Privacy notice

Draft of 6 November 2026 (updated: personal links)

The short version

Your Spotify file is read on your own device. It is never uploaded to us.
From it we only use songs: names, artists, song IDs, and roughly when and how you played them. We never use your Spotify username, IP addresses, devices or country, even though the file contains them.
If you sign in, we keep your email address (encrypted), a display name, your timeline (to the month, never the day), your memories and who your friends are.
Anyone you give your personal link to — and your friends — can see your timeline and only the memories you choose to make visible. Memories are private unless you choose otherwise. You can reset your link at any time to cut off everyone who has it.
No ads, no tracking cookies, no analytics companies. You can delete everything at any time, instantly.

Who we are

Sonic Souls (“we”) is a small independent project based in the United States. Contact us at sonicsouls@shorland.co. [LAWYER TO CONFIRM — whether the responsible person or company must be named here, and whether a representative in the UK/EU is needed.] Sonic Souls is not affiliated with or endorsed by Spotify.

What happens to your Spotify file

When you choose your file, your web browser reads it on your device. The file itself — and everything in it that we don't use — never leaves your device. From each play, the browser uses only: the song's name, artist and Spotify ID; when it finished playing; how long it played; and whether you started it yourself or skipped it (only to work out which songs mattered most — this detail is not kept). It then builds a summary: your top song for each month or season, your top 10, and how many years of history you have.

If you don't sign in, that summary stays in your browser tab and disappears when you close it.

What we store, and why

If you don't sign in

Nothing about you on our servers, except anonymous usage counts (below).
In your browser only: your timeline for this tab; memories you write (until you sign in or delete them); an invite you arrived with; which version of our headline you were shown.

If you sign in

Your email address — to send sign-in links. Stored encrypted, plus a scrambled “fingerprint” so we can find your account without reading the address.
A display name — random at first (like “Velvet-Cassette-42”); you can change it. Anyone who can see your timeline sees it.
Your timeline summary — song names, artists, Spotify song IDs, play counts, your top 10, and months (never days or times).
Your memories — what you write, which song it's for, and whether it's private (the default) or visible to people with your link.
Your friendships and your invite link.
Sign-in details — a cookie that keeps you signed in for 30 days, and one-time sign-in links that expire after 15 minutes. We store only scrambled versions of both.

Anonymous usage counts (everyone)

We count steps like “visited the home page”, “uploaded a file” or “wrote a memory”, with which headline version you saw and the date (no time). These counts are not linked to you, your account, your device or your IP address.

What we never store

Your Spotify file, your Spotify username, IP addresses, device or browser details, your country, or exact dates and times of your listening. (To prevent abuse, our server briefly counts requests per IP address in memory; these counts are never written down.)

Why we're allowed to use it

[LAWYER TO CONFIRM — e.g. under UK/EU GDPR: to provide the service you asked for (contract) for your account, timeline, memories and friends; our legitimate interest in keeping the service secure and understanding, anonymously, how it's used.]

Who can see what

Anyone with your personal link — no account needed: your display name, your timeline and the memories you marked “Show to anyone with my link”. Never your email or private memories. Links can be forwarded, so only make a memory visible if you're happy for anyone with the link to read it.
Your friends (people who opened your link and signed in, or whose link you opened): the same, from their friends list, plus whether songs are on their timeline too.
Everyone else: nothing. Shared timelines are marked so search engines don't list them. If you reset your link (on your timeline page), the old link stops working for everyone who had it; friends you've already connected with keep access until you remove them.
Us: the person who runs Sonic Souls can technically access the database to run and fix the service. We won't read your memories unless needed to deal with abuse or a legal request.

Other companies involved

Spotify — only if you press ▶ to play a song. Spotify's player then loads from Spotify, which receives your IP address and the song, and may set its own cookies. Spotify's own privacy policy applies to that. Nothing from Spotify loads until you press ▶.
Resend, Inc. — receives your email address and your sign-in link, only to deliver the email. Emails are sent from the United States, and Resend keeps sending records for up to 30 days. [Transfer safeguards — lawyer to confirm.]
Render Services, Inc. — runs our server and database in the United States (Virginia). [Transfer safeguards — lawyer to confirm.]

We don't sell or share your data with anyone else, and we don't use advertising or analytics companies. Our fonts and code are served from our own site.

Cookies and browser storage

We use one cookie, only when you sign in, to keep you signed in. It's strictly necessary, so we don't ask for cookie consent. We also use your browser's storage for the items listed above. Spotify may set cookies if you press ▶.

How long we keep it

Account, timeline, memories and friendships: until you delete your account. We don't currently delete unused accounts automatically; if we start to, we'll warn you first.
Sign-in links: stop working after 15 minutes or once used, and expired ones are cleared out automatically. Sign-in cookies: 30 days, or until you sign out.
Anonymous usage counts: for as long as Sonic Souls runs. They contain nothing that identifies you.

Your choices and rights

Delete everything: “Delete my account” on your timeline page permanently removes your account and everything in it, straight away.
Edit or delete any memory, change your display name, make memories private, reset your link, or remove a friend at any time.
Get a copy of your data, or ask questions: contact sonicsouls@shorland.co.
[LAWYER TO CONFIRM — the rights that apply where our users live (e.g. US state privacy laws, UK/EU GDPR) and where people can complain.]

Children

Sonic Souls is not for anyone under 16. If you're younger, please don't sign up.

Security

Email addresses are encrypted; sign-in links and sessions are stored only in scrambled form; the site uses a strict security policy and loads no outside code. No system is perfectly secure; if something goes wrong that affects you, we'll tell you [and the authorities] as required by law.

Changes

If we change how we use your data, we'll update this page and change the date at the top. For significant changes we'll also show a notice on the site.