Privacy Policy

1. Who this policy is for

Mubrary is intended for use by, and directed at, residents of the United States. We design and operate the Service to comply with U.S. law, and this Privacy Policy is written with U.S. law and U.S. users in mind. We do not direct or specifically target the Service to users in any other country — including the European Union, United Kingdom, Canada, or Australia — even though the Service may be technically accessible there. If you access Mubrary from outside the United States, you're welcome to use it, but you do so on that basis.

2. What we collect

• Account info: email address, username, display name, full name, date of birth, gender, and bio.
• Profile media: avatar and banner images you upload.
• Profile link: if you add a Spotify profile link, it is shown publicly on your profile.
• Activity: song ratings, rating history, the genres you pick during onboarding, posts (including any photo or video you attach), comments, likes, follows, blocks, polls you create or vote in, and the badges you earn.
• Private messages: direct messages and group chat messages you send, including any post you choose to share via message.
• Reports: reports you submit, and reports made about you or your content.
• Presence: a timestamp of when you were last active, used to show an "online"/"last seen" status. This is only ever shown to accounts you mutually follow — it is not visible on your public profile or to anyone else.
• Consent records: the date and version of the Terms of Service and Privacy Policy you accepted.
• Technical data our infrastructure providers (Supabase, Vercel) log automatically, like IP address and browser type, for security and abuse prevention. We also store your IP address (and your account ID when you are logged in) in counters we use to limit abusive request rates; these counters are deleted within 24 hours.

Date of birth is collected only to confirm you meet the minimum age requirement. Neither date of birth nor gender is shown on your public profile or to other users. We never invent or infer sensitive data (health, political views, etc.). We don't collect payment information — Mubrary has no paid features yet.

Photos you attach to a post are automatically re-processed on upload to strip embedded metadata (including any GPS location a camera or phone may have recorded) before they're stored — the same protection your avatar/banner already had as a side effect of the crop tool. This doesn't currently apply to video or GIF attachments; avoid attaching a video or GIF if it may contain location metadata you don't want shared.

3. How we use it

• To operate the Service: show your profile, feed, and ratings to the right people.
• To recommend albums based on the genres you picked and who you follow.
• To enforce blocks and handle reports for moderation.
• To secure the account and prevent abuse.

Private messages are stored on our servers and are not end-to-end encrypted. We do not monitor or browse them. Within Mubrary, access is limited to the site operator, and only when necessary to investigate reported or suspected abuse, enforce our Terms, or respond to legal process.

Your rating history (every change to a song rating) is stored but never shown to you or anyone else — it exists only for potential future statistics features.

4. Who we share it with

We use third-party infrastructure to run the Service: Supabase (database, authentication, storage), Vercel (hosting), and Resend (delivering account emails like signup confirmation and password reset — this means your email address, and the content of those emails, passes through Resend's systems). We do not sell your data. Album search queries may be sent to the public MusicBrainz API, but this only sends the album/artist name you search for — not your identity.

When you view album pages and news items, your browser loads cover art directly from the Cover Art Archive (Internet Archive) and thumbnails from the news publishers we link to (Pitchfork, NME, Consequence, Billboard, Stereogum and Rolling Stone). Those services can see your IP address and browser information, as with any site you visit. We do not send them your account information.

We may disclose information if we believe it is required by law or legal process (for example a subpoena or court order), or is necessary to protect the rights, safety or property of Mubrary, our users or others.

5. Cookies and tracking

We use a small number of cookies, all strictly functional: authentication cookies that keep you logged in (set by our authentication provider, Supabase) and one cookie that remembers your light/dark theme choice. We also keep a few display preferences, such as your Top 100 genre filter, in your browser's local storage. We do not use tracking, analytics, or advertising cookies.

We do not track you across other websites and do not use third-party advertising or analytics trackers, so we do not respond differently to "Do Not Track" signals.

6. Your rights

You can access, correct, or delete your personal data at any time — see below and Data Retention further down.

You can delete your account and all associated data — ratings, posts, comments, messages, follows — at any time from Settings. This action cannot be undone, and removes your data from our production database immediately. A copy may remain in our automated backups for up to 7 days before being purged — see Data Retention below.

Deleting individual pieces of content without deleting your whole account works differently depending on the content type — see Data Retention below.

To request a copy of your data or ask a privacy question, contact us at aybarsmv@gmail.com.

7. Children's privacy

Mubrary is not directed at children under 13, and we do not knowingly collect data from them (COPPA). Signup requires confirming you are 13 or older. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

8. Data retention

We keep your data for as long as your account is active. Deleting your entire account removes your personal data and content — including messages you sent — from our production database immediately; a copy may persist in our automated daily backups for up to 7 days before being fully purged.

Deleting individual pieces of content while keeping your account works differently depending on the type:

• Posts are deleted immediately and permanently, along with their comments and likes.
• Comments are hidden immediately (their text is removed from display), but the underlying record is retained — to preserve the surrounding conversation for other users — until you delete your account.
• Removing a rating deletes it along with your full rating history for that song. Editing a rating's score, by contrast, keeps a silent record of past scores for as long as your account exists, so we can potentially build features like a yearly recap in the future; this history is never shown to you or anyone else.

9. Changes to this policy

We may update this policy from time to time and will post the new version here.

10. Contact

Privacy questions: aybarsmv@gmail.com