Privacy and data policy
Last updated: 21 October 2026
Rosso brings your music history together. We only process what the product needs and leave control with you. Below: what we collect, why, and how you delete it — short and complete.
Data controller
Rosso (Project Rosso) is an independently developed, alpha-stage, one-person project; the project owner, Muhammed Uğur Acıelma, is the data controller. You can send requests through the contact section below. Your data is never used for advertising and never sold.
Categories of data we process
| Data | Purpose | Retention |
|---|---|---|
| Account info (email, display name) | Sign-in, session management, and contacting you. | Until the account is deleted. |
| Spotify connection tokens | Access to your Spotify library and syncing. | Until the connection is removed or the account is deleted (encrypted). |
| Listening events (play_events) | Recap, stats, and musical identity (Taste). | Until the account is deleted. |
| Spotify export ZIP file | Importing your past listening data. | Deleted after processing; at the latest when the account is deleted. |
| Playlists and your mood decisions (hidden/approved tracks, relevance labels) | Shaping your lists around you. | Until the account is deleted. |
| Your own Spotify developer app details (Client ID, Client Secret) | Running live sync through your own app, on your own quota. | Stored encrypted; until you remove the connection or delete the account. |
| Legacy data of the discontinued social features (if any: social profile, photos, messages, match decisions) | The social features are discontinued; this data is not processed for any purpose or shown to anyone. | Kept until the account is deleted; included in your data export. |
| System logs (errors and operations) | Diagnostics and security. | 30 days, then deleted automatically. |
| Anonymous visit measurement (only if you allow it) | Seeing which pages are used. | Aggregated and anonymous at Vercel Analytics; never tied to your identity. |
Data we don’t collect
We don’t store IP addresses. The ip_addr field in a Spotify export is not processed: it is never written to any table, log, or error record. The identity file (identity.json) is read only during import and then deleted. We use no advertising cookies, no tracking pixels, and no third-party ad networks.
Cookies and measurement
Essential cookies that keep you signed in are required for the product to work and can’t be turned off. The only other thing is anonymous visit measurement (Vercel Web Analytics), and it loads only if you choose “Accept”. If you haven’t chosen, it doesn’t load either — silence is not consent. You can change your choice here at any time.
Your current choice: …
Where your data goes
Rosso never sells your data. It uses only these service providers (data processors) to run the product:
| Service | What for | Where |
|---|---|---|
| Supabase | Database, authentication, and file storage. | EU (Frankfurt) |
| Vercel | Hosting and (if you allow it) anonymous measurement. | EU (Frankfurt) |
| Spotify | Reading the library and listens of the account you connect. | US / global |
Transfers abroad (KVKK art. 9): Rosso does not send your data to any AI service. Spotify is your own account: you create the connection and can remove it from Settings at any time.
How to exercise your rights
Under KVKK art. 11 and the GDPR you can access, correct, delete, and port your data. Most of this works instantly inside the app, without waiting for a request to be processed:
- Download your data: Settings → “Export personal data” — your full personal data pack downloads as JSON immediately.
- Correct: Settings → Account (your display name; email and password in account settings).
- Disconnect Spotify: Settings → Platform connections. Past data stays; only new syncing stops.
- Delete your account: Settings → Delete account.
How deletion works
Account deletion has two stages. The moment you delete, your account closes; the data stays for another 30 days — if you deleted it by mistake, you can come back within that window. After 30 days permanent deletion runs automatically: listening events, playlists, and the files you uploaded are all removed irreversibly. Your identity in system logs is detached at deletion time (the record is anonymized, and cleared entirely within 30 days).
Contact
For data requests or questions: iletisim@project-rosso.site. Downloading your data and deleting your account need no request: both work instantly from Settings.