Who processes your data?
App2Niche, a French SASU with share capital of €2,000, registered at 6 rue d’Armaillé, 75017 Paris, France, Paris RCS 105 751 630, is the controller for the processing described here. Contact contact@app2niche.com or +33 6 85 97 73 16. Full details appear in the legal notice.
This policy concerns MyWaxFolio. Choices made on the App2Niche website or another service do not constitute consent for MyWaxFolio.
Data, purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, collector name, hashed password, account identifier, verification status and session data | Create and secure the account, authenticate you and restore access | Performance of the contract; legitimate interest in securing the service |
| Artist, title, year, genre, format, condition, collection or wishlist status, favourite, barcode, Discogs identifier, artwork, dates, price paid, estimated value and value history | Save, display, synchronise, search and export your collection | Performance of the contract |
| Free-form notes and places you enter | Keep the personal journal attached to your records | Performance of the contract |
| Barcode, artist, title, edition and condition searched | Query the catalogue and suggest an available edition, artwork or estimate | Performance of the request |
| Acceptance of the terms and privacy information, marketing acceptance or refusal, date, IP address and user-agent | Provide required information, honour your choices and keep evidence of them | Performance of the contract for terms; consent for marketing; duty to demonstrate consent |
| Public handle, sharing settings and information deliberately made public | Display the profile or records that you choose to share | Performance of the requested feature |
| Subscription status and payment provider identifiers, only if a paid plan is enabled | Manage access rights, cancellation and applicable accounting duties | Performance of the contract; legal obligation for relevant records |
| Temporary request counters, technical information and redacted server errors | Prevent abuse and maintain the service’s security and operation | App2Niche’s legitimate interest in protecting the service |
| On Android: device and application information (manufacturer, model, operating-system version and build, available ML accelerators, package name and app version), performance metrics, API configuration, input and output sizes, feature version, event types, error codes and a per-installation identifier not intended to identify a person or physical device | Enable Google ML Kit to diagnose the scanner and produce usage analytics | Performance of the requested scanning feature; legitimate interest in maintaining its operation |
| Visits to public pages and technical browser reports | Measure audiences with Google Analytics 4 or diagnose an error with Sentry, only after the corresponding choice | “Audience measurement” or “Diagnostics” consent |
Email, collector name and password are required to create an account. A record requires at least an artist and title. Stories, places, prices, values, favourites, public sharing and optional choices remain optional.
The service does not request GPS location. The camera starts at your request to read a barcode. The image and recognition result are processed locally on the device; Google does not list the image or recognised value among the data collected by ML Kit in this configuration, and MyWaxFolio does not store the image. The barcode may then be sent to the MyWaxFolio API and Discogs only if you explicitly start a catalogue search.
Website, app and device storage
In the iOS or Android app, the session token is kept in the operating system’s secure storage and is limited to that device. Connected account data stays in memory while the app is in use. It is removed from the screen when you sign out or after the server confirms account deletion.
The demo is separate from the account. Its collection, notes and preferences remain in app or browser local storage until you reset them or clear local data. They are not sent to the account and are not erased by deleting a connected account.
In the browser, authentication uses an HttpOnly cookie. The legacy interface may keep an IndexedDB snapshot for offline viewing; it is replaced during synchronisation and cleared after signing out or deleting the account from that browser. An offline device must be cleared locally when necessary.
The mobile binary currently being prepared contains no Sentry, Google Analytics, advertising or payment SDK. On Android, it does contain Google ML Kit through react-native-camera-kit to read barcodes. That library also bundles the Android face-detection component as a technical dependency; MyWaxFolio does not call it and provides no face-detection feature. The cookie choices described here concern public web pages.
Who receives data?
Internal access is limited to authorised App2Niche personnel who need it to operate the service or handle a request. Collection data is neither sold nor rented. Depending on the features used:
- Hosting: {{HOSTING_DESCRIPTION}}
- Resend: receives the email address, display name and content needed for verification or recovery emails.
- Discogs: may receive search terms, barcodes, release identifiers or public handles needed for the feature you request.
- Apple and permitted media hosts: may provide artwork, metadata or previews. Direct loading sends them the technical connection data needed, including the IP address and resource requested.
- Google ML Kit on Android: collects the technical information and per-installation identifier described above for SDK diagnostics and usage analytics. The Google ML Kit data-disclosure documentation states that this data is encrypted in transit using HTTPS and that ML Kit does not transfer it to third parties.
- Stripe: is involved only if a payment or subscription is enabled. The audited mobile binary starts no payment and MyWaxFolio does not store the full card number.
- Google Analytics 4: receives only authorised data after consent on public pages. Forms, account identifiers, private collections and private API responses are excluded.
- Sentry: may receive a reduced browser report after consent on the web. Separately configured server reports are rebuilt without free-form error messages, request content, logs, replay, performance traces or personal data by default.
How long is data kept?
| Category | Period or criterion |
|---|---|
| Account, collection, value history and account-linked choice log | While the account exists; removed from the active database when erasure is confirmed |
| Issued session token | Up to 30 days, with earlier revocation possible; access becomes impossible when the account is deleted |
| Recovery and verification links | Usable for 1 hour and 24 hours respectively; used or expired hashes are removed by the server’s periodic purge |
| Demo and local preferences | Until reset, app removal or clearing the website’s local data |
| Cookie choices, Google Analytics cookies and events, and web Sentry reports | Choices and cookies: up to 6 months; GA4 events: 2 months; events on the currently configured Sentry plan: 30 days |
| Encrypted backups | An earlier state may remain in encrypted backups. The active VPS rotation retains 14 daily, 8 weekly and 12 monthly backups. Archives are copied daily to the recovery NAS with integrity checks; NAS retention follows its backup and snapshot policy |
| Hosting logs | According to the configuration and terms actually in force. No unverified Hostinger period is stated here |
If a subscription exists, active database deletion follows confirmation of its cancellation. If confirmation fails, the account is retained and deletion can be retried. Records subject to a statutory duty, particularly accounting records, follow that duty separately from collection data.
An encrypted backup is not an active database. The NAS copy has been verified across multiple cycles and through a successful isolated restore. Deletion from the active database does not immediately erase existing backups.
Providers and international transfers
The Sentry organisation used by MyWaxFolio is configured with the European Union as its data storage region. This setting alone does not exclude all international access or processing. Other providers may process data outside the European Economic Area depending on the contract, feature and subprocessors used.
App2Niche verifies relevant processing agreements and transfer arrangements: an adequacy decision where its conditions are met, or appropriate safeguards such as standard contractual clauses. Request details at contact@app2niche.com.
Your choices and rights
You may request access, correction, erasure or restriction of your data, and portability where applicable. You may object, on grounds relating to your situation, to processing based on legitimate interests. Optional consent can be withdrawn at any time.
In the mobile app, open Settings → My account → Delete my account, then enter your current password. The Delete my account page is available without signing in and explains how to make a request if you no longer have access to the app. Never send your password by email.
App2Niche normally answers within one month. This may be extended by two months for a complex or numerous request; you will be informed within the first month. You may complain to the CNIL or your competent supervisory authority. MyWaxFolio makes no decision with legal effects based solely on automated profiling.
Changes to this policy
The date at the top identifies this version. Material changes to purposes, providers or processing arrangements will be brought to your attention, and new consent requested where required by law.