Privacy Policy

Overview

SetAtlas is a music discovery service. Browsing requires no registration and collects no personal information directly. An optional account lets you save favourites; the account section below describes exactly what that stores. SetAtlas does not sell data to third parties. This policy explains what data is processed when you use the service and by whom.

Accounts

If you create an account, SetAtlas stores: your email address, your password (as a secure hash — the actual password is never stored or visible to anyone), your chosen display name, your favourited sets, and your active login sessions. The legal basis for this processing is the performance of a contract: the data is what an account functionally requires, nothing more.

Deliberately not stored: IP addresses, device identifiers, or browser details are never saved to account records or login sessions. Login sessions expire after 30 days and expired session records are deleted automatically. Verification emails are sent only for account operations (email confirmation, password reset) — there are no marketing emails.

You can download all data tied to your account or delete the account permanently at any time from your own DJ page (visible there only to you). Deletion is immediate and removes the account, uploaded sets and their audio files, comments, sessions, and favourites.

Comments you post on set pages are public and are stored with your account, DJ name, profile link, and posting time. They are included in your data export and removed when you delete your account. Comment authors can remove their own comments, and set owners can remove comments from their set pages.

Data collection

SetAtlas itself collects no personally identifiable information. Vercel's analytics services are used to measure aggregate page traffic and website performance. They do not use cookies, fingerprint individual users, store IP addresses, or reconstruct browsing sessions. All collected analytics data is anonymous.

Server logs generated by the hosting providers (Vercel for the website, Railway for the API backend) may temporarily retain standard HTTP request metadata such as IP addresses and user agent strings. These are retained for a short period for security and diagnostic purposes and are not used for tracking.

Third-party services

When you play a DJ set, the audio is streamed through Mixcloud's embedded player. Loading the Mixcloud player may cause your browser to send requests to Mixcloud's servers. Mixcloud's own privacy policy governs any data collected during playback.

Map imagery is served directly from NASA's Global Imagery Browse Services (GIBS) in the United States. When the map loads, your browser requests tiles from NASA's servers. NASA may temporarily process standard request metadata, including your IP address, browser and operating-system information, request time, requested tile URLs, and referring site, for service management and security. This involves transferring technical request data to the United States. SetAtlas does not send account information to NASA or use these requests to track you. NASA's Web Privacy Policy governs NASA's processing.

Account-related emails (verification, password reset) are delivered by Resend, processed in their EU (Ireland) region. The login and signup forms are protected by Cloudflare Turnstile, which processes standard request data (including IP address) transiently to distinguish humans from bots; SetAtlas never receives or stores that data.

Cookies and local storage

When you log in, SetAtlas sets a single strictly necessary session cookie that keeps you logged in. It contains only a random session identifier, is never used for tracking, and is removed when you log out or the session expires. Because it is strictly necessary for a feature you explicitly requested, no cookie consent banner is required. SetAtlas sets no other first-party cookies and no tracking cookies of any kind.

The Mixcloud embedded player may set its own cookies when you interact with it. You can manage or block cookies through your browser settings; doing so may affect playback or login functionality.

Your rights

If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR) including the right to access, rectify, erase, and port personal data held about you. For account holders, the two most important rights are self-serve: your own DJ page lets you export all stored data as JSON and delete your account permanently at any time, without asking anyone. For anything else, contact ville@setatlas.app.

Changes to this policy

SetAtlas reserves the right to change this policy. The effective date at the top of this page reflects when it was last updated.