Privacy Policy

1. Introduction

This Privacy Policy explains how Shuffify collects, uses, and protects your information when you use our service. We are committed to protecting your privacy and being transparent about our data practices.

2. Data We Collect

When you sign in, Spotify shares your profile with Shuffify through its Web API. We store:

• Profile Information: Your Spotify user ID, display name, profile image URL, country, and Spotify subscription level
• Authentication Tokens: The OAuth access and refresh tokens Spotify issues so that Shuffify can work with your playlists
• Login History: When you log in and out, your IP address, your browser's user agent, and the session ID
• Playlist and Track Data: Playlist names and IDs, and the titles, artists, albums, cover art links, and track URIs of the songs Shuffify works with

We also store what you create and do in Shuffify:

• Settings: Your default shuffle method and its options, theme, and display and snapshot preferences
• Playlist Snapshots: Saved copies of a playlist's track order, used to undo and restore changes
• Schedules: The routines you set up (shuffle, raid, drip, and rotate), their settings, and a record of each run
• Raid Sources and Staged Tracks: The playlists and searches you collect songs from, and the songs a raid has found that are waiting for you to keep or dismiss
• Track Locks: Songs you lock to a position in a playlist, and when each lock ends
• Playlist Preferences: Playlists you pin, hide, reorder, or pair with an archive playlist
• Workshop Sessions: Track lists you save while editing a playlist
• Activity Log: A record of what you and your schedules do in the app, such as shuffles, raids, and snapshot restores

3. How We Use Your Data

We use your data exclusively for the following purposes:

• To authenticate you with Spotify and keep you signed in
• To display your playlists and make the changes you ask for
• To run your schedules while you are away, which is why we keep your refresh token
• To undo and restore playlist changes from your snapshots
• To keep your account secure, and to find and fix errors

4. Data Storage and Security

Session-Based Storage: Your session, including your Spotify tokens, is stored on our servers. Your browser holds only a cookie that identifies the session.

Persistent Storage: Everything else listed in section 2 is stored in our database. Our hosting and database providers store this data on our behalf.

What we do NOT store: We do not store your Spotify password, any audio, or any payment information. The copy of your refresh token that we keep for your schedules is encrypted at rest.

Data Retention: We keep your data while your account exists. Snapshots are capped per playlist by your settings, and deleting a schedule deletes its record of runs. You can delete snapshots, schedules, raid sources, track locks, and workshop sessions in the app. To delete your account and all of its data, including your login history and activity log, contact us.

Security Measures: We use industry-standard security practices including encrypted token storage, HTTPS transport, and server-side session management.

5. Third-Party Services

Spotify: We integrate with Spotify's Web API to access your playlist data. Spotify's own privacy policy applies to data collected by their service.

Error Monitoring: When something fails, a report of the error may be sent to our error-monitoring provider, Sentry. Reports are scrubbed of tokens and other secrets and do not include cookies.

No Data Sharing: We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes.

6. Your Rights

You have the following rights regarding your data:

• Access: You can see your playlists, snapshots, schedules, activity, and settings in the app, and you can ask us for a copy of the data we hold about you
• Deletion: You can delete what you create in the app, and you can ask us to delete your account and all of its data
• Revoking Access: You can remove Shuffify's access to your Spotify account at any time in your Spotify account settings; after that, your schedules can no longer change your playlists
• Inquiries: You can contact us with questions about your data

7. Cookies and Tracking

We use one session cookie to keep you signed in and to protect forms from cross-site requests. It is temporary and is cleared when you log out or your session ends. We also use your IP address briefly to limit how many requests can be made in a short time. We do not use advertising or analytics cookies.

8. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page.

10. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us at: christophertrogers37@gmail.com