Privacy Policy

Overview

SetAtlas is a music discovery service. Browsing requires no registration, and optional analytics runs only with your permission. Hosting and security providers still process limited technical request data needed to deliver and protect the service, as described below. An optional account lets you save favourites and publish native sets. SetAtlas does not sell data to third parties.

Accounts

If you create an account, SetAtlas stores: your email address, your password (as a secure hash, the actual password is never stored or visible to anyone), your chosen display name, profile information you provide, your favourited sets, your uploaded-set metadata and media, and your active login sessions. This information is processed because it is necessary to create your account, keep you signed in, save your favourites, and publish your uploads.

SetAtlas does not store in account records or login sessions: IP addresses, device identifiers, and browser details. Login sessions expire after 30 days and expired session records are deleted automatically. Verification emails are sent only for account operations (email confirmation and password reset); there are no marketing emails.

You can download all data tied to your account or delete the account permanently at any time from your own DJ page. Database deletion is immediate and removes the account, uploaded sets, comments, sessions, and favourites. Associated storage objects are also submitted for deletion immediately.

Comments you post on set pages are public and are stored with your account, DJ name, profile link, and posting time. They are included in your data export and removed when you delete your account. Comment authors can remove their own comments, and set owners can remove comments from their set pages.

Data collection

With your consent, Google Analytics measures page visits, city selections, playback starts and successful account creation. It uses cookie identifiers to distinguish browsers and visits, and processes technical information such as browser, device and approximate location. We do not send account IDs, email addresses, display names, comments or search text as event properties. Analytics URLs exclude query strings and fragments, and DJ profile and set paths are grouped to omit names. Advertising personalization and Google Signals are disabled in our integration.

With the same consent, Google Analytics receives Core Web Vitals measurements of loading speed, responsiveness and layout stability, with technical browser and sanitized page context. Measurement starts after acceptance and may use performance timings already buffered by your browser for the current page load. Both traffic and performance measurement remain off until you accept analytics. Rejecting does not prevent browsing, listening or account use.

Google may process analytics information outside the European Economic Area, including in the United States. Read how Google uses information. Analytics is separate from account records and is not included in your account export.

You can change or withdraw your consent at any time in analytics settings. Withdrawal stops future collection and removes this site's Google Analytics cookies; it reloads the page and stops current playback. It does not automatically erase previously collected data.

Companies that help host and protect SetAtlas may temporarily process standard request information, including IP address, requested page, time, browser information, response status, and security action. SetAtlas also uses IP addresses briefly to enforce rate limits. This information is needed to prevent abuse, diagnose failures, and keep the service available. It is not added to account records, used for tracking, or sent to a profiling service. Logs are kept only for short operational and security periods. Some providers may process this information in the European Union or United States under appropriate data-protection safeguards.

Third-party services

Native-set audio, cover artwork, and profile pictures are stored and processed by SetAtlas's infrastructure providers. Temporary processing files are deleted after the job. A failed set may retain its original for retry and debugging until you delete the set or account. Published audio, cover artwork, and profile pictures are intentionally publicly accessible through SetAtlas, while original-upload URLs are not published.

When you play a DJ set, the audio is streamed through Mixcloud's embedded player. Loading the Mixcloud player may cause your browser to send requests to Mixcloud's servers. Mixcloud's own privacy policy governs any data collected during playback.

Map imagery is served directly from NASA's Global Imagery Browse Services (GIBS) in the United States. When the map loads, your browser requests tiles from NASA's servers. NASA may temporarily process standard request metadata, including your IP address, browser and operating-system information, request time, requested tile URLs, and referring site, for service management and security. This involves transferring technical request data to the United States. SetAtlas does not send account information to NASA or use these requests to track you. NASA's Web Privacy Policy governs NASA's processing.

Account-related emails (verification and password reset) are handled by a transactional email provider. Login and signup forms use an automated abuse-prevention provider, which processes standard request data (including IP address) transiently to distinguish humans from bots. The result is used only to accept or reject the protected request and is not added to an account profile.

Cookies and local storage

When you log in, SetAtlas sets a single strictly necessary session cookie that keeps you logged in. It contains only a random session identifier, is never used for tracking, and is removed when you log out or the session expires. SetAtlas's security provider may set strictly necessary security cookies when it challenges suspicious traffic or needs to distinguish clients for abuse prevention. These cookies are not used for advertising or cross-site tracking.

Your analytics choice is saved in local storage on this browser, so both acceptance and rejection are remembered. We ask again if no saved choice is available, for example after clearing storage or using a different browser. If tracking materially changes, a new choice may be requested. After acceptance, Google Analytics may set _ga cookies, configured with a maximum lifetime of 180 days without extending that lifetime on each visit. Necessary storage is independent of optional analytics consent.

The Mixcloud embedded player may set its own cookies when you interact with it. You can manage or block cookies through your browser settings; doing so may affect playback or login functionality.

Your rights

If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR) including the right to access, rectify, erase, and port personal data held about you. For account holders, the two most important rights are self-serve: your own DJ page lets you download your account data as JSON and delete your account permanently at any time, without asking anyone. For anything else, contact ville@setatlas.app.

Changes to this policy

SetAtlas reserves the right to change this policy. The effective date at the top of this page reflects when it was last updated.