Privacy Policy

Effective September 8, 2026

Listenality turns your music library into analytics and readings about your taste. This page explains, in plain sentences, what we collect, what we do with it, and how to delete it.

Your account

In the mobile app, you sign in before connecting a music service. Sign-in is normally one tap through Apple or Google. From that we store your email address, and nothing else about your identity. We never receive a name, a profile photo, a phone number, or your Apple or Google password.

If you use Apple's Hide My Email, we only ever see the relay address Apple generates, never your real one. Some accounts have no email on file at all, and the app works the same either way. Email and password sign-in exists as a fallback; where it is used, we store your email and a hashed password, never the password itself.

What we collect

We only collect data from a music platform after you explicitly connect it in the app. We never see your platform password: connecting goes through that platform's own sign-in (Google for YouTube, Apple's MusicKit for Apple Music).

YouTube (via Google sign-in): your library and playlist metadata, track titles, artists, albums, the dates tracks were added, and artwork URLs. Listenality uses YouTube API Services to read this, so the Google Privacy Policy also applies to that data. You can revoke our access to your Google account at any time from the Google security settings page, as well as by disconnecting YouTube in the app.

Apple Music (via MusicKit): the same library and playlist metadata, plus device play counts and periodically polled recently-played tracks for play tracking.

Spotify (invite only, a small number of beta seats): the same library metadata, plus the playlists you own, and recently-played tracks polled periodically for play tracking. Playlists you follow but did not create are not read. Spotify is not offered on the public App Store release.

History files you upload

You can optionally upload a history export you requested yourself, a Google Takeout archive or an Apple privacy export, to import your listening history. We parse the file on our server, keep only the music rows (play timestamps, track titles, artists, albums, and library add dates), and delete the uploaded file itself as soon as parsing finishes, whether the import succeeds or fails. The archive is never stored, never shared, and never sent to an LLM. Every import shows you a receipt of exactly what was kept and what was excluded. Non-music rows in the archive (regular videos, searches, anything that is not a music play) are discarded unread beyond the check that classifies them.

What we derive

From that library metadata we compute analytics (taste profile, genre and mood breakdowns, listening comparisons) and short LLM-generated readings (an identity blurb, roasts, and other insights about your taste). These are generated from track metadata, titles, artists, genres, never from your account credentials.

These requests go out through OpenRouter, a routing service that hands each one to a model provider. The providers we use are Google, OpenAI, and Anthropic. We keep testing models and moving each feature to whichever one reads best, so we do not tie a named provider to a named feature here: assume any of the three can handle any reading. If we add or drop a provider, we change this list. In every case they receive only the track and library metadata needed for the requested result, never your credentials, never your platform tokens, and never your uploaded archive.

The anonymous global enrichment cache

Many facts an LLM derives about a track, its mood, genre, production era, are true for everyone who has that track, not just you. So once we analyze a track, we cache that result globally, keyed by the track itself (its ISRC or a title/artist match key), not by you or your account. Your library tells us which cached tracks to show you; it does not get attached to the cache entry itself, and deleting your account never touches it.

Usage analytics

We log specific product events, such as onboarding progress, opening an analytics section, starting a share, and viewing or tapping a premium preview. These are tied to your account so we can see what is working, and are deleted if you delete your account.

Your time zone

The app reports your device's time zone, the region name your phone already uses ("America/Toronto"), so your weekly recap is composed on your Friday rather than a server's. It is sent only when it changes, and it is not your location: it is the same value for everyone in your zone and says nothing about where you are in it.

Crash and error reports

When the app hits an error or crashes, it sends a report to Sentry, a third-party error-tracking service, so we can find and fix the problem without waiting for someone to describe it to us. A report contains the error and where in our code it happened, your app version, your device model and OS version, and your account number. It does not contain your music library, your listening history, or anything we derived from them.

These reports are separate from the product events above and are not stored in our database, so deleting your account does not remove them. Sentry deletes them on its own schedule instead, within 30 days of the error.

How we protect your data

The most sensitive things we hold are the access tokens a music platform gives us when you connect it, because a token is what lets us read your library on your behalf. We encrypt those tokens at rest with AES-256-GCM before they are written to the database, with a key that lives only in the server's environment, never in the database or the code. A copy of the database on its own does not reveal a usable token.

Everything moves over HTTPS: between the app and our server, between our server and the music platforms, and between our server and the AI processors named above. Where email and password sign-in is used, the password is hashed with bcrypt and the original is never stored.

Every request to our API carries a short-lived signed token that names one account, and every read and write is scoped to that account. The only way another person sees any of your data is a share card or a comparison you created and sent them yourself, and the only cross-user store is the anonymous enrichment cache described above, which holds no user data at all. Sessions can be ended: each refresh token is recorded individually and revoked on sign-out, so a session that is over cannot be reopened. Web session cookies are httpOnly and secure, so page scripts cannot read them and they never travel unencrypted.

Access to the production database and its host is limited to the people who run Listenality, through the hosting provider's own authenticated console. We do not ship your data to analytics or advertising networks, and we do not sell it.

Where your data lives, and for how long

Your account data is stored in our database hosted by Railway. We do not sell it. We share data only with the connected music services you ask us to use, the AI processors named above, and Sentry for the crash reports described above. Data stays scoped to your account; the only shared store is the anonymous global enrichment cache described above.

We keep account data while your account is active. YouTube-authorized data is refreshed at least every 30 days and deleted if you disconnect YouTube or its authorization expires. All account-scoped data is deleted when you delete your account.

Deleting your account

In the app, open Settings and tap Delete account. Deletion is immediate and permanent: your account and everything scoped to it, library, playlists, listening history, cached reads, usage events, is deleted right away. It cannot be undone. The one thing it does not reach is the crash reports described above, which live with Sentry rather than in our database and expire on their own within 30 days.

Questions

Email privacy@listenality.com.