Privacy Policy

The short version: WOIII.me reads the Discogs data it needs to answer what you ask. It is read-only, shows no prices or cover images, never receives your conversations, does not sell personal data, and does not use advertising or behavioural tracking.

Last updated: 21 October 2026 · Applies to WOIII.me: the Chrome side panel extension, the WOIII.me plugin and connector for ChatGPT and Claude, and the server they use; to DIG for Discogs, the earlier version; and to this website.

Who we are

WOIII.me is an independent project. It operates the services above and is responsible for the personal data described here. It is not affiliated with, sponsored or endorsed by Discogs. Contact: help@woiii.me.

Where the service runs

  • WOIII.me server at discogs-mcp-staging.woiii.workers.dev. The Chrome extension from the Chrome Web Store and the ChatGPT and Claude plugins connect here. It will move to mcp.woiii.me; this policy covers both addresses.
  • DIG for Discogs, the earlier version, at discogs-mcp.woiii.workers.dev. Where it differs, see The earlier version.

Data we process

  • Discogs sign-in. When you connect, Discogs asks you to authorise WOIII.me. We then receive an OAuth access token and secret for your Discogs account, your Discogs username and your numeric Discogs user ID. We never see your Discogs password.
  • Your requests. The arguments the extension or your AI assistant sends for each task: a Discogs release or master link or ID, an album or artist to search for, pressings to compare, or a settings change. We do not receive your conversation.
  • Discogs data you ask for. Catalogue data (releases, masters and their versions, credits, matrix and runout details, labels, formats, community ratings and have/want counts) and, when you ask for it, your own collection and wantlist. We do not request, store or show marketplace prices, listings or images.
  • Your settings. Default lens, how many pressings are checked per album, whether CDs and SACDs may be recommended, and whether explanatory notes show.
  • Technical data. Our hosting providers see your IP address and ordinary request details in order to deliver the service. We do not write IP addresses into our logs or statistics.

Why we use it

  • To provide what you ask for: sign-in, pressing verdicts, surveys and comparisons, and collection and wantlist features. This processing is necessary to provide the service you request.
  • To stay within Discogs' rate limits, keep the service reliable and prevent abuse. This is our legitimate interest in running a stable, compliant service.
  • To see, in aggregate and without any user identifier, which features and albums are used, so we can improve the scoring. This is also our legitimate interest.
  • To answer support, privacy and security requests.

We do not use your data for advertising, sell it, use it to assess creditworthiness, or use it to train AI models.

What we store, and for how long

  • Your sign-in grant is stored on our server (Cloudflare Workers KV). The Discogs token, secret and username are encrypted inside it; the grant also records your numeric Discogs user ID. It is kept while your connection exists. Revoking WOIII.me on Discogs makes the token unusable at once, and we delete the grant on request.
  • Discogs catalogue responses are cached for at most 5 hours 45 minutes after they were fetched, so nothing we show is more than six hours old.
  • Your collection and wantlist pages, and the account behind a personal access token, are cached for at most 4 hours. Collection entries are keyed by your Discogs username; a personal access token is stored only as a one-way hash.
  • Your settings are stored under a one-way hash of your Discogs user ID and kept for 12 months after the last change. Ask the assistant to reset your WOIII.me settings to delete them at once.
  • Sign-in state (the step between our server and Discogs) expires after 10 minutes.
  • Usage statistics (Cloudflare Workers Analytics Engine): one record per action and per Discogs request, holding the action name, outcome, timings, counts, rate-limit readings and the Cloudflare data-centre code. For album surveys it also holds the album's public Discogs master ID. No record holds a username, user ID, token, IP address, search text or URL. Cloudflare keeps them for three months.
  • Error and operations logs (Cloudflare Workers Logs) use a closed set of fields with no IDs, usernames, tokens, IP addresses, search text or URLs, and are kept for up to 7 days.
  • Support correspondence is kept only as long as needed to resolve the request, keep security records or meet legal obligations.

Who receives or processes data

  • Discogs receives the API requests needed to answer you; requests for your own collection or wantlist are signed with your token. Discogs handles them under its own terms and privacy policy.
  • Cloudflare hosts our server, its storage, the usage statistics and the logs, as our infrastructure provider.
  • Fly.io runs a small relay in Frankfurt, Germanythat sends our Discogs requests from one fixed address, so we stay within Discogs' rate limit. It passes requests through and logs only each request's status code, timing and remaining rate-limit count. Discogs sees the relay's address, not yours.
  • Your AI provider. When you use WOIII.me in ChatGPT (OpenAI) or Claude (Anthropic), that provider processes your conversation, the tool request and the result we return, under its own privacy policy. Results can remain in your chat history according to your settings there.
  • Google distributes the extension through the Chrome Web Store and gives us only aggregate install statistics.
  • Vercel hosts this website.
  • Services you choose for support. Email you send us, or a public GitHub issue you open, is processed by that email or GitHub service.

These providers operate in the European Union and the United States; transfers outside the EU rely on their standard contractual clauses. We disclose data to others only when the law requires it.

Chrome extension

  • The side panel reads the address of the discogs.com tab you are viewing to know which release or master page is open. On a marketplace listing page it reads that page's release link. It has no access to other sites, unless you enter your own server address in its settings; Chrome then asks your permission for that one address.
  • It sends release and master IDs and your requests only to the WOIII.me server.
  • It stores on your device: the sign-in session token issued by our server (never your Discogs password or Discogs token), your Discogs username (shown only on its settings page), your settings and accent colour, and your last 10 checked pressings (title, artist and score), which it shows only while that data is under six hours old. Answers are also kept in memory for up to 10 minutes.
  • Signing out removes the session, username, recent list and cached answers from your device. Uninstalling removes everything.
  • It does not collect browsing history, run remote code, show ads or contain analytics.

WOIII.me's use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. That information is used only to provide the extension's single purpose. It is not sold, not used or transferred for advertising, creditworthiness or lending, and not read by people except with your permission, for security, or as the law requires.

ChatGPT and Claude

  • Each tool call carries only the arguments your assistant chose for that request. We do not receive or store conversation transcripts.
  • ChatGPT may attach hints such as your locale, user agent or an anonymised user ID to a call. We neither read nor store them.
  • Results contain Discogs-derived data with "Data provided by Discogs" links. The cards shown in the chat load code only from our server and contain no third-party content or trackers.

The earlier version (DIG for Discogs)

DIG for Discogs is being replaced by WOIII.me. While it runs, it differs in these ways: it may return marketplace price fields where Discogs provides them; it may cache the account behind a personal access token for up to 24 hours; its recently-analysed list can show data up to about 12 hours old; and it may send public Discogs release-notes text (never account data) to TypeSafe AI, which classifies pressing claims in that text.

Your choices and rights

  • Revoke WOIII.me's access at any time in your Discogs settings, under Applications. Its Discogs token stops working at once.
  • Sign out of the extension, or uninstall it, to clear it from your device.
  • Disconnect the plugin or connector in ChatGPT or Claude to stop it from calling WOIII.me.
  • Ask your assistant to reset your WOIII.me settings.
  • Email help@woiii.me with "Privacy request" in the subject to ask for access, correction, deletion (including your sign-in grant and settings), restriction, objection or a copy of your data. We answer within one month and may need your Discogs username to find the data.
  • You can also complain to the data protection authority where you live.

Security

Traffic is encrypted in transit. Discogs credentials are encrypted inside the sign-in grant, personal access tokens are stored only as hashes, and the service asks Discogs only for read access. Report a suspected security problem privately; see Support.

Children

WOIII.me is not intended for children under 16, and we do not knowingly process their data.

Data we do not request

Do not send payment-card information, health information, government identifiers, passwords, API keys, OAuth tokens, MFA codes or other secrets through WOIII.me or its support channels.

Changes

We update this policy when WOIII.me's features, providers or legal obligations change. The date above marks the current version; material changes are also noted in the release notes.

Contact

Questions about privacy: help@woiii.me or GitHub Issues.