Privacy
What this site does with your data. Short, because it does very little.
No analytics. No tracking. No advertising. Browsing and searching needs no account and sets no cookie, and your Spotify connection, if you make one, never reaches this server.
There is one exception, and it is deliberate: the personal listening page at /me asks you to sign in and does keep data on the server. Nothing takes you there by accident, and the section below says exactly what it stores.
What stays in your browser
These live in your own browser's storage and are never transmitted to this site's server:
| What | Where | Why |
|---|---|---|
| Spotify access token | sessionStorage | Authorises calls your browser makes directly to Spotify. Cleared when you close the tab. |
| Your last result set | localStorage | So reopening the map is instant instead of re-running the search. |
| Whether you've seen the walkthrough | localStorage | So it doesn't reappear every visit. |
Clearing your browser storage for this site erases all of it. Disconnecting Spotify removes the token immediately.
If you sign in on the personal page
/me works from your own listening history, which it cannot do anonymously — an import has to belong to someone, or anyone loading the page could read it. So this one part of the site does use an account and a cookie. It is currently open only to invited addresses.
| What | Where | Why |
|---|---|---|
| Your email address | Signed cookie, and on the server's disk | Google sign-in returns your address and nothing else — no name, no picture, no contacts. It is recorded beside each import so the import stays yours and follows you between devices. |
| Your uploaded listening history | The server's disk | A Spotify export is large and slow to parse, so it is kept rather than re-uploaded every visit. Only your own account can read it. |
| Your Last.fm API key and username | Signed cookie only | Used to run lookups on your quota instead of this server's. Never stored on the server, and cleared when you sign out. |
| Your Spotify Client ID | Signed cookie only | Lets the Spotify connection use an app registered to you. Public by design under the PKCE flow, and cleared when you sign out. |
Signing out clears the cookie and everything in it. To remove an import, use Delete this upload from the server on the listening map — it removes the parsed history, the file on disk, the record of who it belonged to, and the per-artist listening figures any map built from it. It is immediate and cannot be undone.
On this deployment the server's disk is wiped whenever the instance restarts or idles out, so an import is lost then anyway. Deleting is how you remove one on your own terms rather than waiting for that.
With a Last.fm username saved, asking the map to "top up" sends that username and your key to Last.fm to read your recent scrobbles. That request is made by this server, not your browser.
If you email yourself a round or a map
The results screen can send the three suggestions to an address you type, and the map can send itself as a spreadsheet the same way. That address is used for that one message and then gone — it is not stored, not added to any list, and not written to a log. There is nothing to unsubscribe from, because nothing was subscribed; the message says so itself.
| What | Where | Why |
|---|---|---|
| The address you type | Held in memory for the length of one request, and sent to the delivery service below | Somebody has to be handed the envelope. It is not kept on this server afterwards, and it is never included in a reply, so it is not recorded even by a failure. |
| The three suggestions and the related artists | In the message itself | That is the message. Nothing else about your session goes with it. |
| The map, when you email that instead: every artist on it, their scores, which of your artists each one connects to, a one-line description, and links to hear them | In the message, and in a CSV file attached to it | It is the same table the Download button produces, so what arrives by email and what lands in your downloads folder are the same thing. |
Delivery is done either by Resend or by the operator's own mail server, depending on how this deployment is configured; whichever sends it handles the message and therefore sees the address, under its own policy. The message carries no images and no tracking pixel, so opening it reports nothing back here.
One address per message, and a small number of messages per hour from any one visitor — limits that exist because an open form that mails strangers is otherwise a gift to whoever finds it first.
Your Spotify connection
Connecting Spotify is optional — everything else on the site works without it. It uses Spotify's PKCE flow, which means no password and no token ever passes through this server. Your browser talks to Spotify directly.
The connection asks Spotify for permission to read your top artists, the artists you follow and your saved library — all used to suggest starting points — and to create private playlists. Playlist creation is currently hidden in the interface, so that last permission is usually requested and unused — and when it is offered, any playlist it makes is private. It is listed here either way, because Spotify's consent screen shows it to you and this page should not contradict what you are asked to approve.
Nothing is ever made public, and nothing in your account is modified without you asking.
You can revoke access at any time from your Spotify apps page.
What the server sees
- Artist searches you run. These are forwarded to the music databases below to get an answer. Unless you are signed in on the personal page, they aren't linked to an account, because there is no account.
- A visit log. Every page and request you make is written to a log on the server with: the date and time, your IP address, the two-letter country code the network in front of this site resolves it to (when it supplies one — otherwise that field is left empty rather than guessed at), which page or endpoint you asked for, how long the server took, how long you have been on the site, and — on your first request only — which site linked you here, if any. That is the whole of it.
- No cookie is used for any of this, and nothing is stored on your device. Requests are grouped into one visit using a fingerprint made by hashing your IP address and browser identification together with a secret that is thrown away and regenerated every day. That is enough to see that eleven requests were one sitting. It is not enough to recognise you tomorrow, and it is deliberately not reversible.
- Why it exists: to know whether anyone is using this and roughly from where. It is read by one person — the operator — and it is never sold, shared, or fed to an advertising or analytics company. There are no third-party trackers on this site at all.
- How long it is kept: the log lives on the server's disk, which is wiped every time the site restarts or is redeployed — in practice days, not months. Copies kept in the hosting provider's own log stream age out on their schedule.
- Standard web server request logs, as with any website.
If you would rather not be logged at all, blocking this site in your browser is the reliable answer; there is no honest way for a page to promise otherwise about a request that has already reached the server. The code that writes this log is mpivot/interactions.py — every claim in this section can be checked against it.
Where the music data comes from
Answers are assembled from four public music databases. Searching sends the artist names you typed to them:
- MusicBrainz — credits and relationships
- ListenBrainz — open listening statistics
- Last.fm — tags and similarity
- Deezer — catalogue and artwork
Those services have their own privacy policies covering what they log.
Contact
soundgraph is a personal, non-commercial project. Its source is public on GitHub, so every claim on this page can be checked against the code rather than taken on trust.