Privacy Policy

Spindle is a free music player at spindle-bice.vercel.app, with a desktop app for Windows and Mac. This page explains what Spindle stores, why, who else is involved, and how to see or delete your data. In short: we keep only what's needed to sign you in, sync your library and keep the app working. There are no ads and no tracking cookies, and we never sell or share your data for advertising.

Who runs Spindle

Spindle is made and run by Somesh Sanjay Thakur, an individual developer based in India, who is responsible for your data ("we" on this page). Contact: someshrthakur@gmail.com.

What we collect

• Account details: your email address and the name you choose. If you sign up with email, your password is stored only as a secure hash by our sign-in provider; we never see it.
• GitHub sign-in: if you use it, we receive your name, email address and profile picture link from GitHub. We don't get access to anything else in your GitHub account and never post on your behalf.
• Your library: liked songs, playlists (including any cover image you upload), lyrics you add, your settings and the queue you're listening to, so they can follow you to your other devices.
• Listening history: which songs you played, when and for how long, for your Stats and playlist play counts. Only you can see your own history.
• Things you share: when you create a share link for a song, playlist or album, its title, artwork, song list and your display name become visible to anyone with the link, until you delete it in Settings.
• Feedback you send: your message, the page you sent it from, and your browser and app version, with your name and email so we can reply.
• Crash reports: when something breaks while you're signed in, the error message, the page it happened on, and your browser and app version, so it can be fixed.
• Visit counts: to know roughly how many people use Spindle, each visit is counted once a day under a code made from your network address and browser plus a secret that changes every day and is then deleted. The address itself is never stored, nothing is saved on your device, and visits can't be linked to you or followed from one day to the next. We also note your country and the website that sent you here, if any. If you're signed in, your account is marked as active that day. Browsers that send "Do Not Track" or "Global Privacy Control" aren't counted, and you can switch counting off in Settings → Privacy.

We don't collect payment details, contacts or your precise location, and we don't use any third-party analytics or advertising service.

Why we use it

• To provide the service you asked for: signing you in, syncing your library, your stats and share links. This is needed to perform our agreement with you.
• To email you a verification code when you sign up or reset your password. We don't send marketing emails.
• To answer feedback, fix bugs, keep Spindle secure, and understand overall usage through totals like daily visitors. This is our legitimate interest in running and improving a free service.

Cookies and storage on your device

Spindle doesn't use cookies for tracking or advertising. It uses your browser's local storage only for things the app needs to work: keeping you signed in, your library and settings, cached search results, and songs you download for offline listening. Clearing your browser's site data removes them.

Songs from YouTube play in YouTube's privacy-enhanced mode (youtube-nocookie.com), in which YouTube says it doesn't store information about visitors unless they play a video. Once a video plays, YouTube's player may store data under YouTube's own policies.

Who else is involved

• Supabase stores accounts, libraries, history, feedback and visit counts, on servers in Singapore.
• Vercel hosts the website.
• YouTube: Spindle uses YouTube API Services to play songs through YouTube's embedded player. By using Spindle you also agree to the YouTube Terms of Service, and YouTube's use of data is covered by the Google Privacy Policy. Spindle doesn't access your YouTube or Google account.
• Music and lyrics services: searches, artwork, previews and lyrics come from Apple's iTunes Search (privacy), Audius, LRCLIB and lyrics.ovh. Your browser contacts them directly when you search or play, so they see your network address, as any website does.
• GitHub handles GitHub sign-in if you choose it.
• Discord: new feedback, with your name and email, is posted to a private channel that only the developer can see, so it gets answered quickly. In the desktop app, if Discord is open on your computer, Spindle shows the song you're playing as your Discord status. That goes from your computer to your own Discord app and is visible to whoever Discord lets see your activity; you can turn it off in Discord's Activity Privacy settings.

All of these are used only to run Spindle. We don't sell your data or share it with anyone for advertising.

How long we keep it

• Your account, library, history and share links: until you delete them or your account.
• Feedback: until it's resolved and no longer needed, at most two years.
• Crash reports: cleared once the problem is fixed, at most one year.
• Visit counts can't identify anyone and are kept as statistics.

Your rights

Wherever you live, you can:

• See and download your data: Settings → Privacy → Download your data.
• Correct it: change your name and password in Settings, or email us.
• Delete it: Settings → Account → Delete account permanently removes your account, library, history, share links, feedback and crash reports. "Sign out and clear" removes your library from the device you're using. You can also email us and we'll delete it within 30 days.
• Object or withdraw consent: turn off visit counting in Settings → Privacy, or email us with any concern.

If you're unhappy with how we handle your data, please contact us first. You can also complain to your local data protection authority.

Children

You must be at least 13 to use Spindle, and if you're under 18, please use it with a parent's or guardian's permission. We don't knowingly collect data from children under 13. If you believe a child has created an account, email us and we'll delete it.

Security

Data travels over encrypted connections, and the database only lets each account read its own library. No system is perfectly secure, so please use a strong password. If we learn of a breach affecting your data, we'll tell you as the law requires.

Changes

If this policy changes, we'll update this page and the date above, and mention important changes in the app.

Contact

Questions, data requests or deletion requests: someshrthakur@gmail.com.