Privacy policy

Riffiter (riffiter.com) is operated from Istanbul, Türkiye, and is the data controller for everything described here under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK). For anything in this policy: [email protected].

Account data: email, username, a password hash (never the password itself; we couldn't read it if we wanted to), your display name and photo if you set them, and timestamps of when you accepted these policies.

Listening history: when you connect Spotify, Last.fm, or ListenBrainz, we store what you played and when (track, artist, album, timestamp). We read your listening history only: never your playlists, never anything that posts on your behalf. Connecting is always your explicit action, and disconnecting is always available.

What you create: ratings, reviews, lists, favorites, follows, concert diary entries, and contributions to the catalog.

Optional profile details: a home city if you opt in to nearby-concert suggestions (you pick it from a list; we never read your device location), and any social links you add yourself.

Technical basics: the IP address at signup and short-lived, IP-based counters used for spam and abuse prevention (rate limits, view-count dedupe). Cookies are covered in full in the cookie policy.

Moderation records: if content you posted is reported or moderated, we keep an audit trail of the action (what changed, when, by whom) so decisions are accountable and reversible.

To run the service you signed up for (GDPR art. 6(1)(b), contract; KVKK m.5/2-c): your account, your ratings and reviews, syncing the listening sources you connected, showing your profile.

To keep the service safe and honest (art. 6(1)(f), legitimate interest; KVKK m.5/2-f): spam and bot prevention (signup IP, rate limits, Cloudflare Turnstile), moderation audit logs, error monitoring, and cookieless aggregate analytics that set nothing on your device.

Only with your consent(art. 6(1)(a); KVKK m.5/1): analytics cookies on the website in the EEA, the UK and Switzerland (off until you accept them in the cookie banner; outside those regions Google Analytics measurement starts on and “Essential only” switches it off — the app has no cookies and its own switch instead, described below) and marketing email (off until you tick the optional box; both are withdrawable as easily as they were given, in the banner and in Settings respectively).

We do no profiling for advertising and make no automated decisions with legal or similarly significant effects about you.

Riffiter is a public music diary: your profile, ratings, reviews, lists, and concert diary are visible to anyone unless you switch on Private profile in Settings, which hides your page and activity from everyone but you. Your ratings always feed the anonymous community averages either way. Listening history powers your own pages and stats; we never publish a raw feed of it to others.

The iOS and Android apps sign in to the same account and are covered by everything above; four things are specific to them.

Product analytics.The app reports which screens are opened and which features are used (a rating, a listen logged, a share, today's song) to PostHog on EU servers — the same processor the website uses. There is no cookie banner on a phone, so the switch lives in Settings → Privacy → Product analytics: turning it off stops the collection at the source, on that device, permanently. Screen names are collapsed to routes, so the report says “an album page”, not which album.

Which advert brought you.On iOS the app asks Apple for its own attribution token and sends it to us, so we learn which Apple Ads campaign or keyword led to an install. It carries no advertising identifier (we never touch the IDFA), and it is Apple's own mechanism, not a third-party tracker — nothing about you is shared with an advertiser.

Notifications. Turning them on registers a push token for that device, which is what a notification is addressed to. Turning them off in Settings releases it.

Location. Asked for only on the concerts screen, only when you open it, and only to sort shows by how near they are. The coordinates are used for that one request and never stored against your account; the home city on your profile is something you type in yourself.

We do not sell your data. We do not share it with advertisers or data brokers. We do not run third-party ad trackers. Riffiter's independence is a feature, not a slogan.

Like every web product, we use infrastructure providers, each bound by a data-processing agreement and used only for the purpose named: Contabo (hosting and database, Germany), Cloudflare (image CDN and the Turnstile bot check), Hetzner (search servers, Germany), Resend (transactional email), PostHog on EU servers (product analytics), Google Analytics (traffic statistics, only with cookie consent), and Sentry (error monitoring). Some providers are US companies; where data leaves the EU/EEA or Türkiye, transfers rest on the EU–US Data Privacy Framework or Standard Contractual Clauses, and on the KVKK transfer rules.

Spotify, Last.fm, and ListenBrainz provide your listening data under their own terms after you explicitly connect them. Disconnecting is always available, and deleting your account removes the stored tokens.

Account data and everything you created: until you delete them (or your account (see below). Last.fm taste reports for non-members: at most 30 days, then purged automatically. Anti-abuse counters: hours to days. Server logs and error reports: weeks, then rotated out. Backups age out on a fixed schedule; deleted data leaves them as they cycle.

Anyone can generate a report for a public Last.fm profile. Reports contain only what that profile already shows publicly (top albums, artists, play counts), are fetched via the official Last.fm API, are never indexed by search engines, and are cached for at most 30 days before being deleted automatically. If a report concerns your Last.fm account and you want it gone sooner, email us and we'll delete it.

You can accesseverything we hold about you: it's all visible in the product. You can correct it, request a copy in a portable format, object to processing based on legitimate interest, restrict processing while a dispute is resolved, and withdraw any consent at any time without affecting what happened before. Requests: Email [email protected]; we answer within 30 days.

Deletion needs no email: account deletion lives in Settings and removes everything (listening history, ratings, reviews, lists, follows) with no grace period and no soft delete.

If you believe we've handled your data unlawfully, you can complain to the Turkish Personal Data Protection Authority (KVKK, kvkk.gov.tr) or, in the EU, to your local supervisory authority. We'd appreciate the chance to fix it first.

All traffic is encrypted in transit (TLS). Passwords are stored only as salted hashes. Production data access is limited to what operating the service requires, and moderation actions are audit logged. No system is perfect; if a breach ever puts your rights at risk, we'll notify you and the authorities as the law requires.

Riffiter is not directed at children and requires users to be at least 16. We don't knowingly collect data from anyone younger; if you believe we have, email us and we'll delete it.

When this policy changes materially, we'll say so in the product before the change takes effect, not just quietly bump the date at the top.

Questions about your data: [email protected]. See also the cookie policy and the terms of service.