Privacy
What we do with your email.
waxid is in private beta. The public site takes an email address for the waitlist; if you are invited in, you get an account. This page says exactly what happens to both.
What is collected
When you submit the waitlist form we record:
- the email address you typed;
- a name, if the form you used asked for one;
- the IP address the request came from, and the time it arrived — stored automatically with the signup as basic abuse protection.
Reading the site sets no cookies and runs no advertising trackers. We do measure traffic — how many people read a page, which page or search sent them, roughly which country, and what browser they used — with Cloudflare Web Analytics. It is cookieless: it stores nothing on your device, holds no identifier for you, and cannot follow you to anyone else's site. Because there is no identifier and nothing stored on your machine, there is nothing here for you to consent to and no banner to dismiss.
Why, and who sees it
The address is used for one purpose: to email you an invitation when a beta place opens, and to answer you if you wrote to us. It is not sold, rented, or shared for anyone else's marketing.
Three services touch it in passing: Cloudflare, which fronts the site and carries the request to us; our hosting provider, on whose server the list is stored; and Mailjet, which delivers the notification email. No other third party receives the address.
Two more see something else — not the address, but the ordinary fact of your
visit. Loading the app's pages or a guide fetches their typeface and icons from
two content-delivery networks: Google Fonts
(fonts.googleapis.com, fonts.gstatic.com) for the
Geist typeface, and jsDelivr (cdn.jsdelivr.net) for the
interface icons. Like any file your browser requests, that request tells those
networks your IP address and which browser you use, on the request itself; they
set no cookie and receive nothing else about you. The public landing page
serves its typeface from our own domain, and we intend to do the same across
the app so that even this stops.
If you have an account
An account is created only from an invitation. It holds:
- your email address, which is also how the app knows which scans are yours;
- a name, if you gave one;
- your password, stored only as a one-way hash — we cannot read it, and neither can anyone who obtains the file;
- the time and IP address of your last sign-in, and a record that you accepted these terms, with the version and the date;
- if you turn on two-factor sign-in, the shared secret your authenticator app uses, and one-way hashes of your recovery codes;
- the scans you run — your photographs are processed to identify the record and are not kept afterwards; the reading and the identification are.
- a record of the changes you ask the app to make and what it answered — which page you saved, which record or order it was about, the figures you typed, and whether it worked or was refused. It is there so a problem can be traced instead of guessed at. It keeps identifiers and amounts only: never a title, a note, a description, or anything you typed as text or searched for.
Market data expires within six hours. Anything a scan pulls from Discogs — what a pressing is selling for, how many people want it — is deleted automatically six hours after the scan, whether or not you come back. That is a condition of using their data, and it is enforced by the app rather than promised by us.
Mailjet delivers your invitation and any account email, so it sees your address for that purpose.
If you install the browser extension
The extension is optional. Its only job is to save you copying and pasting: when you press Get sold prices on a scan, it opens that record's sales-history page on Discogs in your own signed-in browser session, reads the text of that one page, closes it, and sends that text to us so we can work out what the record actually sells for.
What it can reach is deliberately narrow. It asks for access to a
single kind of address — discogs.com/sell/history/… — and nothing
else on Discogs. It cannot see your collection, your orders, your messages or
your account details, and it never writes anything to Discogs. On Firefox you
have to grant even that much yourself before it will work.
What reaches us is the text of that page, which is the same thing you would have sent by selecting it and pasting it in by hand. It is treated identically: used to price the record, and deleted from our server after six hours. The extension stores nothing on your machine and keeps no history of what you looked at.
It only ever answers pages served by waxid, and only when you press the button — it does not run on its own, and it does not read the pages you browse.
How long it is kept
Waitlist entries: until the beta closes to new signups, or until you ask us to remove you — whichever comes first. There is no long-term marketing list behind this; when the waitlist has served its purpose it is deleted.
Accounts: for as long as you have one. You can close it yourself at any time from the security page — the account, your saved scans, anything you pasted into it and any stored Discogs connection are deleted straight away. You can still email us instead if you would rather.
The record of changes you made is kept for 90 days and then drops off on its own. Unlike the scan log below, it is deleted the moment you close your account.
One thing is not immediate, and we would rather say so: the app keeps a technical log of scans it has run — what was read and what it concluded — for 90 days, and lines already written are not removed when an account closes. They age out on that 90-day cycle.
Your rights
Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. For a waitlist entry that is a single line in a file, and removing it is immediate — just ask. For an account, you can close it yourself from the security page and that removes the account and its scans; the 90-day technical log described above is the one exception. You can also complain to the Information Commissioner's Office if you think we have handled your data badly.
Contact
Email [email protected] to be removed, or with any question about this page.
waxid.app is a service of Business Information Technology Services Limited, a company registered in England and Wales, company number 14154728. That company is the data controller for the information described above.
← Back to waxid.app