Legal

Privacy Policy

Effective date: October 7, 2026. This version adds advertising, in-app purchases and affiliate links.

For the Record is a music diary. We collect what we need to run your account and the social features. The core app is free and shows non-personalized ads to people without Plus. We do not sell your data, we do not use your device's advertising identifier, and we never ask to track you.

This policy explains what the For the Record iOS app and this website (together, the "Service") collect, why, who processes it, how long it is kept, and the rights you have. The Service is provided by the operator named at the bottom of this page ("we", "us", "our"), who is the data controller for the personal data described here.

1. What we collect and why

You can use the diary without an account. In that case your diary data is stored only on your device and we receive none of it (see section 2). Ads and affiliate links work the same with or without an account and are covered in sections 4 to 6. If you create an account, we store the following on our servers:

We do not collect your precise location, contacts, photos, health data, payment card details or browsing history, and we do not read your device's advertising identifier. Whether you have Plus is checked with Apple on your device and is not stored on our servers.

When you search the catalog, the app sends your search terms to Apple's public iTunes Search API to find albums. Those requests do not include your account or identity. Album artwork and 30-second previews are loaded from Apple's servers, which, like any web server, receive your IP address.

2. Data that stays on your device

Some data never leaves your iPhone:

• If you use the app without an account, your whole diary, lists and Crate are stored only on the device. Deleting the app deletes them.
• Preferences such as your chosen theme and a cache of the members you follow are stored on the device.
• Your Plus status and the Plus mark on your profile are kept on the device. Other members do not see the Plus mark.
• Spotify access tokens are stored in the iOS Keychain on your device only (see section 3).
• Apple Music library access happens on the device.
• The JSON export you can create in Profile, then Account, is generated on the device and goes wherever you choose to save or share it.

3. Optional music connections

Both connections are optional. The app works fully without them.

Apple Music

If you grant permission, the app uses MusicKit on your device to read the albums in your library and your recently played music so you can add those albums to your Crate. This reading happens on the device. Only the albums you add to your Crate become part of your library contents, which are synced to your account if you have one. You can withdraw permission at any time in iOS Settings.

Spotify

If you connect Spotify, you sign in on Spotify's own page and authorize the app to read your saved albums and recently played tracks so you can import albums into your Crate. The access tokens Spotify issues are stored in the iOS Keychain on your device only and are never sent to our servers. Only the albums you import become part of your library contents. You can disconnect in the app at any time, and you can also remove the app's access from your Spotify account settings. Spotify's own privacy policy applies to your Spotify account.

4. Advertising

If you do not have Plus, the app shows banner ads from Google AdMob in two places: between items in the Home community feed and at the bottom of album pages. There are never ads in your diary, your Crate, or while you log a listen. Plus removes all ads.

• Non-personalized only. Every ad request asks Google for non-personalized ads. These are chosen from context (such as the app and your general location), not from a profile of your interests or your activity in other apps.
• No advertising identifier. The app never shows Apple's App Tracking Transparency prompt, so the SDK cannot read your device's advertising identifier.
• What Google receives. To deliver ads, limit how often you see the same ad, measure ad performance and prevent fraud, the Google Mobile Ads SDK collects your IP address (used to estimate your general location), device information, a device or app-specific identifier, crash and performance data from the SDK, and information about the ads you see and tap. Google describes this in its App Store data disclosure for AdMob. We do not send Google your account, email, name, reviews or diary.
• Consent in the EEA, UK and Switzerland. Before any ad loads, Google's consent form asks for your choices. If you decline, Google may show limited ads that do not use local storage for advertising, or none. You can change your choices at any time from the privacy choices option in the app's account settings, where your region requires it.
• U.S. state privacy laws. We use Google's restricted data processing setting for users in U.S. states with these laws, so Google processes ad data as our service provider and not for its own advertising profiles.
• Opting out. Ads are already non-personalized. To stop ads entirely, get Plus. You can also turn off "Personalized Ads" in iOS Settings (Privacy & Security, then Apple Advertising) and keep "Allow Apps to Request to Track" off; neither changes what this app does, because it never asks to track. Google's own privacy policy and ad choices are at policies.google.com/technologies/ads.

5. In-app purchases (Plus)

For the Record Plus is sold through Apple's App Store as a monthly or yearly subscription or a one-time lifetime purchase. Apple processes the payment. We never receive your card details, billing address or Apple Account details. The app checks with Apple, on your device, whether your Apple Account owns Plus. Apple gives us sales and subscription reports that are aggregated and do not identify you by name or email. Apple's privacy policy applies to your purchase.

6. Affiliate links

Album pages have a "Buy on vinyl" link that opens an Amazon search, and an "Open in Apple Music" link. These links carry our affiliate identifiers, so we may earn a commission if you buy a record on Amazon or start a new Apple Music subscription. As an Amazon Associate we earn from qualifying purchases.

When you tap one of these links, you leave the app and Amazon or Apple receives the click (including the affiliate identifier, your IP address and whatever those services normally collect). We do not send them anything about you. We receive only aggregate reports of clicks, orders and commissions, with no personal data. Amazon's and Apple's privacy policies apply once you are on their sites or apps. Prices are not affected by our commission.

7. Legal bases (EEA and UK)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases under the GDPR and UK GDPR:

• Performance of a contract (Article 6(1)(b)): your account, email, user ID, profile, content, library and social activity, and providing Plus, which we need to provide the Service you signed up for.
• Legitimate interests (Article 6(1)(f)): moderation, reports and blocks, security logs and abuse prevention; and funding the free version with non-personalized ads, including ad fraud prevention. Our interest is keeping the community safe and the Service free and working. We have balanced this against your rights, and you can object (see section 13).
• Consent (Article 6(1)(a) and the ePrivacy rules on device storage): the optional Apple Music and Spotify connections, and any storing or reading of information on your device for advertising, collected through Google's consent form. You can withdraw consent at any time, without affecting earlier processing.
• Legal obligation (Article 6(1)(c)): when we must keep or disclose data to comply with the law.

8. Service providers and partners

We use a small number of providers and partners. Each one receives only what it needs for its role.

Apple, Google, Spotify and Amazon act as independent controllers for the data they handle under their own privacy policies, except where Google processes ad data as our service provider under restricted data processing. "Open in Apple Music" and "Open in Spotify" links hand you off to those apps or websites, which are governed by their own policies.

We may also disclose data if required by law, to respond to valid legal process, to protect the safety of any person, or to enforce our Terms. If the Service is transferred to a successor (for example, the planned company that will operate it), your data would move with it under this policy, and we would tell you first.

9. What other members can see

If you have an account, your name, handle, bio, four favorites, public reviews and ratings that accompany them, lists, follower and following counts, year stats and Genre Passport are visible to other members. Your email address, reports, blocks, Listen Later queue and Plus status are never shown to other members. Members you block cannot see your content in the app.

10. No sale, no cross-app tracking

We do not sell personal data, and we do not share it for cross-context behavioral advertising: ads are non-personalized, and we do not combine your data with data from other companies to target ads to you. We do not use your device's advertising identifier and never show the App Tracking Transparency prompt. The app contains no analytics SDK. The AdMob SDK collects the ad data described in section 4 for ad delivery, measurement and fraud prevention.

11. Retention

• Account data is kept while your account exists. When you delete your account in the app, it is deleted from our live database immediately.
• Backups: our hosting provider keeps routine database backups for disaster recovery. Deleted data can remain in those backups until they expire on their normal rotation, which is no longer than 30 days. Backups are not used for any other purpose.
• Server logs are kept by our hosting provider for a short period (typically days) and then discarded.
• Ad data is held by Google under its own retention policies. We do not receive it except as aggregate reports.
• Purchase records are held by Apple. Our aggregate sales reports are kept as long as tax and accounting law requires.
• Support emails are kept as long as needed to resolve your request and for up to 12 months after.
• Data on your device stays until you delete it or delete the app.

If we must keep specific information longer to comply with law or resolve a dispute, we keep only that information and only as long as required.

12. Deleting your account and data

• In the app: Profile, then Account, then Delete account. This deletes your account and all of your server data immediately, including your profile, content, library, follows, likes, reports and blocks.
• By email: write to elevaresolutionspro@gmail.com from the address on your account with the subject "Delete my account". We will verify the request and complete it within 30 days, usually much sooner.

Deleting your account does not cancel a Plus subscription, because Apple manages billing. Cancel it in your Apple Account subscriptions first (see Support). Step-by-step instructions are on the Delete your account page. Before deleting, you can save a copy of your data with the JSON export in Profile, then Account.

13. Your rights

Wherever you live, you can ask us to access, correct, export or delete your personal data. Much of this you can do yourself in the app: edit your profile, edit or delete any entry, export your data as JSON, and delete your account.

If the GDPR or UK GDPR applies to you, you also have the right to:

• access your personal data and receive a copy;
• have inaccurate data rectified;
• have your data erased;
• restrict processing in certain cases;
• data portability (the JSON export gives you your data in a machine-readable format);
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent;
• lodge a complaint with your local data protection authority.

To make a request, email elevaresolutionspro@gmail.com. We will respond within one month (GDPR) or 45 days (California), and may ask you to confirm the request from your account email so we can verify it is you. Requests about ad data that Google holds as an independent controller can also be made to Google. We will not discriminate against you for exercising any right.

14. California and other U.S. states

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you these rights. Residents of other U.S. states with similar laws have comparable rights, and we honor them the same way.

• Right to know the categories and specific pieces of personal information we collected, the sources, the purposes and the categories of recipients.
• Right to delete personal information we collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of sale, sharing and targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is nothing to opt out of. We also do not sell or share the personal information of consumers under 16.
• Right to limit use of sensitive personal information. We collect account login credentials only to let you sign in, and no other sensitive personal information.
• Right to non-discrimination for exercising these rights. Plus is an optional paid tier available to everyone on the same terms.

In the last 12 months we collected these categories: identifiers (email address, user ID, handle, and a device or app-specific identifier collected by the AdMob SDK); personal records (name); internet or network activity (server logs, ad views and taps); approximate geolocation derived from IP address (by the AdMob SDK, for ads); and other user content you choose to provide (reviews, ratings, diary, lists, tags, favorites, library). Sources: you, your device, and Apple or Google if you sign in with them. Purposes: those listed in sections 1 and 4. Recipients: the service providers and partners in section 8, for business purposes only. Retention: see section 11.

You may use an authorized agent to make a request. We may ask the agent for proof of authorization and ask you to verify your identity directly.

15. Children

You must be at least 13 years old to use For the Record. If you are under 18, you need permission from a parent or legal guardian, who should read this policy and our Terms with you. The app is not directed to children and its ads are not intended for children. We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete the account and its data. If you believe a child under 13 is using the Service, contact us at elevaresolutionspro@gmail.com.

16. Security

Data travels between the app and our servers over encrypted connections (HTTPS/TLS) and is encrypted at rest by our hosting provider. Database access is restricted so that each account can only change its own data. Passwords are never stored in plain text; authentication is handled by Supabase. Spotify tokens are kept in the iOS Keychain. Payments are handled entirely by Apple. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.

17. International transfers

We are based in the United States, and our providers may store and process data in the United States and other countries. Those countries may have data protection laws different from yours. Where the GDPR or UK GDPR applies, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses included in our providers' data processing terms, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where available.

18. Changes to this policy

We may update this policy as the Service changes. We will post the new version on this page with a new effective date. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect.

19. Contact

Questions, requests or complaints about privacy: elevaresolutionspro@gmail.com. The Service is operated by the operator named in the footer of this page, in New York, USA.