Privacy

Session and required connections

A session cookie identifies this browser so your connections and requests stay together. The session expires after 90 days without activity. Authorizing a music service allows recordings to be searched and playlists to be created according to the permissions shown at sign-in.

Music credentials are encrypted on the server for up to 90 days after the last session or connection activity. Use renews the relevant period. Expiration or revocation by the music service may require you to reconnect sooner. The frontend does not save music tokens in local preferences. Setlist to Playlist never asks for your music password in its own form.

Browser preferences

Your search, show ID, service, recording preference, and request IDs may be saved in this browser. Local history stores identifiers, not a permanent copy of the setlist. Data is not synced between devices.

Setlists and requests

The setlist and track details used during processing and shown in results are available for no more than 5 minutes from the start of a request. After playlist creation succeeds, the full setlist copy is removed from the active record. When the short period ends, track details are no longer available, even if the request remains in your history.

Request metadata stays for up to 7 days after creation. It includes the ID, status, counts, and playlist and source links. This helps prevent duplicate requests; checking progress does not extend these periods.

Sources and recipients

Setlists come from setlist.fm. Playlist creation sends searches and tracks to the music service you choose. The application infrastructure uses AWS. Each provider's availability and terms also apply when you use your account.

Optional ads

If you allow it and the setting is active, Google Ad Manager may load ads. Setlist to Playlist sends only the current step and selected service as context, without your email or account token. Rejecting ads does not affect required connections or playlist creation.

Optional usage analytics

After separate opt-in, Google Analytics 4 (GA4) receives individual events describing flow steps, named control clicks, selected providers and step timings. Google may use optional analytics cookies after consent. Events do not include search terms, setlist URLs or IDs, account credentials, or playlist request IDs. Reports may aggregate event data. This preference is independent from advertising consent and can be changed in Privacy preferences.

Revoke and clear

Open My connections to remove server-stored connections and clear local preferences and history. When you disconnect an account, its credentials are removed from the active server record. If an official operation is available, we attempt remote revocation for up to 5 seconds. A failed remote attempt does not restore local credentials.

Official revocation attempts are available for YouTube/Google and SoundCloud. Google's revocation may affect other authorizations for the same project and can take time. SoundCloud's documented operation ends an access session; it may not revoke every token. For other services, removal happens in Setlist to Playlist because our integration has no confirmed official remote-revocation operation. You can also revoke access directly with the music service. Existing playlists remain in your library.

Expiry and physical deletion

The periods above stop the application from using expired data. Automatic deletion of physical records is asynchronous and may happen after expiry. Backup copies are not erased immediately when the active record changes or is removed.

Operational information

The public identity of the data controller and a contact channel for privacy requests must be confirmed before public launch. This page will be updated with those details; no support contact is inferred from a developer account.