Privacy
What we do with your email.
WAXid is in beta. You can create an account yourself, with an email address and a password or by signing in with Google — while there is a place free; when the beta is full the same form takes your address for the waitlist instead. This page says exactly what happens to what you give us.
What is collected
When you submit the waitlist form we record:
- the email address you typed;
- a name, if the form you used asked for one;
- how you heard about WAXid, if you chose to say — it is optional, and used only to see which ways of finding WAXid are working;
- the IP address the request came from, the country Cloudflare reports for it, and the time it arrived — stored automatically with the signup as basic abuse protection.
The waitlist form is protected by Cloudflare Turnstile, which checks that you are a person and sets no advertising cookie; on the landing page it loads only when you press Join. If you try to sign up while every beta place is taken — with the form or with Google — your address goes on the waitlist instead.
Reading the site sets no cookies and runs no advertising trackers. We do measure traffic — how many people read a page, which page or search sent them, roughly which country, and what browser they used — with Cloudflare Web Analytics. It is cookieless: it stores nothing on your device, holds no identifier for you, and cannot follow you to anyone else's site. Because there is no identifier and nothing stored on your machine, there is nothing here for you to consent to and no banner to dismiss.
Why, and who sees it
The address is used for one purpose: to email you an invitation when a beta place opens, and to answer you if you wrote to us. It is not sold, rented, or shared for anyone else's marketing.
Three services touch it in passing: Cloudflare, which fronts the site and carries the request to us; our hosting provider, on whose server the list is stored; and Mailjet, which delivers the notification email. No other third party receives the address.
Two more see something else — not the address, but the ordinary fact of your
visit. Loading the app's pages or a guide fetches their typeface and icons from
two content-delivery networks: Google Fonts
(fonts.googleapis.com, fonts.gstatic.com) for the
Geist typeface, and jsDelivr (cdn.jsdelivr.net) for the
interface icons. Like any file your browser requests, that request tells those
networks your IP address and which browser you use, on the request itself; they
set no cookie and receive nothing else about you. The public landing page
serves its typeface from our own domain, and we intend to do the same across
the app so that even this stops.
On a scan result, the record's cover picture is loaded from YouTube
(i.ytimg.com) where the album has an official upload there; otherwise it is your
own photo, shown from your device, or, for a scan from an eBay listing, that listing's first
photo from eBay's image server. Tapping the cover to play loads YouTube's player from
youtube-nocookie.com, which may then store data in your browser as YouTube
describes in its own privacy policy. Photos of a pressing that you ask to see are loaded
from Discogs' image server.
If you have an account
You create an account yourself — with an email address and a password, or by signing in with Google — or from an invitation. While WAXid is in beta we let each new account in by hand: until we do, it cannot be used, and we email you when it is ready. If you use Google, we ask it for your email address and nothing else; Google learns that you signed in to WAXid. The sign-up form is protected by Cloudflare Turnstile, which checks that you are a person and sets no advertising cookie. An account holds:
- your email address, which is also how the app knows which scans are yours;
- a name, if you gave one;
- When you sign up we ask, optionally, how you heard about WAXid. Your answer is stored with your account and used only to see which ways of finding WAXid are working; you can leave it blank.
- your password, stored only as a one-way hash — we cannot read it, and neither can anyone who obtains the file;
- the time and IP address of your last sign-in, and a record that you accepted these terms, with the version and the date;
- if you turn on two-factor sign-in, the shared secret your authenticator app uses, and one-way hashes of your recovery codes;
- the scans you run — your photographs are sent to our AI provider to identify the record. A resized copy is kept on our server for up to six hours, so you can list that record on eBay without photographing it again — it is deleted sooner if the listing takes it or you forget the scan. It is never shown to anyone, and nothing is kept after that; the reading and the identification are. The one exception is a label photo you choose to share. After you confirm a pressing, we may ask whether you'll share a picture of its label to help other collectors recognise it — it is off unless you tick it. If you do, we keep only the label, cut out of your photo, with its location, camera and date details removed. We check it before anyone sees it; it may then be shown to other WAXid users as an example of that label. You can withdraw it at any time from your account page, and closing your account deletes it.
- a record of the changes you ask the app to make and what it answered — which page you saved, which record or order it was about, the figures you typed, and whether it worked or was refused. It is there so a problem can be traced instead of guessed at. It keeps identifiers and amounts only: never a title, a note, a description, or anything you typed as text or searched for.
Market data expires within six hours. Anything a scan pulls from Discogs — what a pressing is selling for, how many people want it — is deleted automatically six hours after the scan, whether or not you come back. That is a condition of using their data, and it is enforced by the app rather than promised by us.
Mailjet delivers your invitation and any account email, so it sees your address for that purpose.
If you install the browser extension
The extension is optional. Its only job is to save you copying and pasting, and it does that in two places, each only when you press its button:
- Get sold prices on a scan opens that record's sales-history page on Discogs in your own signed-in browser session, reads the text of that one page, closes it, and sends that text to us so we can work out what the record actually sells for.
- Fetch my recent orders from Discogs on the Purchases page opens your Discogs purchases list the same way and sends its text to us, so we can pick out the order numbers you would otherwise paste in by hand.
What it can reach is deliberately narrow. It asks for access to two
kinds of address — discogs.com/sell/history/… and
discogs.com/sell/purchases — and nothing else on Discogs. It cannot
see your collection, your messages or your account details, and it never
writes anything to Discogs. On Firefox you have to grant even that much
yourself before it will work.
What reaches us is the text of that page, which is the same thing you would have sent by selecting it and pasting it in by hand, and it is treated identically. A sales history is used to price the record and deleted from our server after six hours. From a purchases list we keep only the order numbers, and only to look those orders up: the rest of the text is discarded straight away, and nothing is added to your records until you tick the orders and import them. The extension stores nothing on your machine and keeps no history of what you looked at.
It only ever answers pages served by WAXid, and only when you press the button — it does not run on its own, and it does not read the pages you browse.
How long it is kept
Waitlist entries: until the beta closes to new signups, or until you ask us to remove you — whichever comes first. There is no long-term marketing list behind this; when the waitlist has served its purpose it is deleted.
Accounts: for as long as you have one. You can close it yourself at any time from the security page — the account, your saved scans, anything you pasted into it and any stored Discogs connection are deleted straight away. You can still email us instead if you would rather.
The record of changes you made is kept for 90 days and then drops off on its own. Unlike the scan log below, it is deleted the moment you close your account.
One thing is not immediate, and we would rather say so: the app keeps a technical log of scans it has run — what was read and what it concluded, and which of its follow-up questions you opened, skipped, stopped at or took an answer back from — for 90 days, and lines already written are not removed when an account closes. They age out on that 90-day cycle.
Your rights
Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. For a waitlist entry that is a single line in a file, and removing it is immediate — just ask. For an account, you can close it yourself from the security page and that removes the account and its scans; the 90-day technical log described above is the one exception. You can also complain to the Information Commissioner's Office if you think we have handled your data badly.
Contact
Email [email protected] to be removed, or with any question about this page.
waxid.app is a service of Business Information Technology Services Limited, a company registered in England and Wales, company number 14154728, registered office 14 Greenacre Close, Brundall, Norfolk, NR13 5QF, VAT number GB 494 5093 59. That company is the data controller for the information described above.
← Back to waxid.app