Privacy Policy

Information stored in your browser

Songspot uses browser storage to remember interface preferences such as enabled clip lengths, volume, spotlight style, layout width and visual style. It may also remember whether you dismissed an interface notice and which tracks appeared during the current browser session.

This information is stored on your device. You can remove it by clearing site data for songspot.org in your browser. Clearing it resets preferences and removes the device cookie that reconnects you to a Daily 5 profile; it does not by itself delete an already published profile from the leaderboard database.

Daily 5 profiles and leaderboard data

Daily 5 assigns this browser a random, secure session cookie. Songspot stores only a cryptographic hash of that credential in Cloudflare D1, not the credential itself. Clearing browser data can make the profile inaccessible from that device, and v1 does not offer cross-device recovery.

When you start Daily 5, Songspot stores the UTC challenge date, current round and clue stage, per-round outcome and score, total score, correct count, and server-recorded start and completion times. We do not store the text you type into the guess field. Each browser profile can create only one attempt per UTC day.

After finishing, you may publish a unique public nickname and optionally choose a profile photo. The browser center-crops the selected image, re-encodes it as a 256-pixel WebP file and uploads only that processed copy. Songspot stores the image in Cloudflare R2 and a private object key in D1; the original file and its embedded metadata are not uploaded. The processed photo is publicly displayed beside your nickname on Daily 5 leaderboards.

Nicknames are normalized, checked without regard to letter case, and displayed with score, rank, correct count and completion time. Current and longest participation streaks are calculated from published Daily 5 dates. A reported nickname or profile photo may be hidden while reviewed.

You can delete the entire leaderboard profile from the leaderboard page while this browser session is still available. Deletion removes the nickname, profile photo, sessions, Daily 5 attempts and streak history and releases the nickname. Published data otherwise remains while the leaderboard operates or as reasonably needed for security, abuse prevention and legal obligations.

Cloudflare Turnstile and hosting

Publishing a score requires Cloudflare Turnstile, which helps distinguish ordinary players from automated abuse. Your browser sends the Turnstile token and standard request information to Cloudflare; Songspot verifies the single-use, time-limited token on the server. Cloudflare also hosts the site and D1 leaderboard database and may process ordinary network and security logs under its own policies.

Audio previews and third-party requests

Playing a clue makes a direct browser request to Apple for an iTunes audio preview. Apple may receive standard technical information sent with a web request, such as IP address, browser information, time and the requested file. Album artwork is also delivered from Apple image hosts.

Song titles, artist names, artwork and preview links are sourced through the Apple iTunes Search API. Their handling of request data is governed by Apple’s own policies. Songspot does not proxy these requests or use them to build user profiles.

Challenge links

A friend challenge places game information in the shared URL so another player can receive the same track and difficulty. Anyone who receives that link may be able to open it, so do not treat a challenge URL as confidential. The link does not contain your name, email address or the song title.

Contact messages

If you email Songspot, we receive the address and information you choose to include. We use it to respond, investigate an issue and maintain a reasonable support record. Do not send passwords, payment details or unrelated sensitive information.

Advertising, cookies and consent

Songspot loads one standard Adsterra banner after the game: 728×90 on wider screens or 320×50 on smaller screens. The banner loads automatically when its placement approaches the visible page. Songspot does not enable Adsterra Popunder, Social Bar, Smartlink, Native Banner or adult-ad formats. Advertising is separate from the analytics privacy choice.

Adsterra and its advertising partners may process standard request information such as your IP address, device and browser details, approximate location, referring page, ad impressions and interactions. They may use cookies or similar technologies to deliver, limit, measure or personalise advertising under their own policies. Read the Adsterra Privacy Policy for more information.

Analytics, session recordings and security logs

With your permission, Songspot uses Google Analytics 4 to measure basic page views and anonymous game events that help us evaluate the music catalog. Practice events may include an internal track ID, difficulty, clue length, cue position, interaction or playback source, result and preview-retry count; Daily 5 uses a generic track marker so the day's answer is not sent. Songspot never sends the text entered in the guess field, a song title, public nickname, leaderboard rank, session credential, name or email address through these events. Enhanced measurement is disabled. Songspot also uses Microsoft Clarity to produce heatmaps and privacy-masked session recordings that help identify confusing controls, playback problems and layout issues.

Clarity is configured to wait for consent before setting cookies, its advertising storage signal remains denied, and the project uses strict masking of all page text. The song-guess input is additionally marked for masking. Songspot does not load either analytics service until you select “Allow analytics & recordings” in the privacy choices panel.

You can reopen Privacy choices from the footer at any time and switch to essential-only use. Songspot then sends denied consent signals, asks Clarity to clear its cookies and removes accessible Google Analytics cookies before reloading without either analytics tag. Google and Microsoft may process technical information such as device and browser details, approximate location, referring page, pages viewed and interaction data under their own terms. Hosting and security providers may also process ordinary server logs to deliver the site, detect abuse and diagnose failures.

Retention, children and your choices

Browser preferences remain until you clear them. Daily 5 data follows the retention and deletion choices described above. Support messages may be retained while needed to respond, protect the service or resolve a rights concern. Songspot is a general-audience music game and is not directed to children under 13.

You may clear local data at any time, delete a leaderboard profile from the leaderboard page, or contact us to ask about information contained in a support message. Depending on where you live, you may have additional rights concerning access, correction or deletion.

Contact

Privacy questions and requests can be sent to privacy@songspot.org. General and music-rights contacts are listed on the Songspot contact page.