audifyd1. Who is responsible
John Paulsen, Norway, is the controller responsible for Audifyd by Codinq. For privacy questions or requests, email codinq@audifyd.codinq.xyz.
Contact: codinq@audifyd.codinq.xyz. Provider agreements and international-transfer arrangements are still being reviewed; this notice remains a draft for that review.
2. Information we handle
Account information includes your display name, email address, verification status, and a hashed password if you use password sign-in. Your optional profile picture and description are also stored. Passwords are hashed rather than stored as readable text.
Your listening journal includes ratings, written reviews, listening-list choices, and follow relationships. Historical saved-album data may remain in existing accounts for compatibility, but the collection feature is retired and that data is not shared on public profiles.
Security records include hashed session tokens, short-lived account-link tokens, token expiry times, and hashed rate-limit identifiers derived from request IP addresses or account/email identifiers. Server logs are used for operation and security and have a configured maximum retention of 31 days. Storage limits may remove logs earlier.
3. Why we use it
We use account and journal information to provide sign-in, store your contributions, show the profile sections you share, and support follows and listening lists. Account emails support verification and password recovery.
We process security information to prevent abuse, enforce request limits, and protect accounts. The intended legal bases are performance of the service agreement for the account and journal features you request, and legitimate interests in operating a secure service for abuse prevention and limited security logs. The operator must document and review these grounds, including the interests and rights of younger users. We do not use account information for advertising or sell it.
4. What other people can see
Accounts start private. If you enable a public profile, people can search for your display name and view the sections you set to public. Separate controls cover review text, ratings, your listening list, description, profile picture, and connection counts.
Your email address, password hash, and security tokens are not included in public profile responses. Follow lists and feeds display public profiles. Turning off public visibility hides your profile and contributions from other users through these features. Your own account can still view its information.
5. Cookies and browser storage
Audifyd uses an HttpOnly sign-in cookie, audifyd_session, with a seven-day maximum lifetime. A separate audifyd_discord cookie binds a Discord sign-in request to your browser and expires after ten minutes. Signing out removes the current sign-in cookie.
The current application does not add advertising or analytics trackers. Guest review storage and importing have been removed. Old browser data from earlier versions may remain on your device until you clear site storage. External images and links can cause requests to their respective providers.
6. Services involved
The application runs on an OVHcloud VPS in Canada East, Beauharnois. MongoDB Atlas stores the account, journal, and security database on AWS in Stockholm, Sweden. The Canadian application server accesses and processes that data to provide the service. Resend receives recipient email addresses and transactional message content for verification and password-reset emails.
If you choose Discord sign-in, Discord provides an account identifier, profile details, email address, and verification status. Audifyd does not retain Discord access or refresh tokens. Existing password accounts are not automatically merged merely because an email matches.
Music searches are sent to Deezer by the backend. Album artwork and Discord avatars may load from external image hosts, which receive normal connection information when your browser requests them. Following Spotify or other external links sends you to those services.
Processing on the Canadian VPS takes place outside the EEA even though the Atlas database is in Sweden. Resend, Discord, provider support, and their subprocessors may also process information outside the EEA. The operator has not yet confirmed the applicable processor agreements, contractual entities, transfer mechanisms, or safeguards. This section must be completed after reviewing those agreements; no claim is made that all transfers have already been approved or assessed.
7. Reports and moderation
Signed-in users can report public profiles and public written reviews. A report stores the reason, account identifiers, and a snapshot of the public content as it appeared when reported. The administrator can review reports, restrict public visibility, suspend access, and revoke sessions. Private journals are not available for routine browsing in the administration panel.
Reports and administrator audit records are scheduled to expire after 31 days. Account deletion also removes reports involving that account, its review restrictions, and audit entries linked to it. Contact codinq@audifyd.codinq.xyz if you want to question a moderation decision.
8. Retention
Your account and listening journal are retained while your account exists. Inactivity alone does not trigger deletion. When you confirm deletion in Settings, the account is immediately disabled and hidden, and deletion of the live profile, avatar, journal, sessions, and follow records is performed as part of that request. A minimal user-ID-only cleanup job retries for up to twenty-four hours to handle failures or in-flight writes, and is removed after successful cleanup.
Session records expire after seven days; Discord sign-in transactions after ten minutes. MongoDB expiry cleanup runs asynchronously. Rate-limit buckets become unusable when their window ends and are scheduled for automatic expiry cleanup.
Password-reset links expire after thirty minutes; verification links after twenty-four hours. Expiry prevents use even if a token hash remains in the account record. Successful use removes the relevant token record, and requesting a replacement invalidates the previous link.
9. Your choices and rights
You can edit your name, description, and picture; change privacy settings; remove reviews or ratings; and manage your listening list and follows. Download your data or delete your account from Settings. You can also contact codinq@audifyd.codinq.xyz for assistance or other privacy requests. Identity verification may be required.
Depending on applicable law, you may have rights to access, correct, erase, restrict, object to processing, or receive a portable copy of your information. Some rights have conditions or exceptions. You may complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or the authority responsible for your location. We normally respond to rights requests within one month; applicable law permits extensions in some circumstances.
10. Younger users
Audifyd’s account policy is 13+ subject to applicable local requirements. This is not a statement that a 13-year-old can always consent or enter a valid agreement in every country. Requirements for younger users, including any parental consent or age assurance, must be reviewed before actively targeting children.
Accounts start private. Younger users should avoid identifying personal details and ask a trusted adult for help if they receive unwanted attention or encounter unsafe content. We do not request identity documents or dates of birth as part of the current sign-up flow.
11. Security and updates
Audifyd uses password hashing, hashed session and recovery tokens, expiring single-use recovery links, and shared rate limits. Public production access requires HTTPS. No system can guarantee absolute security.
We will update this page when data practices change. The date above identifies the latest revision. For questions or to exercise your rights, contact codinq@audifyd.codinq.xyz.
Contact codinq@audifyd.codinq.xyz