/privacy and /terms describe what the app actually collects and shows (public profiles and listening, 50 recent plays, encrypted service tokens, stripped profile pictures, Android reader scope, song lookups that carry no identity, 14-day backups, 13+), linked from a web footer, the sign-up forms and mobile Settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,137 @@
|
||||
import type { Metadata } from 'next';
|
||||
import Link from 'next/link';
|
||||
|
||||
export const metadata: Metadata = { title: 'Privacy policy · musicshare' };
|
||||
|
||||
const UPDATED = 'October 6, 2026';
|
||||
const CONTACT = 'app@musicshare.binarygnome.com';
|
||||
|
||||
export default function PrivacyPage() {
|
||||
return (
|
||||
<article className="card legal">
|
||||
<h1>Privacy policy</h1>
|
||||
<p className="muted">Last updated {UPDATED}</p>
|
||||
|
||||
<p>
|
||||
musicshare shows your friends what you're listening to. This page explains what we collect to do that, who can
|
||||
see it, and how to delete it. In short: we only collect what the app needs, we don't show ads, and we never
|
||||
sell your data.
|
||||
</p>
|
||||
|
||||
<h2>What we collect</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Your account:</strong> username, email address, display name, bio, and profile picture if you add one.
|
||||
Your password is stored only as a one-way hash. Profile pictures are resized and stripped of hidden data like
|
||||
camera details and location before they're stored.
|
||||
</li>
|
||||
<li>
|
||||
<strong>What you listen to:</strong> the song you're playing now (title, artist, album, artwork, where in the
|
||||
song you are, and which app or service it's from) and your last 50 plays. Older plays are deleted
|
||||
automatically.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Services you connect:</strong> to read what you're playing we keep a sign-in token for each service
|
||||
(Plex, Last.fm, Apple Music, Jellyfin) or just your username (ListenBrainz). Tokens are encrypted. We never see
|
||||
or store your Plex, Last.fm or Apple password; your Jellyfin password is used once to sign in and not kept.
|
||||
</li>
|
||||
<li>
|
||||
<strong>The Android app's “This phone” sharing:</strong> if you turn it on, Android calls it
|
||||
“notification access”, but the app only reads the song, artist and album from music apps you allow.
|
||||
It doesn't read or store your notifications, messages or anything from other apps.
|
||||
</li>
|
||||
<li>
|
||||
<strong>People:</strong> who you follow, who you've pinned, who you've blocked, and reports you send.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Technical data:</strong> sign-in sessions (stored as hashes), and your IP address, which is used briefly
|
||||
to prevent abuse (like limiting sign-in attempts) and appears in server logs that are kept for a short time.
|
||||
</li>
|
||||
</ul>
|
||||
<p>We don't use advertising, analytics or tracking tools, and we don't use cookies except the one that keeps you signed in.</p>
|
||||
|
||||
<h2>Who can see what</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Your profile is public.</strong> Your username, display name, picture, bio, featured song, what you're
|
||||
playing and your recent plays can be seen by anyone who has your profile link or finds you in search, including
|
||||
people who aren't signed in.
|
||||
</li>
|
||||
<li>Your followers see what you play in their feed, live.</li>
|
||||
<li>
|
||||
Your email address is never shown to other people. It's used to sign in, to send you confirmation and
|
||||
password reset emails, and to contact you about your account.
|
||||
</li>
|
||||
<li>
|
||||
People you block can't find you or see your profile, and you stop following each other. They aren't
|
||||
told.
|
||||
</li>
|
||||
<li>
|
||||
You can <strong>pause sharing</strong> at any time in Settings. While paused, nothing new you play is shared or
|
||||
stored.
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h2>Who we share it with</h2>
|
||||
<p>We don't sell or rent your data. Some information goes to other services so the app can work:</p>
|
||||
<ul>
|
||||
<li>
|
||||
<strong>Services you connect</strong> (Plex, Last.fm, ListenBrainz, Apple Music, your Jellyfin server): we ask
|
||||
them what you're playing using the access you gave us.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Song matching:</strong> to build “open in your app” links we look up song titles and artists
|
||||
with Deezer, Apple's iTunes search, Spotify's catalog and Odesli (song.link). These lookups contain only
|
||||
the song, never who listened to it.
|
||||
</li>
|
||||
<li>
|
||||
<strong>Our own servers:</strong> the app, database and email run on servers we manage ourselves.
|
||||
</li>
|
||||
<li>If the law requires it, we may have to share information with authorities.</li>
|
||||
</ul>
|
||||
<p>
|
||||
Data from Last.fm is shown with a link back to the listener's Last.fm profile, as Last.fm requires. Each
|
||||
connected service has its own privacy policy for the data it holds.
|
||||
</p>
|
||||
|
||||
<h2>How long we keep it</h2>
|
||||
<ul>
|
||||
<li>Recent plays: the latest 50. Older ones are deleted as new ones come in.</li>
|
||||
<li>
|
||||
Everything else: until you delete it or your account. Deleting your account (Settings → Delete account)
|
||||
removes your profile, picture, plays, follows and connected services right away. Database backups are kept for
|
||||
14 days, so deleted data is fully gone after that.
|
||||
</li>
|
||||
<li>Password reset and email confirmation links expire within a day and are deleted once used.</li>
|
||||
</ul>
|
||||
|
||||
<h2>Your choices and rights</h2>
|
||||
<ul>
|
||||
<li>Edit your profile, change your email or password, disconnect services and delete your account in Settings.</li>
|
||||
<li>Pause sharing, block people, and remove followers whenever you like.</li>
|
||||
<li>
|
||||
You can ask us for a copy of your data, or to correct or delete it, by emailing{' '}
|
||||
<a href={`mailto:${CONTACT}`}>{CONTACT}</a>. Depending on where you live (for example the EU, UK or
|
||||
California) you may have further rights, and you can complain to your local data protection authority.
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h2>Children</h2>
|
||||
<p>musicshare isn't meant for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has an account, email us and we'll delete it.</p>
|
||||
|
||||
<h2>Security</h2>
|
||||
<p>
|
||||
We use encrypted connections (HTTPS), hash passwords and session tokens, and encrypt service tokens. No system is
|
||||
perfectly secure, so if something goes wrong that affects your data, we'll tell you.
|
||||
</p>
|
||||
|
||||
<h2>Changes</h2>
|
||||
<p>If we change this policy in a way that matters, we'll update the date above and let you know in the app or by email.</p>
|
||||
|
||||
<h2>Contact</h2>
|
||||
<p>
|
||||
Questions or requests: <a href={`mailto:${CONTACT}`}>{CONTACT}</a>. See also our <Link href="/terms">terms</Link>.
|
||||
</p>
|
||||
</article>
|
||||
);
|
||||
}
|
||||
Reference in New Issue
Block a user