Privacy Policy

1. Who we are

Diggidig is a service operated by Esch Music, a sole proprietorship registered in the Netherlands.

• Trade name: Esch Music
• Chamber of Commerce (KvK): 42004386
• VAT number: NL005427075B69
• Contact: info@diggidig.app

Our registered business address is on file with the Dutch Chamber of Commerce and can be requested by sending an email to info@diggidig.app.

2. What data we collect

When you create an account and use Diggidig, we collect and store the following data:

• Account information — your name, email address, and (if you use Google login) your Google profile information.
• Discogs credentials — your Discogs username and Personal Access Token, which are used to retrieve your collection and wantlist from Discogs on your behalf.
• Usage data — records you have liked, disliked, listened to, and notes you have written about releases.
• Subscription data — whether you are on a free trial, paid plan, or have used an invite code.

We do not collect payment card details. Payments are processed by Stripe, which has its own privacy policy.

3. How we use your data

Your data is used exclusively to provide and improve the Diggidig service:

• To authenticate you and keep your session active across devices.
• To sync your likes, dislikes, listened records, and notes across devices.
• To generate personalised recommendations based on your taste.
• To manage your subscription status.

4. Where your data is stored

Your data is stored in Supabase (West EU — Ireland), a managed database provider. Supabase stores data in compliance with GDPR. Your Discogs token is stored securely via Supabase's database-level encryption.

Diggidig is hosted on Cloudflare Pages, with backend logic running in Cloudflare Workers. Cloudflare may temporarily process your IP address for security, rate-limiting, and standard access logs. IP addresses used for feedback rate-limiting are stored in encrypted form in Cloudflare KV and automatically deleted after one hour.

5. Third-party services

• Discogs — we use the Discogs API to retrieve release information, your collection, and your wantlist. Your token is sent to Discogs on your behalf.
• Stripe — payment processing. Stripe stores your payment information. We only receive confirmation of payment status.
• Google — if you use "Continue with Google", Google shares your name and email with us for authentication purposes.
• YouTube — release previews are embedded from YouTube. YouTube may set third-party cookies when you interact with a video preview. These cookies are only activated when you click play, and are subject to Google's privacy policy.
• Resend — used to send transactional emails (welcome emails, feedback messages). Resend processes your email address and the content of the message only to deliver it.
• Anthropic — the optional AI Recommendations feature uses the Anthropic API. If you enable this feature, you provide your own Anthropic API key, which is stored locally in your browser only. Your liked records and taste data are sent to Anthropic to generate recommendations. Diggidig does not store or share this data with Anthropic itself.

5b. Data processing agreements

As a data controller, Diggidig has data processing agreements (DPAs) in place with the following sub-processors:

• Supabase — database and authentication provider. Supabase's DPA is available at supabase.com/privacy.
• Stripe — payment processor. Stripe's DPA is available at stripe.com/privacy.
• Cloudflare — hosting provider and edge server (Workers, Pages, KV). Cloudflare's DPA is available at cloudflare.com/privacypolicy.
• Resend — email delivery provider. Resend's privacy information is available at resend.com/legal/privacy-policy.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data associated with your account is permanently deleted within 30 days.

7. Your rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• The right to access your personal data.
• The right to correct inaccurate data.
• The right to request deletion of your data ("right to be forgotten").
• The right to object to processing of your data.
• The right to data portability.
• The right to withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at info@diggidig.app.

You also have the right to file a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. Cookies

Diggidig uses only functional cookies necessary for authentication (session tokens stored by Supabase). We do not use tracking or advertising cookies ourselves. When you click to play a YouTube video preview, YouTube (Google) may set third-party cookies on your device. You can prevent this by not interacting with video previews.

9. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or via a notice in the app. Continued use of Diggidig after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this privacy policy? Contact us at info@diggidig.app.