Privacy

What we collect

• Account data (only if you sign in): email address and/or phone number, username, display name, avatar URL, bio, and the identity reported by any OAuth provider you connect (provider name, provider account id, the email it reported at link time). Previous usernames remain reserved to your account until permanent deletion, to prevent another account taking your old name. These names are included in your data export.
• Usage data tied to your account: listening history, likes, player preferences, group memberships, permissions, and session metadata (creation/expiry times — session tokens themselves are stored only as one-way hashes).
• Verification metadata: when you use email magic-link or phone OTP sign-in, we store the address/number a code was sent to and its lifecycle timestamps. Codes are stored hashed and expire quickly.
• Comments: posting requires an account; comments are linked to the account that posted them, display its chosen name, appear in your data export, and are permanently deleted with the account. Comments posted anonymously before attribution shipped are not linked to any account and cannot be exported or deleted per account (manual process below).
• Likes: liking requires an account; likes are linked to your account, appear in your data export, and can be undone at any time. When an account is deleted, its likes are anonymized — the aggregate count survives with no link to you.
• Playlists: creating playlists requires an account; your playlists are linked to your account, appear in your data export, and are permanently deleted with the account. Playlists are private unless you set them to unlisted (reachable by link; never in the library, search, or sitemap).
• Playback telemetry: when you play a track, the player reports which song, how many seconds of it were heard, and which parts (second ranges) — for per-song play counts and listening heatmaps. Each report is keyed to your account id if you are signed in, otherwise to a keyed one-way hash derived from your IP address (never the IP itself; devices sharing a network share that anonymous identity). Retention is bounded (below).
• IP addresses: used transiently for rate limiting, in in-memory counters with windows of at most 60 seconds, and never written to storage. Likes recorded before accounts were required store a keyed one-way hash derived from the IP, never the IP itself. A retry key sent with a note or playlist is stored as a one-way hash, never the key itself. It cannot be used after 24 hours and is deleted by a daily purge after expiry.

Why we process it (lawful basis)

• Performing the service you asked for (GDPR Art. 6(1)(b)): accounts, sign-in, sessions, preferences, listening history, likes.
• Legitimate interest (Art. 6(1)(f)): abuse prevention and security — rate limiting by IP, hashed session storage, verification-code lifecycle tracking — and first-party playback measurement under the pseudonymous model above.

We do no profiling, no automated decision-making, and no processing beyond what is listed here.

Who it is shared with

Nobody, in the advertising/analytics sense. Data lives on Cloudflare's platform (Workers, D1, R2), which processes it on our behalf. If you sign in by email or phone, the delivery provider (Resend for email, Twilio for SMS) processes the address or number needed to deliver your code. OAuth sign-in shares nothing with the provider beyond the sign-in itself.

Retention

• Account data: kept while the account exists.
• Sessions: expire after 30 days of inactivity; revoked immediately on sign-out.
• Verification codes: expire within minutes; consumed codes are kept only as metadata.
• Playback telemetry: raw per-play reports are deleted after 90 days by a daily purge; anonymous aggregates (per-song play counts, per-second listen tallies) are kept indefinitely. When an account is permanently deleted after its 30-day grace period, any remaining raw reports are unlinked from that account — as like counts are.
• Database backups: deleted data can persist in backups for up to 30 days (daily snapshots) and up to 365 days (weekly snapshots). Monthly archival snapshots are currently retained indefinitely and are not retroactively scrubbed — a copy of deleted data can therefore persist in cold archives. Re-delete on restore: if any backup containing deleted data is ever restored, pending and completed deletions are re-applied as part of the documented restore procedure, so a restore cannot resurrect an erased account into the live service. To object to archival retention specifically, email privacy@mus.ax.

Your rights: export and deletion

If you have an account, both controls are self-serve on your profile page (sign in, then open your @username chip in the header):

• Export — downloads a JSON snapshot of everything listed above that is tied to your account.
• Delete — signs you out everywhere, hides your profile immediately, and permanently deletes the account and its data after a 30-day grace period. Signing in again before the purge date cancels the request.

Manual process (no account, legacy anonymous comments, or anything else): email privacy@mus.ax. Comments posted before attribution shipped have no account linkage, so to amend or remove one, quote its text in your message. We respond without undue delay and within one month, as GDPR requires (extendable only as it permits) — usually much faster.

Cookies

Two functional cookies, no tracking cookies: a session cookie (only after you sign in) and a CSRF token that protects state-changing forms. Short-lived handshake cookies exist only for the minutes an OAuth sign-in is in flight.