The music here is invented. This page is not. It says what Sidetrax records about you, why, and what you can ask us to do about it.
You can listen without telling us anything
Browsing and playing need no account. If you never make one, we hold no name, no email address, and nothing that identifies you.
We count plays, including anonymous ones
When a song is played far enough in to count, we record which song, when, and a random identifier stored in your browser session. That identifier is how we tell one afternoon's listening from another's, so that a chart counts people rather than replays. It is not linked to your name or your device, it is not shared, and it is discarded when the session ends.
If you are signed in, the play is also attached to your account. That is what makes a listening history possible, and it is the only reason it is kept that way.
An account holds what you asked it to
An account is an email address and a password. The password is stored only as a one-way hash, so it cannot be read back, by us or by anyone who reached the database. Alongside it we keep the songs you saved, the songs you starred, the artists you follow, which of the two mailing lists you asked for, and when you confirmed your address — which is the account, rather than anything gathered around it.
Signing in also records the IP address and browser of the session, so that a session can be recognised and ended. We use it for nothing else, and we do not build a location or a profile from it.
Two kinds arrive because you asked for them: the link that confirms your address when you sign up, and the link that resets a forgotten password. Those are not a mailing list and cannot be turned off while the account exists, because they are the only way back into it.
Two more arrive only if you say so — a newsletter, and news from the artists you follow. Both are off unless you turn them on, on the signup form or on your account page, and neither is ever pre-ticked. Every one of them carries a link that turns them all off without signing in, and that link does not expire. We do not pass your address to anyone else to mail you, and we do not sell it.
Cookies, and what we do without them
One cookie, for the session: it keeps you signed in and carries the random identifier the play count uses. Your player's queue and position are kept by your own browser rather than sent to us, which is why playback resumes on the device you left it on and not on another one.
Traffic is measured with Plausible, which sets no cookies, collects no personal data, and produces page counts rather than people. There are no advertising trackers on this site, and nothing here is sold or handed to a broker.
Who else touches it
The merch pages read product names, prices and pictures from Fourthwall, and every tile links out to Fourthwall's store. Buying happens there, under their privacy policy — no order, payment or delivery detail ever reaches this site.
Audio is stored with Cloudflare R2 and served through links that expire, so a file cannot be lifted and shared on. Analytics are Plausible's. Nobody else is given any of it, and we do not sell or trade any of it at all.
Where it is
Sidetrax is run from Japan, and the app and its database are hosted in the United States. So if you are reading this from the UK or the EU, what little we hold about you is stored outside it. We rely on the standard contractual clauses our hosts offer for that transfer, and the honest mitigation is how little there is to transfer: an email address, a password nobody can read back, and a list of songs you liked.
How long it is kept
Your account and what is in it are kept until you ask us to delete it. Plays are kept indefinitely, because they are what the charts are built from — but when an account is deleted, its plays are cut loose from it rather than removed, so the count survives and the person in it does not.
What you can ask for
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Deleting is a button on your account page and takes effect at once; for the other two, write to [email protected] and we will do it.
If you are in the UK or the EU, the UK GDPR and the GDPR give you those rights and a few more — to object to a use, to restrict one, and to complain to your data protection authority if we handle it badly. Those rights hold wherever the site is run from. Sidetrax is the controller of the data described here, and the address above reaches it.
Children
Sidetrax is not aimed at children, and accounts are not intended for anyone under 13. If you believe a child has made one, write to us and we will remove it.
Changes
If what the site collects changes, this page changes with it rather than after it. Material changes will be said plainly here rather than folded in quietly.
Questions about any of this go to [email protected]. See also the terms and what Sidetrax is.