Privacy Policy
Short version: Waxrunner helps you buy your Discogs wantlist for less. Your record data lives at Discogs — we only store what we genuinely need to run the service for you, nothing more. We don't sell your data, we don't track you with advertising cookies, and we never see your Discogs password.
1. Who we are
Waxrunner ("Waxrunner", "we", "us") is a personal project run by Bradley Macquine from the Netherlands. Bradley is the data controller for the personal data described below. For any privacy question or to exercise your rights, get in touch.
2. What data we process
We keep data collection to the minimum needed to run the service:
- Your Discogs identity — your Discogs username and the currency set on your Discogs profile, received when you connect your Discogs account.
- Discogs access tokens — a token that lets us read your wantlist on your behalf. It is encrypted at rest, used only to provide the service, and never shared. We never receive or store your Discogs password.
- Your wantlist and run data — the wantlist items you choose to optimize, and the results of each optimization run (which records, which sellers, totals, savings).
- Email address (optional) — only if you choose to give it. We use it to send you price-drop alerts and occasional key updates about Waxrunner — nothing else. It's entirely optional: you can use Waxrunner fully without giving an email, we never sell or share it, and you can unsubscribe from any email with one click.
- Basic technical data — a login session cookie and standard server logs (e.g. IP address) needed to keep you logged in and keep the service secure and working.
We do not collect special categories of data, we do not build advertising profiles, and we do not process any personal data beyond what is listed above.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Connect your Discogs account, read your wantlist, run optimizations and show results | Performance of the service you request (Art. 6(1)(b)) / our legitimate interest in providing it (Art. 6(1)(f)) |
| Keep you logged in and keep the service secure | Legitimate interest (Art. 6(1)(f)) |
| Send you price-drop alerts and occasional key updates about Waxrunner (only if you gave us your email) | Your consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link |
4. Discogs
Waxrunner is an independent tool and is not affiliated with, endorsed by, or operated by Discogs. When you connect your account, Discogs' own privacy policy governs how Discogs handles your data on their side. We only act on your behalf using the access you grant, and you can revoke that access in your Discogs account settings at any time.
5. Who we share data with (processors)
We don't sell your data. We rely on a small number of service providers strictly to operate Waxrunner:
- Supabase — our database and hosting. Your data is stored in the European Union (Ireland).
- Resend — sends the optional price-drop alerts and key updates, only if you provide an email address.
Each provider only processes data on our instructions, under a data-processing agreement, and only as far as needed to deliver their part of the service.
6. International transfers
Your core data stays within the EU (Supabase, Ireland). Where a provider processes data outside the EU (for example our email provider), that transfer takes place under appropriate safeguards — such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. How long we keep it, and what happens when you delete your account
We keep your data for as long as you have a Waxrunner account, so the service keeps working for you. You can delete your account at any time from your settings.
When you delete your account, we remove the data that identifies you — your email address, your Discogs access tokens, and your account record. We may keep your past optimization runs in anonymized form: any link to your Discogs identity is removed and replaced by a random identifier, so the runs can no longer be traced back to you. We use this anonymized data only to understand usage and improve the service. Standard server logs are kept only for a short period for security and troubleshooting. Encrypted database backups may briefly retain data after deletion before they are automatically overwritten.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (and you can delete your account yourself);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent (e.g. for emails) at any time.
To exercise any of these, get in touch. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
9. Security
We use appropriate technical and organisational measures to protect your data, including secure storage of access tokens and restricted access to the database. No system is perfectly secure, but we work to keep your data safe and to minimise what we hold in the first place.
10. Cookies
Waxrunner uses only strictly necessary cookies and no tracking or advertising cookies. See our Cookie Policy for the details.
11. Changes to this policy
We may update this policy as the service evolves (for example if we later add analytics or affiliate links). When we do, we'll update the date at the top and, for significant changes, let you know.