Privacy

I'm hurfyd, and I run cosine.club. Email [email protected] with anything about this page.

• Your account. Email, username, a hashed password, and anything you add to your profile.
• What you do on the site. Plays, favorites, playlists, journeys and submissions. I use these for your history and your recommendations. Each play also stores a one-way hash of your IP address, so I can count how many different people play a track.
• Connected accounts. Your Discogs or Bandcamp username and collection, plus your Discogs wantlist or Bandcamp wishlist, when you connect them.
• Donations. The amount and your email. Stripe takes the card details, and I never see them.
• Emails. Account emails, plus recommendation emails when you turn them on, each with an unsubscribe link.
• Logs and analytics. IP address, browser, pages visited and searches. Visit counts come from Plausible, which sets no cookies. Error reports go to GlitchTip and include your user ID if you're logged in. I run both on my own servers, so nobody else sees this data.

The legal basis for each use:

• I need your account, activity, connected accounts and donations to provide the features you use (contract).
• I send recommendation emails only if you turn them on. You can turn them off at any time (consent).
• I need logs, analytics, error reports and the cookies below to run and protect the site (legitimate interests).

You need an email to make an account. Everything else is optional.

• Session. Keeps you logged in. It lasts 30 days.
• Security. Protects forms from cross-site request forgery. It lasts 30 days.
• Visitor ID. A random ID that counts plays, including plays by people who aren't logged in. It also keeps your journeys and submissions together, and links them to your account when you log in. It lasts a year. Email me to opt out of it.
• Discogs wantlist setting. Remembers whether to add tracks to your Discogs wantlist when you add them to a playlist. It lasts a year.

The player is YouTube's embed, which sets YouTube's own cookies. See Google's privacy policy.

• The public. Your profile page, and any playlists or favorites you make public.
• Stripe. Handles donations.
• YouTube. Plays the tracks.
• Service providers. Host the site and send its emails.

Some of these providers are in the US. Standard data protection contracts cover that transfer, and each provider publishes its own.

I keep account data until you delete your account. You can do that from your account settings.

Plays and journeys stay after that, but they are no longer linked to your account. I delete logs after 30 days.

Email me to get a copy of your data, or to have me correct it, delete it, limit how I use it, or send it to you in a format you can take elsewhere.

You can also ask me to stop using your data for logs, analytics and error reports. I'll stop unless I need it to keep the site running or secure.

If you have a concern about how I use your data, email me. You can also complain to the Information Commissioner's Office, the UK's data protection regulator.