Privacy Policy

Setlist helps you review and move playlists between Spotify and YouTube. This policy explains what information Setlist uses, why it is used, and the choices available to you.

Information we use

• Sign-in information. Clerk processes your sign-in and may provide Setlist with identifiers and basic account details, such as your email address, needed to maintain your workspace.
• Connected music accounts. When you connect Spotify or YouTube, Setlist receives account identifiers and display names, OAuth access and refresh tokens, and the playlist and track information needed to show your library, find matches, and create a playlist you approve.
• Workspace information. Setlist stores transfer progress, playlist and track identifiers and details, match suggestions you review, your selections, and the result of a transfer so you can review or resume your work.
• Security and service data. Sign-in sessions, short-lived OAuth state, and basic request and error information may be processed to secure and operate the service.

How we use music-service data

Setlist uses Spotify data only to display and transfer playlists you choose. Its Spotify permissions include reading private and collaborative playlists and creating or editing playlists. Setlist uses YouTube data only to display your YouTube playlists, search for match suggestions, and create or update the destination playlist you approve. Its YouTube permission is the YouTube Data API scope youtube.force-ssl. We do not use connected music data for advertising, profiling, or selling data.

Setlist requests playlist and track details from Spotify and Google/YouTube, sends searches to the selected destination service, and sends your approved playlist choices to that service to create or update the destination playlist. Match suggestions can be wrong; you review them before Setlist creates the destination playlist.

Storage and security

Setlist stores workspace records in Cloudflare D1 and runs on Cloudflare Workers. Music-account credentials are encrypted with AES-GCM before they are stored. Setlist limits access to the account that connected the service and uses short-lived, secure OAuth state cookies to complete account connections. No method of storage or transmission is completely secure.

When information is shared

Setlist does not sell your personal information. Information is shared only as needed to operate the service:

• Clerk provides authentication and processes sign-in information. When you grant playlist access through a linked account, Clerk also manages its OAuth authorization and supplies access tokens to Setlist’s server for the actions you request.
• Spotify and Google/YouTube receive the OAuth requests and API calls needed to connect your account and perform the playlist actions you request. Their own terms and privacy policies apply to their services. See Spotify’s Privacy Policy and Google’s Privacy Policy.
• Cloudflare hosts the application and database and may process technical information needed to deliver and secure the service.

We may also disclose information if required by law or if necessary to protect the service, its users, or someone’s safety.

Retention and your choices

Music-account credentials remain stored until you disconnect that account or request deletion. Disconnecting either music account removes its saved credentials and immediately deletes your saved transfer history. You can also revoke Setlist’s access in your Google account permissions or Spotify account settings; revoking access prevents further API access, and you can email us to request deletion of stored data.

If you hide playlists from your library lists, Setlist stores that list (playlist IDs, names, and cover image URLs) until you unhide them or delete your Setlist data. It is kept when you disconnect a music account. You can delete your saved transfer history at any time from Settings.

Transfer history and workspace records are automatically deleted no later than 30 days after a transfer is started. OAuth connection state expires after ten minutes. You may request deletion of your Setlist data, including connected-account credentials, by emailing me@joaogf.dev from the email address associated with your account. We will verify the request and delete information we control, subject to any legal retention requirements.

Disconnecting a music library stops Setlist from using its Clerk-managed authorization. The social account may remain linked for sign-in; remove it through your Setlist account settings or revoke access at the provider to remove that authorization too.

Cookies

Setlist and Clerk use essential cookies for authentication, session security, and completing music-service OAuth requests. The temporary OAuth state cookie is HTTP-only and expires after ten minutes. Setlist does not use advertising cookies.

Children

Setlist is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can review and delete it.

Changes to this policy

We may update this policy when the service or its data practices change. We will post the current version on this page and update the effective date. If a change materially affects how Google user data is used, we will provide notice and request consent where required.

YouTube API Services

Setlist’s use of information received from YouTube API Services complies with the Google API Services User Data Policy, including its Limited Use requirements. You may revoke Setlist’s access at any time from your Google account permissions. Use of Setlist’s YouTube features is also subject to the YouTube Terms of Service.