Privacy Policy

setlist.id is operated by Skylight Studio LLC, which is the data controller for the information described here. Questions, or any request below, go to play@setlist.id. We answer them ourselves; there is no ticket queue to get lost in.

What We Collect, and Why

• Your account: email address and a hashed password. Needed to give you an account at all, so we process it to perform our contract with you.
• If you sign in with Google: we receive your email address, your name and profile picture, and the account identifier that provider uses for you. We store the email address and the identifier, so that signing in again reaches the same account; we do not store the name or the picture, and we ask for nothing else: no access to your contacts, files or mail. You can disconnect a provider at any time from your account page, and if it is the only way into your account we will ask you to set a password first. Needed to sign you in, so we process it to perform our contract with you.
• Your use of the service: the links you submit, whether each one could be priced and what it was quoted, the tracklists we identify, your hours and any set allowance and how you used them, and any share links you create. Same basis: it is the service.
• What you put in the link box on our homepage, whether or not you submit it and whether or not you have an account: the text, whether it was a link we can take, and the error we showed you if it was not. A web address we cannot take is kept without anything after its "?", and a single word that is not a link is kept only as its length, so a password pasted by mistake is not stored. It is tied to your account if you are signed in, and otherwise to the anonymous analytics identifier and country of the visit. We rely on our legitimate interest in seeing which links people try, and keep it for 180 days.
• Billing: your hours balance and the history of hours bought, spent and refunded, and, if you have a plan, the plan, its renewal date and the sets used. Card details are handled by Stripe and never reach us. Same basis.
• API tokens, if you create one to reach setlist.id from another tool. We store a hash of the token, never the token itself, which is why we can only show it to you once, and why a lost token has to be replaced rather than recovered.
• Anything you write to us: feedback submitted through the site, and email you send us. The feedback form asks for your name and email so we can reply.
• Analytics: how the site is used, described below. We rely on our legitimate interest in understanding and improving the product.

Your Mixes and the Audio

When you submit a link, our server fetches the audio from wherever it is hosted, so that platform sees a request from us, not from you, and whatever it logs about that request is governed by its own privacy policy. The audio is written to temporary storage on our servers and processed by our recognition system. We may keep a copy of the mix audio for a short period on our own servers to improve recognition; it is never published or shared.

To identify tracks, our system also calls on recognition partners. We send ACRCloud the mix link, or the audio itself where it cannot fetch the link, and we send short audio clips to AudD and to Apple's ShazamKit. What we keep afterwards is the link you submitted, the title and length of the mix, and the tracklist we found.

If the tracklist we found passes our quality bar (enough tracks identified for the length of the mix), we publish it on a public tracklist page with the mix's title and a link to where it is hosted. That page never names you or your account, and a private SoundCloud link (one carrying a secret token) is never published. Every public page has a removal link. Separately, you can create a share link for any of your tracklists. A share link is public to anyone holding the URL: we do not list it anywhere or put it in our sitemap, and we ask search engines not to index it, but treat posting one publicly as publishing it. You can revoke a share link at any time, and deleting your account revokes every one you made.

Email About Your Account

Besides sign-in mail, we email you about your account and purchases: a checkout you started and didn't finish, your plan renewing, tips after you sign up. We rely on our legitimate interest in telling customers about our own service. Every one of these emails has an unsubscribe link, and unsubscribing never affects sign-in or receipt email.

Analytics and Session Recording

We use PostHog. What it does depends on where you are.

In the EU, EEA, UK and Switzerland: PostHog runs in cookieless mode. It stores nothing whatsoever on your device, and your activity is never linked to your account, even when you are signed in. Session recording is off. Our servers count purchases and mixes from these regions only in aggregate, under a shared anonymous identifier, never tied to you. Because nothing is stored on your device without you asking for it (see Embedded Players below for the one thing that is, and when), there is no cookie banner to show you.

If your browser sends Global Privacy Control, we treat you the same way wherever you are: PostHog runs cookieless, your activity is not linked to your account, and session recording is off.

Everywhere else: PostHog sets cookies, and once you sign in your activity is linked to your account. It collects pages viewed, clicks, your browser and device, an approximate location from your IP address, referrer, performance data and errors, and records a replay of your session. The replay masks all text on screen and everything you type, passwords included.

We do not use any of this for advertising, and we do not sell your data.

Embedded Players

Where you can play a mix on setlist.id, it plays in the hosting platform's own embedded player - YouTube, SoundCloud, Mixcloud and the others we support. The audio is streamed to you by that platform, never by us. That means the platform sees your IP address and can tell that a player was loaded on a setlist.id page, under its own privacy policy rather than this one.

For the YouTube player we use YouTube API Services. Information collected through it is handled under the Google Privacy Policy, and using setlist.id also means agreeing to the YouTube Terms of Service. You can review and revoke setlist.id's access to your data through the Google security settings page. We load that player from youtube-nocookie.com, YouTube's privacy-enhanced host, so it stores nothing on your device unless and until you actually start playback.

Cookies

• One to keep you signed in. Required for the service to work.
• One, kept a year, recording only that an account exists on this browser so returning visitors land in the app rather than the marketing site. It does not identify you and is cleared when you delete your account.
• One, kept a day, holding only your two-letter country code, so the page can tell which analytics mode applies without asking our server. It is set only outside the EU, EEA, UK and Switzerland.
• Two short-lived ones that carry a choice across sign-up: the hours bundle you picked before creating an account (kept a day), and the link you pasted before signing up (kept two hours). Both are cleared once used.
• PostHog's analytics cookies, which as above are not set at all in the EU, EEA, UK or Switzerland, or when your browser sends Global Privacy Control.
• Cookies set by an embedded player once you press play on a mix. These are the platform's own, not ours, and we cannot read them. Nothing is stored by the YouTube player before you press play.

We also keep a few settings in your browser's own storage: your key notation and which streaming links to show, kept until you clear them, and, for the life of the tab, the mix you were unlocking while you are away at checkout. None of these is used for analytics.

Who Processes Your Data

• ACRCloud: one of the recognition partners our system uses. We send ACRCloud the mix link, or the audio itself where it cannot fetch the link, to identify tracks, and it may be processed under their own privacy policy. See acrcloud.com.
• AudD and Apple ShazamKit: recognition partners that receive short audio clips from a mix to identify tracks.
• Stripe: payments and card details.
• Google, but only if you choose to sign in with it. Data travels the other way here: it tells us the email address and account identifier described above, under its own privacy policy. We send it nothing about how you use setlist.id.
• PostHog: analytics and session recording.
• Postmark: your email address, to send sign-in, verification and password-reset email, and the account email described above.
• ICP Tracker: our own system for account email, hosted on Vercel and Hetzner. It receives your email address and account events (a checkout started, a plan renewing) to decide which account email to send.
• Spotify, Tidal and Apple Music, but only if you connect one to export a tracklist as a playlist. We send it the tracks to add, under its own privacy policy.
• Deepgram and Anthropic: Deepgram turns artist interview recordings into text. Anthropic's models help write interview questions and guides and suggest a set's genres.
• Vercel (site hosting), Hetzner (our servers and database) and Cloudflare (DNS and SSL, and R2 storage for interview recordings and photos).
• Whichever platform hosts the mix you submit: SoundCloud, YouTube, Mixcloud and the like. They are not our processors and we have no agreement with them; our server simply requests the audio, the same way any listener's browser would. The same platforms see your browser directly when you play a mix in their embedded player, including Google for YouTube playback; see Embedded Players above.

Where Your Data Goes

Our servers and database are in the EU (Finland and Spain). Analytics (PostHog), payments (Stripe), email (Postmark) and site hosting (Vercel) process data in the United States; those transfers rely on the EU-US Data Privacy Framework where the provider is certified and on standard contractual clauses otherwise.

How Long We Keep It

• Downloaded audio: a short period, as described under Your Mixes and the Audio.
• Your account, mixes, tracklists and submitted links: while your account exists, and in the reduced form described below after you delete it.
• Billing records: seven years after the transaction, because tax and accounting law requires us to keep them.
• What you put in the homepage link box: 180 days.
• Account history kept after you delete your account: up to 3 years after deletion.
• Artist interview recordings and photos: until the interview is withdrawn.
• Session recordings: 30 days.
• Analytics events: up to 7 years.

Artist Interviews

If we invite you to an interview, we collect what you give us there: your answers, written or spoken, your voice recordings, the photos you upload and the links and details you add about yourself. Recordings are transcribed by Deepgram and kept so we can check quotes. Anthropic's models help us write the questions and the guide to the piece. Recordings and photos are stored in Cloudflare R2. We rely on your consent, and keep all of it until you withdraw the interview, which deletes the recordings and photos. Email play@setlist.id to withdraw at any time.

What Happens When You Delete Your Account

Deleting your account cancels any subscription and immediately makes the account unusable: every session is ended, every share link you made stops working, any API tokens are destroyed, any Google, Spotify or Tidal connection is unlinked, and what you put in the homepage link box while signed in is deleted. Your email address and password are erased, we delete your customer record at Stripe, and we delete your analytics profile at PostHog. Stripe keeps its own record of your payments, which tax law requires, under the Stripe Privacy Policy. No one can sign in as you afterwards, including us.

What we keep is the activity itself, detached from your identity: the mixes and tracklists, the links you submitted and what they were quoted, and the record of hours and sets bought, spent and refunded. These rows stay attached to a random identifier that is no longer connected to any email address or name, for up to 3 years after deletion. We keep them because they are our billing and accounting trail, and because how the service actually gets used is what we improve it from.

That is pseudonymisation, not anonymisation. A link you submitted is text you chose, and a link to your own upload can name you. So if you want the retained records gone too, tick "Also erase my mix history" when you delete, or email us afterwards, and we will erase them, apart from the billing entries the law requires us to keep.

If any analytics data about you is left after that, email us and we will delete it.

Security

Passwords are stored only as bcrypt hashes and API tokens only as SHA-256 hashes, so neither can be read back out of our database, not by an attacker, and not by us. Third-party connection tokens are encrypted at rest. Traffic runs over HTTPS throughout. If we ever suffer a breach that puts your data at risk, we will tell you and the relevant regulator, without waiting to be asked.

Your Rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on your consent you can withdraw it at any time. Email play@setlist.id and we will action it, normally within a few days and always within a month. We will not charge you for it, and we will not ask why.

If you are in the EU, EEA or UK and you think we have got something wrong, you can also complain to your national data protection authority.

Changes

We may update this policy. Changes are posted here with a new date. If a change means we start doing something materially different with data we already hold, we will email you rather than rely on you noticing the date.