is likely to result in a high risk to affected people, we will notify them where required by applicable data-protection law.

13. Children

GroovyShelves accounts are available only to people who are at least 18 years old. Registration requires the user to confirm that they are at least 18. GroovyShelves does not ask for or store a date of birth for this purpose. If we learn that an account belongs to a person under 18, we will take appropriate steps to restrict or close the account and address the associated personal data.

14. Cookies, local storage and similar technologies

GroovyShelves uses browser storage, caching and service-worker functionality needed to keep you signed in, remember functional state and provide the installed web-app experience. GroovyShelves does not currently use advertising pixels or third-party analytics in the web app, and Firebase Analytics is disabled in the Android app.

See the Cookies & Local Storage notice for the current browser-storage inventory, purposes and retention details. If GroovyShelves later introduces non-essential analytics, advertising or similar storage that requires consent, it will not be activated before the required choice has been provided.

15. Changes to this policy

This policy is versioned. We may update it when GroovyShelves’s features, providers or legal obligations change. If a change materially affects how personal data is processed, we will provide appropriate notice before or when the change takes effect. The current version and effective date are shown at the top of this page.

16. Contact and complaints

For privacy questions or to exercise a right that is not available through Settings, contact Jeff Sundin at groovyshelves@proton.me. General legal and Digital Services Act contact information is available on the Legal & DSA Contact page. Suspected illegal content can be submitted through the public Report illegal content form.

If you believe your personal data has been handled in breach of data-protection law, you also have the right to complain to Integritetsskyddsmyndigheten (IMY).

Terms of Service · Cookies & Local Storage · Community Guidelines · Report illegal content · Legal & DSA Contact