Privacy Policy

When you create an account we collect your email address, a username, and a password. Your email is used to identify your account, sign you in, send password resets, and deliver essential service notices such as billing receipts or changes to this policy.

We do not sell, rent, or trade your email address. We do not send marketing email unless you explicitly opt in, and every optional message includes an unsubscribe link. Passwords are stored only as salted hashes by our authentication provider — we never see them in plain text.

You can update your email or delete your account at any time. Deleting your account removes your profile, ratings, library, and playlists from our active systems, with backups aging out on a rolling 30-day schedule.

Subscriptions are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Card numbers, expiration dates, and security codes are entered directly into Stripe's hosted checkout and are never transmitted to, processed by, or stored on our servers.

From Stripe we receive and store only what is needed to run your subscription: a Stripe customer ID, a subscription ID, the plan and price you selected, your subscription status, the current billing period, and whether the plan is set to cancel. We use this to unlock plan features and show your billing state.

Billing changes, invoices, and cancellations are handled through Stripe's billing portal. Stripe's own handling of your data is governed by the Stripe Privacy Policy at stripe.com/privacy.

IT'S NOTED is served from our own custom domain over HTTPS with TLS certificates provisioned automatically. All traffic between your browser and our domain is encrypted in transit.

Our hosting and DNS layer processes standard request metadata — IP address, browser user agent, referring page, and timestamps — to route traffic, apply rate limits, and defend against abuse. This data is retained for a short operational window and is not used to build advertising profiles.

Cookies and local browser storage set on our domain are limited to what the product needs: your signed-in session, your saved ratings, and any music-service credentials you choose to link. Third-party music tokens (Spotify, Apple Music) stay in your browser's local storage and are never sent to our servers.

Linking Spotify or Apple Music is optional. Authorization happens directly between your browser and that service. We request only the permissions needed to read the playlists you choose to import and to create playlists you choose to export.

You can disconnect a service at any time from the Connect page, which clears the stored token from your browser.

We share data only with the processors that make the product work: our hosting and database provider, Stripe for payments, and the AI provider that generates playlist and history results from the prompts you submit. We do not sell personal data.

Playlists you share with friends are visible to the people you invite, at the permission level you assign. You can revoke access at any time.

You may request a copy of your data, correction of inaccurate data, or deletion of your account. Contact us at privacy@itsnoted.app and we will respond within 30 days.