Controller and contact
The controller for Tracklist.lol personal data is Bearsoft Group Ltd (company number 14774267), whose registered office is 20 Pinnacle House, 4 Schooner Road, London, E16 2RE, UK. For privacy questions or rights requests, contact mark@bearsoft.com.
This notice applies to the Tracklist.lol website, submit flow, chart pages, listener checks and related delivery services. It does not replace the privacy notice of a streaming service you choose to visit.
Information we collect
Listeners can use the public charts without creating an account or giving us their name, email address, telephone number or billing details. We nevertheless process limited pseudonymous and technical information to make likes, previews, security checks and functional preferences work. Depending on how you use the service, we may collect:
- artist submission and checkout details such as email address, billing address, name used for cardholder or payment verification, track title, artist name, release links, artwork, preview information and selected genre or sub-genre;
- analysis and matching results, including detected categories and provider identifiers;
- order and payment records such as currency, amount, rankpoints, payment status and Stripe references, but not the full card details handled by Stripe;
- public chart information such as rank, points, likes, artwork and listener engagement totals;
- listener state, including the opaque
tracklist_listenercookie, likes, preview events, service-click events and a saved streaming-service preference if you choose to keep one; and - technical, security and anti-abuse information such as browser/device request details, Turnstile verification results and short-lived rotating IP-derived rate-limit values.
If we introduce artist or listener accounts, we may also process an email address and/or federated sign-in identifier associated with the chosen provider. We do not intend to request protected attributes such as age, gender or other highly sensitive information for ordinary account use, and we will update this notice before introducing those features.
Why we use it
We use this information to receive and resolve submissions; analyse and categorise tracks; calculate rank and point fade; process payments; provide confirmations and support; deliver artwork, previews and provider links; remember functional preferences; measure service performance; prevent fraud, artificial engagement and abuse; train, validate, evaluate and improve internal music-classification models using permitted preview audio, selected categories and derived analysis; and comply with legal obligations.
Our usual legal bases are performance of a contract for submission and payment steps, legitimate interests for operating, improving and securing a fair public chart, and legal obligation for records such as payment and accounting information. The artist terms also describe the permission for classifier development. We use consent where an optional feature genuinely requires it, and will provide an appropriate choice or objection route where required for a secondary model-development use. Where we rely on legitimate interests, you may have the right to object.
What is public
A published listing may show its title, artist name, artwork, genre, sub-genre, rank, rankpoints, likes and links or link availability to other services. An artist's submission email, payment details and internal review information are not displayed in the public chart.
Please do not put personal contact details or information about another person into a title, artwork, description or other public metadata unless you are authorised to do so.
Providers and sharing
We share information with service providers that help us operate the product, including Cloudflare for Workers, Durable Objects, D1, R2, caching, delivery and Turnstile, and Stripe for payment processing. We may send limited track metadata to supported music-data providers when needed to search, resolve or match a release.
We may disclose information where necessary for support, security, fraud prevention, legal requests, payment disputes or a change in business ownership. We do not sell or license artist contact or payment information for unrelated advertising, and we do not use it to promise streaming-service placement. The separate content licence for classifier development is described in the terms.
International processing
Our providers and their infrastructure may process information in the UK, the European Economic Area, the United States and other countries. Where UK data-protection law requires protection for an international transfer, we will use an applicable adequacy decision, contractual safeguards or another lawful transfer mechanism.
The final notice should identify the material provider locations and transfer safeguards that apply to the launch configuration.
Retention and security
We keep each category of information only for as long as needed for the purpose collected, the listing and support history, security and abuse prevention, disputes, backups or legal and accounting obligations. Payment and accounting records may need to be retained for the period required by law. Public listing data may remain while a listing or its records are needed to operate the chart.
The tracklist_listener cookie currently has a maximum life of up to 12 months and can be cleared by the listener. Rotating rate-limit values and operational event receipts are designed to expire after short periods; aggregate chart and engagement data may be retained for service reporting and model improvement. If accounts are introduced, closing an account may remove or anonymise its direct identifiers while genuinely anonymised likes, preferences, chart aggregates and model statistics are retained where they can no longer reasonably be linked to a person. We use technical and organisational safeguards, but no online service can guarantee absolute security.
Cookies, storage and automated processing
We use essential cookies and browser storage to keep the listener identity and functional choices working. The listener identity is an opaque first-party identifier, not a browser fingerprint. The site may also use functional local storage for a preferred streaming service and currency choice. Optional analytics or marketing storage will not be introduced without the notice and consent controls required by law.
Music analysis can suggest a genre and sub-genre, and chart algorithms calculate rank and point fade. Turnstile and rate-limit checks help identify automated or abusive traffic. These processes are not intended to make decisions producing legal or similarly significant effects; artists can review and edit the chart category before payment. Contact us if you think a data or access decision is wrong.
Your rights and complaints
Where we process personal data, individuals may have rights to access it, correct it, request erasure or restriction, receive a portable copy, object to processing or withdraw consent where consent is the legal basis. The fact that we use data for a transaction, security, service-operation or model-development purpose does not automatically remove those rights. Erasure is not absolute: we may need to retain some data for tax or accounting obligations, fraud and abuse prevention, disputes, legal claims, backups or other applicable exemptions. We can usually continue using information that has been irreversibly anonymised, because it no longer relates to an identifiable person.
Contact mark@bearsoft.com to exercise a right or ask a privacy question. We may need to verify your identity and ask for enough information to locate the relevant record. We aim to respond to ordinary support queries within 7–10 working days; statutory rights requests are handled without undue delay and within the applicable legal deadline, normally one month.
If you are in the UK and remain unhappy, you can complain to the Information Commissioner's Office. We will publish material updates here and change the date above.