Privacy Policy

Account Information

When you create an account, we collect your email address, name, and authentication credentials (password hash or OAuth tokens).

Landing Page Data

Spotify URLs, track/playlist/album/artist IDs, custom text content, design preferences, and configuration settings you provide when creating landing pages.

Conversion Tracking Data

Meta Pixel IDs, Conversions API (CAPI) access tokens (encrypted), custom event names, and conversion event data.

Analytics and Usage Data

Page views, click events, visitor IP addresses (anonymized), browser type, device information, and aggregated statistics.

Payment Information

Billing details processed through Stripe. We do not store credit card numbers on our servers.

Public Metadata (No User Login Required)

We use the Spotify Web API with server-side Client Credentials (app-level authentication) to fetch publicly available metadata about tracks, playlists, albums, and artists. This includes track titles, artwork, artist names, and playlist contents. No Spotify user account is involved in this process.

Visitor Spotify OAuth (Fan Gate Flow)

When a landing page has a Spotify fan gate, visitors are invited — but never required — to connect their Spotify account to unlock exclusive content. If a visitor chooses to connect, the following occurs:

• The visitor is redirected to Spotify's official authorization page, where Spotify presents a consent screen describing the permissions being requested
• The visitor explicitly approves the requested permissions on Spotify's own interface
• Spotify issues a short-lived access token that is returned to our server
• We use that access token to perform exactly the action shown (follow an artist, save a track, or follow a playlist) on the visitor's behalf
• The access token is immediately encrypted (AES-256-GCM) and stored temporarily for up to 5 minutes solely to complete verification
• Once verification is complete, the token is permanently deleted from our systems
• We never store, log, or share the visitor's Spotify username, profile information, listening history, or any other Spotify data beyond what is strictly necessary to confirm the action was completed

Spotify Permissions (Scopes) We Request

Depending on the gate type configured by the landing page creator, we may request the following Spotify permissions from visitor accounts:

Data Retention for Spotify Tokens

Visitor Spotify access tokens are stored encrypted in our database for a maximum of 5 minutes. They are deleted immediately upon successful verification, or automatically purged by our cleanup process if verification does not occur within that window. We never store Spotify refresh tokens from visitor OAuth sessions.

What We Do Not Do With Spotify Data

• We do not sell, share, or transfer Spotify user data to any third party
• We do not use Spotify data for advertising or profiling
• We do not store Spotify user profile information (name, email, profile image)
• We do not retain access tokens beyond 5 minutes
• We do not perform any Spotify actions beyond what the visitor explicitly approves
• We do not access your saved tracks, playlists, or listening activity for any purpose other than the specific idempotency check (to avoid performing an action you've already completed)

Opting Out of Spotify Fan Gates

Connecting your Spotify account to a fan gate is always voluntary. If you do not wish to connect your Spotify account, you may choose not to use the gated content feature on the landing page. Declining does not affect your ability to view the rest of the landing page.

Vercel (Hosting & Infrastructure)

Our application is hosted on Vercel. Data is stored in secure data centers.

Stripe (Payment Processing)

Payment information is processed by Stripe. We do not store credit card details.

Resend (Email Communications)

Transactional emails are sent via Resend. We share your email address for this purpose.

Meta (Facebook/Instagram)

If you configure Meta Pixel integration, conversion events are sent to Meta's servers according to your settings. We act as a data processor for this functionality.

Spotify

We use the Spotify Web API to fetch public metadata (tracks, albums, playlists, artists) and, for fan gate features, to perform authorized actions on behalf of visitors who explicitly consent via Spotify's OAuth flow. See the "Spotify Integration and Fan Gates" section above for complete details. Spotify's own Privacy Policy governs data processed through their platform.