Privacy Policy

Melodystats is run by PE Ishtvan Komonii, a sole proprietor (фізична особа-підприємець) registered in Ukraine for computer programming and related activities. That person is the controller of the personal data described here.

• Registered address: Petliury Street 4, apt. 210, Lviv 79054, Ukraine.
• Email: contact@melodystats.me

There is no data protection officer, and none is required: Melodystats does not monitor anyone on a large scale and does not set out to process special categories of data. Every data-protection question goes to the address above, and it reaches the person who wrote the code.

It covers the Melodystats site at melodystats.me and nothing else. It does not cover Spotify — your Spotify account is governed by Spotify’s own privacy policy — and it does not cover any other site you reach from a link here.

We do not ask you to agree to it. Reading a page is not consent and neither is continuing to browse. Most of what happens here runs on the connection you set up when you authorise Spotify: that is a contract you asked for, and Art. 6(1)(b) GDPR is its basis. Where consent really is the basis — today that is analytics, and nothing else — it is asked for separately, and you can take it back from “Cookie settings” in the footer of every page.

There is no signup form on this site. There is no account, no password, and no field anywhere that asks you to type a personal detail. Everything personal here arrived from Spotify because you authorised it.

There is one way in: you authorise Melodystats from your Spotify account. Spotify then issues a token carrying a fixed list of permissions. None of what follows is public data, and none of it is volunteered by you to us — Spotify is the source of every piece of personal data we hold.

Melodystats can read:

• your profile: display name, email address, country, subscription type, follower count and profile picture;
• your top artists and top tracks, over the three windows Spotify calculates (roughly the last four weeks, the last six months, and several years);
• your last 50 plays;
• what is playing right now, and on which device;
• your saved tracks — up to 2 000 of them — and your saved albums;
• the artists you follow;
• your playlists, including private ones.

It can also write to your Spotify account, in three narrow ways and only when you press something:

• Playback. Play, pause, next and previous, on a device you already have open. Nothing beyond those four.
• Liking a track. The heart on a track row saves or removes exactly the track you pressed. There is no bulk operation and nothing else in your library is touched.
• Creating a playlist. The playlist builder creates a new private playlist and adds the tracks you kept. It never edits, reorders or deletes a playlist that already existed.

Melodystats never writes to your Spotify profile.

From this data the site works out readings about you: genres, decades, an obscurity score, a listening personality, a colour palette taken from your album art. Listening history can imply things most people would call private — belief, politics, who they are. Those readings exist to draw your own page. They are shared with nobody, sold to nobody, and used for nothing else. What you choose to export or post is your decision, not ours.

You can see the grant and cancel it at any time at spotify.com/account/apps. The moment you do, Melodystats can no longer read anything.

No automated decision-making. Nothing here produces a legal effect or anything similarly significant about you. The readings are descriptions, not decisions, and no human or machine acts on them.

Nothing is required of you. Providing this data is neither a statutory nor a contractual obligation. It is simply what the site is made of: without the Spotify connection there is nothing to compute and nothing to show.

There is no database. Nothing about you is written to a disk, a backup, or a log of ours.

There is a cache, and it deserves describing exactly, because “we store nothing” would not be true. So that a second page does not re-fetch everything the first one did, what Spotify returns is held in the server process’s own memory. That memory is:

• keyed by a one-way SHA-256 fingerprint of your Spotify refresh token, truncated — the token itself is never stored, and cannot be recovered from the key;
• never shared between listeners: two people cannot land in the same namespace;
• capped at 200 entries in total across everyone using that server, with the least recently used dropped first;
• never written to disk, never backed up, never sent anywhere;
• gone when the server restarts, and every deployment restarts it.

How long each kind of entry lives:

One qualification, so the table is not read as tighter than it is: an entry that has just expired may be served once more while a fresh copy is fetched behind your page, for at most twice its own lifetime again. The outside limit for anything in that table is therefore three times the figure shown — three hours for the profile, ninety minutes for the top lists.

Your session is not held on our server at all. It lives in a cookie in your own browser, and logging out destroys it. See the next section.

Every item this site sets, what it is for, and whether you can say no. Nothing here is an advertising cookie, and none of it is shared with an advertising network.

ms_session is the one security-critical object here. It holds the tokens Spotify issued for your account, encrypted with AES-256-GCM under a key only the server has. It is marked httpOnly, so no script on the page can read it; SameSite=Lax, so another site cannot make your browser send it; and Secure, so it never travels over plain HTTP in production. Logging out destroys it, and revoking at spotify.com/account/apps makes what is inside it worthless.

The three preference cookies carry a setting and no identifier. The two browser-storage items never leave your browser at all.

Melodystats uses Google Analytics 4 — and only if you say yes.

• The Google tag is not in the page until you accept. Not loaded and held back, not loaded with a flag set: absent. If you have not answered, that counts as no.
• Accept and decline sit in the same row of the banner, one click each, at the same visual weight. There is no dismiss button, because dismissing is not consent, and the banner never blocks the page behind it.
• Your answer is kept in the ms_consent cookie for 182 days. After that the banner asks again rather than assuming the old answer still holds.
• Withdrawing is as easy as granting. Open “Cookie settings” in the footer of any page. Going from accepted to declined reloads the page, so nothing measured about that session carries on.
• When it does run, it is configured with anonymize_ip, and Google sets the _ga and _ga_<id> cookies listed above.
• Analytics runs on the live site only. It is never loaded in development.

Google Ireland Limited acts as the processor for visitors in the EEA and the UK, and the data reaches Google LLC in the United States. See the next section for how that transfer is made.

Each acts under its own written terms, as a processor or — for the image hosts — simply as the host of a file your browser asks for. None of them is given your data by us to use for its own purposes.

Nothing is sold. There is no advertising network here, no data broker, no affiliate tracking, and no profile is built for anybody but you. Personal data goes to anyone else only where the law requires it — a court order or a lawful request from a competent authority — and only as far as it requires.

Transfers out of the EEA and out of Ukraine. Vercel and Google are in the United States. For readers in the EEA and the UK that is a transfer under Arts. 44–49 GDPR, made on the EU–US Data Privacy Framework where the recipient is certified under it and on the European Commission’s Standard Contractual Clauses otherwise. Because the controller is established in Ukraine, the same transfers are made under Art. 29 of the Law of Ukraine “On Personal Data Protection”, on the ground that the transfer is necessary to perform the connection you asked for.

If you support Melodystats on Patreon and ask to be credited, your first name and the initial of your surname appear on the Patrons page — “Oleksandr K.” rather than a full name. That is done with your agreement, it is the whole of what is published, and it is used for nothing else.

Write to contact@melodystats.me and the credit comes off at the next deployment of the site. You do not have to give a reason.

Where the GDPR applies to you, all of the following are yours, and none of them costs anything:

• Access — a copy of the personal data held about you. This notice is most of that answer already: there is no database, so what exists is a cache entry that expires within the times in Where your data is held.
• Rectification — correction of anything wrong. Nearly everything here comes from Spotify, so the correction usually belongs in your Spotify profile; it flows through on the next fetch.
• Erasure — log out and revoke at spotify.com/account/apps. The session cookie is destroyed, the tokens stop working, and the cached entries expire on their own. Write to us if you want that confirmed.
• Restriction and objection — including objecting to the processing based on legitimate interests in Why, and on what legal basis.
• Portability — every feature page has an export control: CSV, XLSX or JSON of the data behind it. You do not have to ask us for it.
• Withdrawing consent — for analytics, at any moment, from “Cookie settings” in the footer. Withdrawal stops future measurement; it cannot unmake what was already measured, which is the one thing withdrawal never can.
• Not being subject to automated decision-making — there is none here to be subject to.

Write to contact@melodystats.me. You will have an answer within one month, and if a request turns out to be complicated you will be told so inside that month rather than after it.

Complaints. If you are in the EEA you may complain to the supervisory authority where you live, where you work, or where you think something went wrong. In Ukraine the authority is the Verkhovna Rada Commissioner for Human Rights. You are not required to write to us first, though it is usually faster.

• Sign-in is OAuth 2.0 with PKCE. No password ever reaches Melodystats, because Melodystats has no password.
• The session cookie is encrypted with AES-256-GCM under a key held only by the server, and is httpOnly, SameSite=Lax and Secure.
• Nothing about you is written to disk, so there is no database to breach and no backup to leak.
• The cache key is a one-way hash; your refresh token cannot be recovered from it, and the digest never leaves the server.

No system is perfectly secure and this notice will not pretend otherwise. If something goes wrong that puts your data at risk, we will say so — to you, and to the supervisory authority where the law requires it.

Melodystats is not directed at children. You need a Spotify account to use it at all, and Spotify sets its own minimum age for your country.

Where the GDPR applies, the age at which you can agree to an online service on your own account is 16, unless your country has lowered it — it may go no lower than 13. Below that age a parent or guardian has to agree for you.

There is no form here and no profile of our own, so there is no way for us to check anyone’s age. This is a rule rather than a gate. If you believe a child has connected Spotify to Melodystats, revoking the grant at spotify.com/account/apps stops it immediately — nothing further can be read, and the cached entries expire within the times in Where your data is held. Write to contact@melodystats.me if you want help doing it or confirmation that it is done.

Melodystats is operated from Ukraine, so the Law of Ukraine “On Personal Data Protection” (No. 2297-VI) applies to the controller — including its duties on the purposes of collection, on notifying you about transfers to third parties, on security, and on the grounds for sending data abroad.

The site is offered to readers in the EEA, in their own languages, so the GDPR applies in parallel to that processing under Art. 3(2)(a).

Where the two set different standards, Melodystats applies the higher one rather than choosing the more convenient. Complaints go to the Verkhovna Rada Commissioner for Human Rights in Ukraine, or to your own national supervisory authority in the EEA.

This notice carries one date, at the top of the page, and that is its version. There is no second, contradicting stamp.

• A correction that does not change what happens — a typo, a clearer sentence — takes effect when it is posted.
• A change to what is collected, why, or who receives it is announced on the site before it takes effect, and where the change needs your consent you will be asked again rather than told. Continuing to use Melodystats is not treated as agreement to a material change.

PE Ishtvan Komonii, Petliury Street 4, apt. 210, Lviv 79054, Ukraine.

contact@melodystats.me — for anything in this notice, including every right in Your rights. It reaches a person, not a queue.

The Terms and Conditions govern your use of the site itself.