Privacy Policy

You sign in to Discollect with your Spotify account. We collect the following information to run the service. We do not collect your email address.

• Spotify profile: your Spotify account ID, display name and the link to your Spotify profile image, which we don't display.
• Spotify authorization: the access and refresh tokens Spotify gives us so we can check what you've recently played. We only request the recently played permission. We cannot control your playback, see your playlists, or read your email.
• Listening data: the tracks you've played, from Spotify's recently played list. Plays on albums you can collect are kept as part of your album progress and discs. Every other play we receive is kept for 30 days and then removed, so we don't keep your full play history indefinitely.
• Sign-in sessions: when you sign in, we record the time, your device's browser details and your IP address, so we can keep you signed in and protect your account.
• Your activity on Discollect: your albums in progress, discs collected, ratings, backlog, pinned discs, achievements, who you follow, who follows you, and the settings you choose, such as your username and country flag.

We also record basic technical information about how the service is running, such as sync errors and failures, to keep it working.

We use your information to run Discollect: to track your listening, award discs and achievements, and show your profile. We use your IP address and sign-in details to keep you signed in and to enforce usage limits that protect the service from abuse. We do not sell your data, use it for advertising, or share it with advertisers.

Your profile is part of the service, so some of it is public. Anyone with the link to your profile can open it, whether or not they're signed in. Your display name and username are always shown. By default, the following are also shown, and you can hide each of them separately in your settings:

• Discs in progress
• Recently collected discs
• Listen history
• Followers and who you follow
• Your country flag

You can also choose whether your profile is discoverable. When it isn't, your profile is left out of search, the collectors page, collector lists and sitemaps. People who have the link can still open it. You always see everything on your own profile.

Discollect uses a single cookie, which keeps you signed in. It serves no other purpose. We don't use cookies for analytics, advertising or tracking.

You can delete this cookie through your browser settings. Doing so signs you out, and blocking it prevents you from signing in.

Discollect does not include third-party cookies, advertising or analytics. The following third parties are involved in running the service:

• Spotify: you sign in with Spotify, and we get your listening data, album details and album artwork from it. Spotify's own terms and privacy policy apply to your Spotify account.
• Cloudflare: Discollect is served through Cloudflare, which handles your requests to our site and may process technical information such as your IP address.

Discollect asks Spotify for one permission: to read your recently played tracks. You can remove Discollect's access to your Spotify account at any time at spotify.com/account/apps. Once you do, Discollect can no longer see your listening and stops collecting new plays. Your existing data stays on Discollect until you delete your account.

We keep your data for as long as you have a Discollect account, with one exception: plays that don't count toward a disc are removed after 30 days, as described above.

You can delete your account at any time in your settings. Your account is deleted immediately, and so is everything tied to it:

• Profile: your name, username and settings.
• Album progress and discs collected: your albums in progress, discs, ratings, backlog, pinned discs and achievements.
• Listening data: your play history, including recently played tracks.
• Followers and following: your connections to other collectors.
• Spotify access: your Spotify tokens are deleted, and Discollect stops checking your listening. To also remove Discollect from your Spotify account, see section 5.
• Sign-in sessions: you're signed out everywhere.

We keep encrypted backups of our database for disaster recovery. A deleted account can remain in backups until they expire, which may take up to 35 days. Deleted accounts can't be restored.

We take reasonable steps to protect your data, including encrypted connections to the site. Because we don't ask for your password or email, there's no password for you to lose. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your data, we'll tell you as required by law.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of the personal data we hold about you, to object to how we use it, and to complain to your local data protection authority. You can view and change most of your information in your settings and delete your account there. For anything else, including a request for a copy of your data, contact us at isaac [at] discollect.app and we'll respond within a reasonable time.

We may update this Privacy Policy from time to time. The date at the top of this page shows when it last changed. If we make a significant change, such as collecting new kinds of information, we'll tell you in the app or by another reasonable means before it takes effect. Continuing to use Discollect after a change means you accept the updated policy.

If you have any questions, concerns, or requests related to your information or this Privacy Policy, please email us at isaac [at] discollect.app.