Privacy

Who's responsible

DigDog is built and run by one person in the United Kingdom, as a spare-time project. For data protection purposes that person is the controller, and UK GDPR and PECR apply. If you want to reach me about anything on this page, send an email.

What stays on your device

Nearly everything. When you sync, DigDog saves your collection, wantlist and lists into storage your browser sets aside for this site, on your own device. The same place holds the things you create in DigDog — your notes and your wantlist target prices — and your choice of which streaming services to show.

None of that is sent to me, and there's no copy of it on any server I run. There is no DigDog account — the only account involved is your Discogs one. It also means clearing your browser's site data deletes it: the Discogs parts can be downloaded again, but your notes and target prices cannot, which is why Settings offers an export.

What does leave your device

Three things, and none of them is your collection.

Your sign-in cookie. Signing in with Discogs produces a pair of access tokens. They're encrypted into a cookie that only your browser holds, and that cookie travels to my server with each request so it can sign the Discogs API calls you asked for. It isn't stored server-side — the cookie really is the only place those tokens live.

Server logs. DigDog is hosted on Vercel, and like any site on any host, requests are logged by the platform itself — IP address, path, timestamp. That happens below my application code and outside my control.

Error reports. When something breaks, a report goes to Sentry so I can fix it. DigDog strips these before they're sent: no user identity, no cookies, no headers, no request body, no query strings, and the free-text error message is replaced with a fixed placeholder. What's left is the stack trace, which names code rather than data. It's a careful, best-effort scrub rather than a guarantee — a file path could in principle carry something incidental — so treat it as reducing exposure, not eliminating it.

There's also basic visitor analytics through Vercel: page views and loading-speed measurements. It sets no cookies and doesn't follow you between sites, and DigDog strips the query string from the recorded URL before the measurement is sent, so nothing carried in a link you opened ends up in it.

Cookies and what's stored on your device

DigDog sets two cookies. Both exist purely to sign you in, and there are no advertising, tracking or profiling cookies.

The browser storage described above is storage on your device too, and the same rules cover it. It isn't incidental to DigDog — it is where the app keeps everything it shows you.

Why there's no cookie banner. UK rules require consent for storage on your device unless that storage is strictly necessary for a service you asked for. Both cookies are the sign-in itself, and the browser storage is the app itself, so they qualify. Nothing here is optional or used for advertising, which means there would be nothing for a banner to ask you about. The obligation that does apply is telling you what's stored — that's this page.

Who else is involved

Discogs is where you sign in and where all the record data comes from. Your use of Discogs is governed by their own terms and privacy policy. DigDog is not affiliated with or endorsed by them.

Vercel hosts the app and provides the request logs and analytics described above.

Sentry receives the scrubbed error reports.

That's the complete list. Nothing is sold, shared with advertisers, or used to build a profile of you.

Why I'm allowed to do this

The sign-in cookie is necessary to deliver the thing you explicitly asked for: seeing your Discogs collection. Without it there is no service. Server logs, error reports and the basic analytics rest on legitimate interests — keeping DigDog secure, working, and fast enough to use. Each is the minimum needed for that purpose, which is why the error reports are scrubbed and the analytics set no cookies. If you disagree with that balance, you can object; see below.

How long things are kept

What DigDog has saved in your browser stays until you delete it — no expiry, and entirely your call. The sign-in cookie lasts 14 days, and disconnecting clears it immediately. Server logs and error reports are kept according to Vercel's and Sentry's own retention schedules, which are short by design and not something I extend.

Your rights

You have the usual UK GDPR rights — access, correction, erasure, portability, and objection. In DigDog most of them don't need me at all, because the data is on your machine:

• To get a copy, use the export in Settings.
• To erase it, disconnect and clear DigDog's browser data — also in Settings. That removes everything saved here, and the cookie.
• To correct your collection itself, edit it on Discogs and re-sync. Discogs is the source of truth; DigDog only holds a copy.

For anything that's left — the logs and error reports — email me and I'll deal with it. If you're unhappy with how I've handled something, you can complain to the Information Commissioner's Office, the UK's data protection regulator.

Changes

If what DigDog does with data changes, this page changes with it and the date at the top moves. There's no mailing list to notify, since there are no accounts.