Privacy Policy

Who is responsible

Permanent Index is the data controller for the information described here. For any privacy question or request, contact privacy@permanentindex.com.

What we collect

• Account data: your email, username, and optional display name, bio, and profile picture.
• Curation data: the collections, playlists, liner notes, and annotations you create.
• Technical data: an authentication cookie to keep you signed in, and standard server logs.

We do not run advertising or third-party tracking on your profile, collection, or release pages. We do not build advertising profiles about you.

Why we hold it, and our legal basis

We process account and curation data to provide the service you signed up for, which under the GDPR is the performance of our agreement with you. We send a small number of transactional emails (sign-up confirmation, password recovery) on the same basis. We keep essential cookies and logs on the basis of our legitimate interest in running a secure, working service.

Your curation belongs to you

The collections you build and the words you write about music are yours. We hold them in trust to display them as part of the service. We do not sell your data, and we do not license or train models on your annotations. You can export everything you have made at any time, in an open format, from your account.

What is public

Profiles and their collections are public by default, so that a collection can live at a shareable URL. You can make an individual collection private, or make your whole profile private, from your settings. Private content is visible only to you.

Who else touches your data

We rely on a small set of service providers, acting as our processors: Supabase (database, authentication, and file storage), Vercel (hosting), Resend (transactional email), and Cloudflare (DNS and email routing). Music metadata comes from MusicBrainz and cover art from the Cover Art Archive; we send no personal data to them. We do not sell or share your personal data with anyone for their own purposes.

How long we keep it

We keep your data for as long as your account exists. If you delete your account, we delete your account data and curation, except where we are required to retain something by law. You can delete individual collections at any time.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, or export it, and you can object to certain processing. Data export is built into the product; for anything else, email privacy@permanentindex.com. If you are in the EU and believe we have mishandled your data, you may complain to your local supervisory authority; in Portugal this is the Comissao Nacional de Proteccao de Dados (CNPD).

Children

Permanent Index is not directed at children under 16. Please do not create an account if you are under 16.

Changes

If we change this policy we will update the date above. Significant changes affecting how we use your data will be communicated before they take effect.