Privacy Policy
Effective October 4, 2026
Listenality turns your music library into analytics and readings about your taste. This page explains, in plain sentences, what we collect, what we do with it, and how to delete it.
Your account
In the mobile app, you sign in before connecting a music service. Sign-in is normally one tap through Apple or Google. When your provider supplies them, we store your first and last name alongside your email address so your own cards and friend comparisons can name you correctly. We never receive a profile photo, a phone number, or your Apple or Google password.
If you use Apple's Hide My Email, we only ever see the relay address Apple generates, never your real one. Some accounts have no email on file at all, and the app works the same either way. Email and password sign-in exists as a fallback; where it is used, we store your email and a hashed password, never the password itself.
What we collect
We only collect data from a music platform after you explicitly connect it in the app. We never see your platform password: connecting goes through that platform's own sign-in (Google for YouTube, Apple's MusicKit for Apple Music).
YouTube (via Google sign-in): your library and playlist metadata, track titles, artists, albums, the dates tracks were added, and artwork URLs. Listenality uses YouTube API Services to read this, so the Google Privacy Policy also applies to that data. You can revoke our access to your Google account at any time from the Google security settings page, as well as by disconnecting YouTube in the app.
Apple Music (via MusicKit): the same library and playlist metadata, plus device play counts and periodically polled recently-played tracks for play tracking.
Spotify (invite only, a small number of beta seats): the same library metadata, plus the playlists you own, and recently-played tracks polled periodically for play tracking. Playlists you follow but did not create are not read. Spotify is not offered on the public App Store release.
History files you upload
You can optionally upload a history export you requested yourself, a Google Takeout archive or an Apple privacy export, to import your listening history. We parse the file on our server, keep only the music rows (play timestamps, track titles, artists, albums, and library add dates), and delete the uploaded file itself as soon as parsing finishes, whether the import succeeds or fails. The archive is never stored, never shared, and never sent to an LLM. Every import shows you a receipt of exactly what was kept and what was excluded. Non-music rows in the archive (regular videos, searches, anything that is not a music play) are discarded unread beyond the check that classifies them.
What we derive
From that library metadata we compute analytics (taste profile, genre and mood breakdowns, listening comparisons) and short LLM-generated readings (an identity blurb, roasts, and other insights about your taste). These are generated from track metadata, titles, artists, genres, never from your account credentials.
These requests go out through OpenRouter, a routing service that hands each one to a model provider. The providers we use are Google, OpenAI, and Anthropic. We keep testing models and moving each feature to whichever one reads best, so we do not tie a named provider to a named feature here: assume any of the three can handle any reading. If we add or drop a provider, we change this list. In every case they receive only the track and library metadata needed for the requested result, never your credentials, never your platform tokens, and never your uploaded archive.
The anonymous global enrichment cache
Many facts an LLM derives about a track, its mood, genre, production era, are true for everyone who has that track, not just you. So once we analyze a track, we cache that result globally, keyed by the track itself (its ISRC or a title/artist match key), not by you or your account. Your library tells us which cached tracks to show you; it does not get attached to the cache entry itself, and deleting your account never touches it.
Usage analytics
We record specific product events: when you open the app, the screens you open, opening a recap and reaching its last page, sharing a card and whether the share went through, onboarding steps and your answers to its questions, connecting a music service, the Plus offers you see, purchases and their outcome, trials starting and ending, and notifications sent and opened. Each event carries a small fixed set of details, such as a recap number or a card type. Events never contain your music library, track titles, listening history, generated readings, name or email address.
We send these events to PostHog, a product analytics service, so we can see what is working. Events are tied to your account number. With each event, PostHog also receives the app version, your device's operating system and model, its language and time zone settings, an app session identifier, a random identifier for this installation of the app, which music service you connected first, and whether your account had Plus, a trial or neither when the event reached our server. PostHog keeps a profile for your account number with the app version and device details from your events. Events from the app pass through our server first, which removes anything not on this list. We do not send your IP address, and PostHog does not look up a location. PostHog stores this data in the United States. We also keep our own record of these events in our database.
When you delete your account, our own record of these events is deleted right away. We then ask PostHog to delete your profile and every event tied to your account number. We first wait a few minutes, so that events already on their way arrive and are deleted too. PostHog completes deletions in the background and does not publish a fixed time for them. We check PostHog until it shows no events and no profile left for your account number, and we delete again anything that arrives late. If a deletion is still not complete after 30 days, we are alerted and follow it up.
Compare invites
We record when invite links are opened and whether people reach a comparison. These events include an invite identifier and information about the step taken, such as opening the invite or recovering it after installation.
The invite page stores a random identifier in your browser. The app can store a separate random identifier for its installation. The identifiers do not contain your name, email address or music data. They help us distinguish browsers and installations when measuring the invitation journey. After sign-in, app events are associated with your account. Account-associated events are deleted when you delete your account.
When you tap the button on an invite page, the page attempts to copy the invite link. On first launch after installation, the app may ask to read copied text or a URL to look for a Listenality invite. If it finds one, it saves the invite identifier so you can continue after sign-in and setup. Unrelated clipboard content is ignored and is not saved or sent to our servers by this check.
The automatic check runs once per installation. If recovery does not work, you can choose to paste an invite link in Compare later.
Feedback you send
If you use Send feedback in the app, we receive the message, the reply email address you enter, your account number, app version, device description, and whether Plus is active. The message is delivered to our support inbox and a copy is sent to Sentry so we can investigate it with the same error context used for crash reports. Do not include passwords, music-service tokens, or other sensitive information in a feedback message.
Purchases
Apple processes payment for Listenality Plus. We use RevenueCat to connect the App Store purchase to your Listenality account and keep access in sync. RevenueCat receives a random billing identifier created for your account, the product and transaction information Apple returns, subscription status, and the app and device information needed to operate the purchase service. We do not send RevenueCat your email address, music library, listening history, or generated readings.
Your time zone
The app reports your device's time zone, the region name your phone already uses ("America/Toronto"), so your weekly recap is composed on your Friday rather than a server's. It is sent only when it changes, and it is not your location: it is the same value for everyone in your zone and says nothing about where you are in it.
Crash reports and performance
When the app or our server hits an error or crashes, it sends a report to Sentry, a third-party error-tracking service, so we can find and fix the problem without waiting for someone to describe it to us. A report contains the error and where in our code it happened, your app version, your device model and OS version, and your account number. It does not contain your music library, your listening history, or anything we derived from them.
For a sample of app sessions and server requests, Sentry also receives performance timings: how long a screen took to appear and to show its content, and how long requests and database queries took. Timings name the screen and the kind of request (for example, "GET /api/recap/[id]"), never the values in it, and can carry your app version, device model and account number. Sentry stores this data in the United States.
These reports and timings are separate from the product events above and are not stored in our database, so deleting your account does not remove them. Sentry deletes them on its own schedule instead; a crash report is deleted within 30 days of the error.
How we protect your data
The most sensitive things we hold are the access tokens a music platform gives us when you connect it, because a token is what lets us read your library on your behalf. We encrypt those tokens at rest with AES-256-GCM before they are written to the database, with a key that lives only in the server's environment, never in the database or the code. A copy of the database on its own does not reveal a usable token.
Everything moves over HTTPS: between the app and our server, between our server and the music platforms, and between our server and the AI processors named above. Where email and password sign-in is used, the password is hashed with bcrypt and the original is never stored.
Every request to our API carries a short-lived signed token that names one account, and every read and write is scoped to that account. The only way another person sees any of your data is a share card or a comparison you created and sent them yourself, and the only cross-user store is the anonymous enrichment cache described above, which holds no user data at all. Sessions can be ended: each refresh token is recorded individually and revoked on sign-out, so a session that is over cannot be reopened. Web session cookies are httpOnly and secure, so page scripts cannot read them and they never travel unencrypted.
Access to the production database and its host is limited to the people who run Listenality, through the hosting provider's own authenticated console. We send product events to PostHog and crash reports and timings to Sentry, as described above. We send nothing to advertising networks, and we do not sell your data.
Where your data lives, and for how long
Your account data is stored in our database hosted by Railway. We do not sell it. We share data only with the connected music services you ask us to use, RevenueCat for purchases, the AI processors named above, PostHog for the product events described above, and Sentry for the crash reports and performance timings described above. Data stays scoped to your account; the only shared store is the anonymous global enrichment cache described above.
We keep account data while your account is active. YouTube-authorized data is refreshed at least every 30 days and deleted if you disconnect YouTube or its authorization expires. Deleting your account removes your account data from our database. The section on deleting your account explains how we ask RevenueCat and PostHog to delete their copies, and how Sentry reports, timings and feedback copies expire.
Deleting your account
In the app, open Settings and tap Delete account. Deletion is immediate and permanent: your account and everything scoped to it, library, playlists, listening history, cached reads, usage events, is deleted from our database right away. It cannot be undone. We also ask RevenueCat to delete the billing customer record tied to the account, and PostHog to delete your product events and profile, as described in Usage analytics. Deleting the account does not cancel an App Store subscription, which you manage separately with Apple. The deletion exceptions are the crash reports and performance timings described above, and the Sentry copy of any feedback you sent, which live with Sentry rather than in our database and expire on Sentry's own schedule.
Questions
Email privacy@listenality.com.