Privacy policy

Last updated 8 October 2026

Soundtrackd (soundtrackd.app, "we") matches songs with films and TV shows, and films with songs. It's an independent project run from Turkey. This page explains what we collect, why, who else sees it, and how to get it deleted. Questions: support@soundtrackd.app.

The short version

• You can search without an account. We don't use tracking cookies, ads or cross-site trackers.
• With an account we keep your email, your search history and your saved lists, so they follow you to other devices.
• AI providers see the songs and films you search, never your email or account.
• You can delete your account and everything in it from the account menu at any time.

What we collect

When you search, with or without an account

• What you search: the song, film, show or Spotify playlist link you enter. We send it to the services below to build the results. Results are cached and shared: anyone who searches the same song later gets the same result. The cache doesn't record who searched.
• IP address: used to stop abuse. Signed out, a daily count of new searches is kept per IP address and resets every day. Our host also keeps short-lived request logs (including the page address, which contains the search, and the IP address) for a few days to fix errors.
• On your device: signed out, your recent searches are stored only in your browser (local storage), not on our servers.

When you create an account

• Account details: your email address. If you sign in with Google, also your name and profile picture from Google.
• Your library: your search history (the last 50 searches, or 500 on Premium) and the lists you save.
• Plan and usage: your plan, and a daily count of new searches tied to your account.

Analytics

We use Cloudflare Web Analytics to count page views. It sets no cookies, doesn't fingerprint you and doesn't follow you across sites. We only see totals, such as visits per page and country.

Why we use it

• To run the service you ask for: search, sign-in, history and lists (needed to provide the service).
• To keep it working and fair: rate limits, abuse prevention, security and fixing errors (our legitimate interest).
• To understand overall use in aggregate, without profiling anyone (our legitimate interest).

We don't sell your data, show ads, or use your data to make decisions about you.

Who else processes it

• Supabase (accounts and database, servers in Frankfurt, Germany): your account, history and lists.
• Cloudflare (hosting, caching, request logs, analytics, global network).
• Resend (sends sign-in emails): your email address.
• Google, only if you choose "Continue with Google": handles that sign-in.
• AI providers that read songs and pick matches: Anthropic (Claude) first, with Google (Gemini) and Groq as backups when Claude is unavailable. They receive song, film and show titles, listener tags and, for pasted playlists, the playlist's track list. Never your email, name or account. Google's free Gemini tier may use these prompts to improve Google's products; visitors in the EEA, Switzerland and the UK are never routed to it.
• Music and film data: Deezer, Last.fm, TMDB and Spotify receive the titles or links you search, from our servers, not from your browser.
• Images and scripts loaded by your browser: posters from TMDB, album art from Deezer, icons from Simple Icons and the sign-in library from jsDelivr. Like any website, these servers see your IP address when your browser loads them.

Some of these providers process data outside Turkey and the EU, including in the United States. We only use established providers that commit to protecting it under their own data processing terms.

How long we keep it

• Account, history and lists: until you delete them or your account. History beyond your plan's limit is removed automatically.
• Daily search counts: reset every day.
• Request logs: a few days.
• Database backups kept by Supabase may hold deleted data for up to 7 more days.

Cookies and local storage

We don't use cookies for tracking or advertising. Your browser's local storage keeps your sign-in session, your signed-out search history and small settings. These are needed for the site to work, so there's no cookie banner.

Your rights

Wherever you live, you can ask us to show you, correct, export or delete your data, or object to how we use it. You can delete your account yourself: open the account menu and choose "Delete account". It removes your account, history and lists right away.

If you're in Turkey, you have the rights in Article 11 of the Personal Data Protection Law (KVKK, No. 6698): to learn whether your data is processed and why, which third parties in Turkey or abroad receive it, to have it corrected or deleted and those third parties told, to object to results of solely automated analysis that go against you, and to claim compensation for unlawful processing. If you're in the EEA, the UK or Switzerland, you have the matching rights under the GDPR, including data portability and restricting processing.

Email support@soundtrackd.app from the address on your account. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or your local data protection authority.

Children

Soundtrackd isn't meant for children. You must be at least 13 to create an account, or the minimum age in your country if it's higher.

Changes

If we change this policy, we'll update the date at the top. If the change is significant, we'll say so on the site or by email before it applies.