Privacy Policy
Last updated: June 1, 2026
The Short Version
Vynl is self-hosted. Your data never leaves your server.
This website (vynl.music) collects minimal analytics. The app itself collects nothing.
What Data We Collect
From the Website (vynl.music)
We use Umami Analytics (self-hosted) to understand how people use our site:
- •Page views — Which pages you visit
- •Referrers — Where you came from
- •Country — General location (from IP address, not stored)
- •Device type — Desktop, mobile, tablet
- •Browser — Chrome, Safari, Firefox, etc.
What we DON'T collect:
- ✕ Personal information (name, email, etc.)
- ✕ Cookies
- ✕ IP addresses (not stored)
- ✕ Tracking across sites
- ✕ Third-party analytics (no Google Analytics, Facebook Pixel, etc.)
Umami is privacy-first:
- ✓ Self-hosted on our infrastructure
- ✓ GDPR compliant
- ✓ No cookies required
- ✓ Anonymous by design
From the Vynl App
Nothing.
Vynl is self-hosted on your server. We never see:
- ✕ Your music library
- ✕ Your playlists
- ✕ Your listening history
- ✕ Your server details
- ✕ Anything else
Your data stays on your hardware.
How We Use Data
Website Analytics
We use Umami data to:
- • Understand which features people are interested in
- • Improve documentation based on popular pages
- • See where traffic comes from (to focus marketing efforts)
We do NOT:
- ✕ Sell data
- ✕ Share data with third parties
- ✕ Use data for advertising
- ✕ Track you across sites
App Telemetry
There is no app telemetry. Vynl runs on your server, we have no access to it.
Third-Party Services
On the Website
- •Umami Analytics — Privacy-first, self-hosted analytics
- •GitHub — For hosting code (public repository)
- •Coolify — For website hosting (our infrastructure)
In the App (Optional)
If you use these features, you're connecting directly to these services (not through us):
- •Claude AI (Anthropic) — For music discovery recommendations
- •ACRCloud / AudD — For Shazam-like song identification (iOS app only)
- •Tailscale — For secure remote access to your server
Important: These are YOUR connections to these services. We don't see the data exchanged.
Your Rights
Because we collect almost nothing, there's not much to request. But you can:
- ✓Access — Request any data we have (likely just anonymous analytics)
- ✓Deletion — Request deletion of your data (if any exists)
- ✓Opt-out — Use an ad blocker to block Umami (we won't be offended)
Contact: [email protected]
Data Retention
Website Analytics
- • Retained for 12 months
- • Then automatically deleted
- • Anonymized from day one (no way to link back to you)
App Data
You control retention. It's on your server.
Security
Website
- ✓ HTTPS encryption
- ✓ Regular security updates
- ✓ Hosted on secure infrastructure
App
You control security (it's self-hosted). We recommend:
- • Keep software updated
- • Use Tailscale for remote access (encrypted)
- • Strong passwords for admin accounts
Children's Privacy
Vynl is not directed at children under 13. We don't knowingly collect data from children. If you're under 13, please don't use our website or app without parental permission.
VynlGator Bot (Telegram)
@VynlGatorBot is a Telegram bot operated by the Vynl maintainer (André Wolke / 48nauts). It answers documentation and support questions in the @vynl_music community and in direct messages. This section covers how it handles your data.
What the bot receives
- •The text of messages you send directly to the bot, or messages in the @vynl_music group that @-mention or reply to it.
- •Your Telegram user ID, first name, username (if set), and language code.
- •Message timestamps.
Telegram does not give the bot access to group messages that don't mention it or reply to it.
Where your message is processed
Queries are processed on self-hosted inference infrastructure (OpenClaw or Hermis) running on hardware controlled by the Vynl maintainer. To generate an answer, the bot uses one of two paths:
- •Local LLM — the model runs entirely on the maintainer's own hardware. No third party is involved.
- •OpenRouter — your message is forwarded to openrouter.ai, which routes the query to the chosen upstream model provider. OpenRouter's own privacy policy applies to that hop.
The bot does not call OpenAI, Anthropic, Google, or any other model provider directly — only via the two paths above.
What we log
- •Conversation history is retained up to 30 days for spam prevention, abuse handling, and bot improvement. After that, contents are deleted automatically.
- •Aggregate metrics (query count, error rates, response times) are kept indefinitely. These contain no personal data.
What we never do
- ✓Your conversations are not used to train any AI model.
- ✓Your messages are not sold, shared with advertisers, or used for marketing.
- ✓The bot has no access to your Vynl library, your music files, or anything outside the Telegram chat.
Delete your data
Send /forget-me to @VynlGatorBot at any time. All your conversation history is deleted within 24 hours. De-identified aggregate metrics are not affected.
Bot privacy questions?
Email [email protected] or post in @vynl_music.
Open Source
Vynl is open source (MIT License). You can:
- ✓Review the code: github.com/48Nauts-Operator/vynl-app
- ✓ Verify there's no hidden tracking
- ✓ Contribute improvements
- ✓ Fork and modify
Transparency is built in.
Changes to This Policy
We may update this policy occasionally. Changes will be posted here with a new "Last updated" date.
For major changes, we'll announce them on GitHub and X (@vynl_it).
Contact
Questions about privacy?
Email: [email protected]
Summary
- •Website: Minimal privacy-first analytics (Umami, self-hosted)
- •App: Zero data collection (it's self-hosted on YOUR server)
- •Bot: Optional. Processed on self-hosted infra (local LLM or OpenRouter). 30-day retention, never used for training. Details
- •No cookies, no tracking, no data selling
- •Open source = verifiable
Your music, your data, your server. That's the Vynl way.