musicshare/apps/web/src/app/privacy/page.tsx

import type { Metadata } from 'next';
import Link from 'next/link';

export const metadata: Metadata = { title: 'Privacy policy · musicshare' };

const UPDATED = 'October 15, 2026';
const CONTACT = 'app@musicshare.binarygnome.com';

export default function PrivacyPage() {
  return (
    <article className="card legal">
      <h1>Privacy policy</h1>
      <p className="muted">Last updated {UPDATED}</p>

      <p>
        musicshare shows your friends what you&apos;re listening to. This page explains what we collect to do that, who can
        see it, and how to delete it. In short: we only collect what the app needs, we don&apos;t show ads, and we never
        sell your data.
      </p>

      <h2>What we collect</h2>
      <ul>
        <li>
          <strong>Your account:</strong> username, email address, display name, bio, and profile picture if you add one.
          Your password is stored only as a one-way hash. Profile pictures are resized and stripped of hidden data like
          camera details and location before they&apos;re stored.
        </li>
        <li>
          <strong>What you listen to:</strong> the song you&apos;re playing now (title, artist, album, artwork, where in the
          song you are, and which app or service it&apos;s from) and your last 50 plays. Older plays are deleted
          automatically.
        </li>
        <li>
          <strong>Services you connect:</strong> to read what you&apos;re playing we keep a sign-in token for each service
          (Plex, Last.fm, Apple Music, Jellyfin) or just your username (ListenBrainz). Tokens are encrypted. We never see
          or store your Plex, Last.fm or Apple password; your Jellyfin password is used once to sign in and not kept.
        </li>
        <li>
          <strong>The Android app&apos;s &ldquo;This phone&rdquo; sharing:</strong> if you turn it on, Android calls it
          &ldquo;notification access&rdquo;, but the app only reads the song, artist and album from music apps you allow.
          It doesn&apos;t read or store your notifications, messages or anything from other apps.
        </li>
        <li>
          <strong>Comments and reactions</strong> you leave on plays. Comments stay until you or the person who played the
          song deletes them, or one of your accounts is deleted. Plays with comments are kept in their history so the
          conversation isn&apos;t lost.
        </li>
        <li>
          <strong>People:</strong> who you follow, who you&apos;ve pinned, who you&apos;ve blocked, and reports you send.
        </li>
        <li>
          <strong>Notifications:</strong> reactions, comments and replies, new followers and songs (with any note) sent to you, and your
          notification settings. If you turn on push notifications, we store the push address your browser or
          phone gives us and its encryption keys.
        </li>
        <li>
          <strong>Technical data:</strong> sign-in sessions (stored as hashes), and your IP address, which is used briefly
          to prevent abuse (like limiting sign-in attempts) and appears in server logs that are kept for a short time.
        </li>
      </ul>
      <p>We don&apos;t use advertising, analytics or tracking tools, and we don&apos;t use cookies except the one that keeps you signed in.</p>

      <h2>Who can see what</h2>
      <ul>
        <li>
          <strong>Your profile is public.</strong> Your username, display name, picture, bio, featured song, what you&apos;re
          playing and your recent plays can be seen by anyone who has your profile link or finds you in search, including
          people who aren&apos;t signed in.
        </li>
        <li>Your followers see what you play in their feed, live.</li>
        <li>
          Comments on a play can be read by signed-in people who can see that play. Only you and the people you follow can
          write them, and you can delete any comment on your plays.
        </li>
        <li>
          Your email address is never shown to other people. It&apos;s used to sign in, to send you confirmation and
          password reset emails, and to contact you about your account.
        </li>
        <li>
          People you block can&apos;t find you or see your profile, and you stop following each other. Their comments on
          your plays, and yours on theirs, are removed. They aren&apos;t told.
        </li>
        <li>
          You can <strong>pause sharing</strong> at any time in Settings. While paused, nothing new you play is shared or
          stored.
        </li>
      </ul>

      <h2>Who we share it with</h2>
      <p>We don&apos;t sell or rent your data. Some information goes to other services so the app can work:</p>
      <ul>
        <li>
          <strong>Services you connect</strong> (Plex, Last.fm, ListenBrainz, Apple Music, your Jellyfin server): we ask
          them what you&apos;re playing using the access you gave us.
        </li>
        <li>
          <strong>Song matching:</strong> to build &ldquo;open in your app&rdquo; links we look up song titles and artists
          with Deezer, Apple&apos;s iTunes search, Spotify&apos;s catalog and Odesli (song.link). These lookups contain only
          the song, never who listened to it. Lyrics come from LRCLIB, looked up the same way: just the song.
        </li>
        <li>
          <strong>Push notifications:</strong> if you turn them on, notifications are encrypted on our server and
          delivered through your browser maker&apos;s push service (for example Google for Chrome, Mozilla for Firefox) or,
          on Android, through the push server your ntfy app uses (ours, unless you chose another). They can&apos;t read
          the contents.
        </li>
        <li>
          <strong>Our own servers:</strong> the app, database and email run on servers we manage ourselves.
        </li>
        <li>If the law requires it, we may have to share information with authorities.</li>
      </ul>
      <p>
        Data from Last.fm is shown with a link back to the listener&apos;s Last.fm profile, as Last.fm requires. Each
        connected service has its own privacy policy for the data it holds.
      </p>

      <h2>How long we keep it</h2>
      <ul>
        <li>Recent plays: the latest 50. Older ones are deleted as new ones come in.</li>
        <li>Notifications: until you delete your account. Push addresses are deleted when you turn push off or the device stops accepting them.</li>
        <li>
          Everything else: until you delete it or your account. Deleting your account (Settings &rarr; Delete account)
          removes your profile, picture, plays, follows and connected services right away. Database backups are kept for
          14 days, so deleted data is fully gone after that.
        </li>
        <li>Password reset and email confirmation links expire within a day and are deleted once used.</li>
      </ul>

      <h2>Your choices and rights</h2>
      <ul>
        <li>Edit your profile, change your email or password, disconnect services and delete your account in Settings.</li>
        <li>Pause sharing, block people, and remove followers whenever you like.</li>
        <li>
          You can ask us for a copy of your data, or to correct or delete it, by emailing{' '}
          <a href={`mailto:${CONTACT}`}>{CONTACT}</a>. Depending on where you live (for example the EU, UK or
          California) you may have further rights, and you can complain to your local data protection authority.
        </li>
      </ul>

      <h2>Children</h2>
      <p>musicshare isn&apos;t meant for children under 13, and we don&apos;t knowingly collect data from them. If you think a child under 13 has an account, email us and we&apos;ll delete it.</p>

      <h2>Security</h2>
      <p>
        We use encrypted connections (HTTPS), hash passwords and session tokens, and encrypt service tokens. No system is
        perfectly secure, so if something goes wrong that affects your data, we&apos;ll tell you.
      </p>

      <h2>Changes</h2>
      <p>If we change this policy in a way that matters, we&apos;ll update the date above and let you know in the app or by email.</p>

      <h2>Contact</h2>
      <p>
        Questions or requests: <a href={`mailto:${CONTACT}`}>{CONTACT}</a>. See also our <Link href="/terms">terms</Link>.
      </p>
    </article>
  );
}