Privacy policy
Last updated 2026-09-22.
Who is responsible
Spins is run by Ethan Gunn, who is the data controller under the General Data Protection Regulation (GDPR). Membership is by invitation only. For questions about your data, contact Ethan Gunn directly through the channel you received your invitation from.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address, username, password (stored only as a bcrypt hash) | Creating and securing your account, signing you in, and sending a password-reset email if you ask for one | Performance of a contract (art. 6(1)(b)) | Until you delete your account |
| Display name, bio, ratings, reviews, track ratings, who you follow, reviews you like, and the dates of these | Providing the service: these are the content of your public profile and of the site | Performance of a contract (art. 6(1)(b)) | Until you delete them or your account |
| IP address, browser type, requested pages and timestamps (server logs) | Keeping the site secure, preventing abuse, applying rate limits, diagnosing errors | Legitimate interest in security and operation (art. 6(1)(f)) | Up to 30 days |
| Session cookie and optional "remember me" cookie | Keeping you signed in and protecting forms against cross-site request forgery | Strictly necessary for the service you asked for; no consent banner is required | Session cookie: until you close the browser or sign out. Remember-me cookie: 30 days. |
We do not use analytics, advertising or tracking cookies, and we do not sell or share your data for marketing.
What is public
Your username, display name, bio, ratings, reviews, track ratings, the dates you rated things, who you follow, who follows you, and the reviews you like are visible to anyone on the internet, including search engines. Your email address and IP address are never shown to other members.
Who else receives data
- Hosting. The site and database run on servers provided by Render (application), Supabase (database) in Frankfurt, EU, acting as our processor under a data processing agreement.
- Email delivery. Password-reset emails are sent through our mail provider, which processes your email address for that purpose only.
- Spotify. Album cover art and artist images are loaded by your browser directly from Spotify's image servers. Spotify therefore sees your IP address and browser details when a page with covers is displayed, in the same way as any website that shows an image from another server. We do not send Spotify anything about your account, ratings or reviews. Spotify's own privacy policy applies to that image request.
If any provider is located outside the EU/EEA, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
- Access and portability: download everything we hold about you at any time from Settings → Your data.
- Rectification: change your display name, bio, email address and password in Settings; edit or remove any rating or review from the album page.
- Erasure: delete your account and all its content from Settings → Delete account. Deletion is immediate. Backups that contain the data are overwritten within 30 days.
- Objection and restriction: you may object to processing based on legitimate interest by contacting us.
- Complaint: you have the right to lodge a complaint with a supervisory authority. In Denmark this is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk. You may also contact the authority in the EU country where you live.
To exercise any right, use the tools in Settings or contact Ethan Gunn directly through the channel you received your invitation from. Requests are answered within one month.
Children
Spins is not intended for children under 13. Accounts are not knowingly created for them; if you believe a child has registered, contact Ethan Gunn directly through the channel you received your invitation from and the account will be deleted.
Security
All traffic is encrypted with HTTPS. Passwords are stored only as salted bcrypt hashes and cannot be recovered by us. Access to the server and database is restricted to the controller. Should a breach affecting your data ever occur, we will notify the supervisory authority within 72 hours and, where required, you.
Changes
If this policy changes in a way that matters, we will show a notice on the site. The date at the top always shows the current version.