Privacy policy

Who runs this

Album Ranker is a personal project run by an individual based in Poland — not a company. For anything in this policy, including a request to see or delete your data, write to michal100larczyk@gmail.com.

This policy covers the deployment at https://album-ranker.cojaj.co. The source is open, so anybody can run their own copy; if you are using one of those, its operator decides what happens to your data, and this document says nothing about it.

Your account

Sign-in is handled by Clerk, which holds your credentials. When you first sign in, this app creates a row of its own holding four things: your Clerk user id, a handle, your display name if Clerk has one, and the address of your profile picture if Clerk has one.

Your email address is not stored in this app’s database. Clerk keeps it as your sign-in credential, and this app never copies it.

One consequence of that is worth stating plainly. Your handle becomes your public profile address at /u/<handle>, and it is chosen for you on first sign-in: your Clerk username if you have one, otherwise your first name, and failing both, the part of your email address before the @. So if you signed up with no username and no first name, publishing a ranking would put that fragment of your email address on a public page. Nothing is published automatically — rankings are private by default — but if you intend to publish, set a username in Clerk first. There is no screen for changing a handle yet; ask and it will be changed.

Your library and your rankings

For each album you import, this app stores what it needs to tell albums apart:

• artist, title, release year, track count and album type
• the barcode, where a service supplies one
• a cover image address, where a service supplies one
• per-service identifiers and links, so an album can point back at Spotify or Tidal
• when you added it, and which source it came from

Album records are shared across accounts and addressed by a hash of the normalised artist and title, so the same record imported by two people is one row. That row is not personal data; the link between it and your account is, and that link is what a deletion removes.

For each ranking, it stores the ranking itself and every decision inside it:

• its title, address, visibility, round count and the seed its draw depends on
• every comparison drawn, which album you chose, and when you chose it
• which albums you set aside, and when

Connected services

Connecting Spotify or Tidal stores an access token and a refresh token, both encrypted at rest with AES-256-GCM, along with the granted scopes, the expiry, and the service’s own id for your account.

The access requested is read-only and as narrow as each service offers: user-library-read on Spotify and collection.read on Tidal. This app reads the albums in your collection. It does not play anything, read or write playlists, follow anybody, or change one thing about your account at either service.

Disconnecting deletes the stored tokens here, and that is all it can do. Neither Spotify nor Tidal publishes an endpoint for revoking a link from the outside, so to withdraw the grant itself you have to visit their own pages — Spotify’s apps page and Tidal’s account settings. The albums already imported stay in your library: they are there because you own the records, not because a connection is open.

The macOS app and Music.app

The macOS app can read your Music.app library. That scan runs entirely on your Mac, and the tracks it finds are folded into albums in the page before anything is sent — so the track list itself never leaves your machine, only the album-level result. Artwork is deliberately never read: this app treats a cover as a link and stores no image files at all.

Album covers, and your IP address

This one deserves saying out loud, because it is a genuine trade-off rather than an oversight. When a cover is not supplied by a connected service, this app looks it up by artist and title through the iTunes Search API and then Deezer, both without keys. The result is a redirect, not a proxy.

That means your browser then connects to Apple’s or Deezer’s servers directly, and those companies see your IP address, your user agent, and which cover you asked for — exactly as they would for any image hotlinked from anywhere on the web. Proxying instead would hide your address from them, at the cost of routing every cover on every screen through this server, which would make the app slower for everyone and shift a great deal of somebody else’s bandwidth onto it.

Nothing about those lookups is written back to your account. The address a search returns is cached so the next person does not repeat the search, and no image is ever stored.

Public rankings

Every ranking is private when it is created. If you choose to publish one, it appears at /r/<slug> and is listed on your profile at /u/<handle>, together with your display name and handle. Public means public: anybody with the link can read it without an account, and search engines may index it.

Setting it back to private removes it from both pages immediately. What a search engine or an archive already copied is beyond anybody’s reach, here or anywhere else.

Analytics and cookies

The only cookie this app relies on is Clerk’s session cookie, which is what keeps you signed in. It is strictly necessary; without it there is no way to know whose rankings to show you.

Vercel Web Analytics and Speed Insights measure page views and loading performance in aggregate. Both are cookieless and neither is used to identify you or to follow you anywhere else. There are no advertising cookies, no ad networks, no cross-site trackers and no consent banner, because there is nothing here to consent to beyond the cookie that signs you in.

Who else handles it

Running the app means four other companies process some of this data:

• Clerk — accounts, sign-in and your email address
• Neon — the Postgres database everything above is stored in
• Upstash — the cache holding computed tables and cover addresses
• Vercel — hosting, and the aggregate analytics described above

Some of these process data outside the European Economic Area under their own transfer safeguards, and each publishes its own privacy notice. Nothing is sold, and nothing is shared with anybody not on that list.

How long it is kept, and how to get rid of it

Account data is kept while your account exists. Beyond that, three things behave in ways worth knowing:

• Deleting a ranking is a soft delete. It disappears from your account and from any public address at once, but the rows are retained rather than destroyed. That is deliberate — this app will not throw away a ranking on a single click, because doing so once cost somebody hours of work — and it is why the settings page puts a JSON export next to the delete button. If you want a ranking genuinely purged, ask and it will be.
• Clearing your library removes the albums you pick from. It does not touch rankings you have already built, which keep their own contenders.
• Disconnecting a service deletes its tokens here immediately, as described above.

There is no self-serve way to close an account yet. Rather than pretend otherwise: write to michal100larczyk@gmail.com and everything tied to your account will be removed, including the rows a soft delete had kept.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected, have it erased, have its use restricted, take it elsewhere, or object to it being processed. Write to michal100larczyk@gmail.com for any of them.

Portability is already built in and needs no request: every ranking has a JSON export on its settings page that contains the whole session, and the app will import that file back.

If you think your data has been mishandled you can complain to the President of the Personal Data Protection Office (UODO).

The legal bases

• Contract — holding your account, library and rankings, which is the service itself
• Legitimate interests — keeping the app working and reading aggregate performance figures
• Consent — connecting a streaming service, which you give at that service and can withdraw

Children

This app is not directed at children and is not intended for anybody under 16. If you believe a child has an account here, write and it will be removed.

Changes

The date at the top of this page is the date it last changed. Anything that materially alters what is collected or who sees it will be flagged in the app rather than quietly edited in here.

The terms of service cover the rest of the arrangement.