Privacy
Not much, and none of it is sold.
There are no cookies on this site and no third-party tracker — no Google Analytics, no advertising pixel, nothing from Meta or TikTok. That is why you have never been asked to accept anything here. I did not switch a banner off to be clever; there is simply nothing to ask you about.
I do count things, because I would like to know whether the songs are working. But it is counting rather than watching. I can see that forty people opened a page and six of them finished a song. I cannot see who any of them were, and neither can anybody else.
A random value, made in your browser, that identifies the tab you have open — not you. It exists so one person reading four pages is not counted as four people. It lives in sessionStorage, which means closing the tab forgets it. It is sent nowhere except alongside the count it qualifies, it is not a cookie, and it means nothing outside this site.
There is one other, and it is only ever mine: if I have signed into the admin page, that token sits in the same place until the tab closes.
Deleted after 90 days
The path, the site you arrived from, your country, and a random value that identifies the browser tab. Not the query string — campaign tags and anything accidentally pasted into a link are thrown away before the row is written. Not the full referring address either, only the host: instagram.com, never the page you were on.
Kept while the song is on the site
Which song, and whether the play passed thirty seconds and reached the end. I want to know whether songs hold people, and this is the only place I can see that before a record is out. The same per-tab value is attached so that replaying a song four times does not read as four different listeners.
Until you ask me to remove it, or I do
What you wrote, the name you chose if you gave one, and your country. No email and no account. Your IP address is turned into a salted hash used only to stop one person flooding the page — it is one-way and cannot be turned back into an address.
Last 100 messages · daily totals for 30 days
The chat is anonymous — no account, no email, and the name you appear under is assigned rather than chosen. The last 100 messages stay so the room is not empty when someone walks in. Your connection's country goes into a daily total, so I can tell which timezones the room should run for; it is never attached to a message or to you.
Until you unsubscribe
Your email address, your name if you gave one, and the exact sentence you agreed to — stored as the words themselves rather than a tick, because a yes in a database proves nothing later. Nobody else gets the list. I do not sell it, share it, or send it anywhere else.
Cloudflare attaches a two-letter country code to each request before it reaches me. I keep that code and nothing narrower: no city, no region, and no IP address stored. It tells me the album is being played in six countries. It does not tell me where anybody lives. If you use a VPN it reports wherever your VPN comes out, and I have no way of telling the difference — which is worth knowing in both directions.
Three of them, and two only in one place each. I would rather list them than pretend the site is an island.
Everywhere
Hosts the site and the database. Your request reaches them before it reaches anything of mine, so they see your IP address in order to deliver the page to you. I do not store it.
One Song only
When One Song hands you a recommendation, the artwork and the short preview clip come from Spotify, so your browser loads them from their servers. I send them the artist and title I am looking up — never anything about you.
The live room only
If someone posts a GIF in the live chat, the image loads from GIPHY. Searching for one passes your search words to them through my server. Nothing else goes with it.
Ask what I hold about you, ask me to delete it, or ask me to correct it, and I will. In practice the only things tied to a person are a mailing list entry and any comment you put a name on — the rest genuinely cannot be traced back to you, which also means I cannot pick it out to delete it. Every mailing list email carries an unsubscribe link, and that is instant and needs no explanation.
Email [email protected]. If you are in the UK and think I have handled something badly, you can complain to the Information Commissioner's Office at ico.org.uk.
Nothing here is aimed at children and the mailing list is not for under-13s. If a child has signed up, tell me and I will take it out.
If I change what the site records, I change this page with it. A privacy page that has drifted from the truth is worse than not having one at all.
How the music gets paid for is a different question, and it has its own page.