Privacy Policy

UnderRhythm ("we", "us", "the site") is a non-commercial fan project — a player for fan-made music and cover art. We collect as little personal data as technically possible, and this page describes all of it: what is stored, why, for how long, and how you stay in control of it at all times.

1. The short version

• Without an account, nothing about you is stored on our server at all.
• With an account, we store only what you give us at registration: a username, an email address, a password hash, plus your liked tracks and an optional profile picture.
• There are no ads, no analytics, no trackers, no data sales — nothing of that kind, ever.
• You can delete your account and every piece of data attached to it yourself, at any moment, from your profile — no need to write to anyone or wait for a reply.

2. Data we store — and why

Everything below exists solely so that the account system can work:

• Username — shown in the menu and used to log in.
• Email address — used exactly three ways: to confirm your registration, to send a password-reset link if you request one, and never for anything else. We do not send newsletters or promotions.
• Password hash — your password is run through bcrypt, a one-way hashing algorithm, before it is stored. The actual password never touches our database, and we could not read it even if we wanted to.
• Liked tracks — the list of tracks you've liked while logged in, with timestamps, so your likes follow you across devices.
• Profile picture — only if you choose to upload one; you can replace or remove it whenever you like.
• Session cookie — see section 3.

3. Cookies

UnderRhythm sets exactly one cookie, and only after you log in. It contains a single random identifier that keeps you signed in between visits; it holds no personal information, and it is marked HttpOnly so page scripts cannot read it. It is a strictly functional cookie — we use no advertising, analytics, or third-party cookies of any kind. Logging out deletes it.

4. Local storage on your device

Player preferences — volume, the last track you listened to, and (for guests) liked tracks — are kept in your browser's own localStorage. This data stays on your device; it is never transmitted to our server and we cannot see it. When you first log into an account, likes you made as a guest are moved into the account so they aren't lost.

5. Third-party services

• Google Fonts — pages load webfonts from fonts.googleapis.com / fonts.gstatic.com. Like any request to any web server, this reveals your IP address to Google. See Google's privacy policy.
• "Join the project" — this menu item opens a Google Forms page. Anything you enter there is processed by Google Forms under Google's own terms; the form is entirely optional.
• Email delivery — confirmation and password-reset emails are handed to a transactional email provider strictly for delivery of that one message.

No other third parties are involved. Your data is never sold, rented, shared, or used to build any kind of profile.

6. Retention and deletion

Account data is kept only while the account exists. Open your profile and choose Delete account — after confirming with your password, your username, email address, password hash, liked tracks, and profile picture are erased from the database immediately and permanently. There is no grace period, no soft-delete, and no backup restore of deleted accounts; the deletion is done entirely by you, with no contact with us required.

7. Security

Passwords are stored only as bcrypt hashes, sessions use random identifiers in HttpOnly cookies, login and registration attempts are rate-limited, and in production the site is served exclusively over HTTPS.

8. Children

UnderRhythm is not directed at children. Do not register if you are not old enough to agree to these terms on your own under the law of your country.

9. Changes to this policy

If our data practices ever change, this page will be updated and the date at the top revised before the change takes effect. Since the site stores so little, we expect changes to be rare.