Privacy, in plain English

Your streams: for each one, when it started, how long you listened, the track, artist and album, the device name, the country, how it started and ended, and whether shuffle, offline or private mode was on. This is what your dashboard is built from.

Your account: your email address (to send sign-in links), passkeys if you add them, and your settings. If you sign in with Google we receive your name and email from Google; the tokens are stored encrypted.

A short audit log of sign-ins, sharing and visibility changes, so you can see who could see what and when. It never includes IP addresses.

Spotify's export includes the IP address you connected from for every single stream. depth.fm drops that field while it reads the file, before anything is written to the database. The same goes for your Spotify username and anything else in the export that isn't needed for a chart.

The file you upload is stored encrypted and deleted 24 hours after it's been processed (or 24 hours after a failed attempt). Sign-in rate limits use a hash of your IP address that expires within a day; the address itself is never stored.

Only you, by default. It stays that way unless you do one of these:

• create a share link (anyone with the link can see what you chose to share, until you revoke it);
• make your profile public (it appears at depth.fm/u/your-name and in search engines);
• turn on anonymous contribution, which adds your listening, without your name, to public artist and track pages.

You can hide any artist, track or album from what others see, or from your own dashboard too. Hidden items are removed before totals, ranks and percentages are worked out, so they can't be worked out from the numbers.

• Uploaded files: 24 hours after processing.
• Your streams and dashboard: until you delete them or your account.
• Guest dashboards (uploads without an account): 7 days.
• Reminder emails you asked for: the address is kept until the reminder is sent, then only the fact it was sent.
• Backups: nightly database backups are kept for 14 days, so deleted data is fully gone from backups within 14 days.

One cookie keeps you signed in. Your light or dark theme choice is saved in your browser, not sent to us. There are no analytics or advertising cookies today; if ads are added, you'll be asked first where the law requires it, and ads will never use your listening data.

From Settings you can download everything depth.fm holds about you as a file, and delete your account. Deletion removes your streams, dashboards, uploads, share links and cached pages within minutes, and from backups within 14 days.

You also have the right to ask what we hold, to correct it, and to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

depth.fm is an independent project run from the United Kingdom. It isn't affiliated with Spotify or any other music service. Uploaded files are held with Cloudflare R2; the site and database run on our own server; sign-in emails are sent through a transactional email provider. None of them receive your listening history for their own use.