Privacy Policy

Who is responsible

Permanent Index is the data controller for the information described here. For any privacy question or request — access, correction, deletion, export, or anything else — contact privacy@permanentindex.com. For now, Ed is the only person on the other end of that address.

What we collect, and why

Account data. Your email, username, and a password we never see in plain text (Supabase Auth, our authentication provider, stores only a hash — nobody at Permanent Index, including us, can read your actual password). Optional profile fields — display name, bio, profile picture, links, and preferred streaming services — are yours to add or leave blank.

Legal basis: performance of our contract with you. We need an email and a way to authenticate you to run an account at all.

If you rename your account, we keep a record of your old username rather than deleting it — old links and mentions using it still lead to your current profile, and nobody else can claim it while you’re using this one.

Curation data. The collections and playlists you build, the items in them, and the liner notes, Diary entries, and curator’s statements you write. This is the actual product — the record of what you kept and why. It also covers your Top Four (up to four picks pinned to your profile, separate from any collection), who you follow and who follows you, and which other curators’ collections and playlists you’ve saved.

Legal basis: performance of our contract with you, for the same reason: building and displaying your collections is the service you signed up for.

One more thing worth being direct about: editing or deleting a liner note or Diary entry also writes a copy into an older internal table that predates the current one. Nothing on the site reads from it or displays it anymore, but it’s a live mirror, not dead history — it grows every time you edit a note. It isn’t included in the data export described further down, but it is deleted along with everything else if you delete your account.

Liked data. The tracks and albums you’ve liked — a single tap, separate from adding something to a collection or playlist. Likes are public by default, the same as the rest of your profile: they’re visible on your Diary and to anyone who visits your profile, gated only by your profile’s own privacy setting, not a setting of their own. There’s no private queue and no dismiss here — a like exists until you unlike it, which deletes the row outright rather than hiding it.

Legal basis: performance of our contract with you.

Technical data. A session cookie that keeps you signed in, and a separate cookie remembering your light/dark preference. Standard hosting request logs, kept by our hosting provider (Vercel) rather than by us directly — we don’t run a separate analytics or tracking layer. We also keep a small record of which onboarding tips and suggestions you’ve dismissed, so we don’t show them to you again.

Legal basis: legitimate interest in running a working, secure service.

We do not run advertising or third-party tracking on your profile, collection, release, or Diary pages, and we never will (this is a permanent commitment, not a current-state description). We do not build advertising profiles about you, and we do not sell your data to anyone.

What is public, and what isn’t

Profiles and the collections in them are public by default — that’s the point of a permanent, shareable URL. You can make an individual collection private, or your entire profile private, from your settings at any time; a private collection is visible only to you.

Liner notes work differently, and the difference matters. A note belongs to you and to the record it’s about — not to any one collection. So making a collection private does not hide the notes you’ve written about the records inside it: those notes stay visible on the release pages they belong to, and on your profile. The setting that governs a note is your profile’s, not your collection’s — make your whole profile private and your notes and Diary go private with it. If you want a single note gone, delete the note itself.

Who else touches your data

We rely on a small set of processors — companies that handle data on our behalf, under our instruction, never for their own purposes:

• Supabase — our database, authentication, and file storage provider. Holds essentially everything described above.
• Vercel — hosts the application and serves every page you load. Standard web request logs (including IP address) pass through their platform as part of normal hosting.
• Resend — sends the small number of transactional emails the service needs: sign-up confirmation and password reset. It never receives anything beyond your email address for that purpose.
• Cloudflare — DNS for permanentindex.com, and email routing for our role addresses. Mail you send to the privacy address above is forwarded through Cloudflare to the mailbox we actually read.
• Google — database backups are copied to a Google Drive folder as an off-machine recovery point. A backup is a snapshot of the whole database, so it contains the same personal data the live service does, including email addresses. We keep a rolling set of the most recent backups (currently the last 14) and delete older ones automatically.
• Google, again, separately — fonts. Generating a share-card image fetches font files server-side from Google’s font hosting (fonts.gstatic.com) each time. A request for a public file, not something your browser does directly, and it carries no personal data — but it’s a second, distinct touchpoint with Google beyond the backup copies above, so it gets its own line rather than being folded into that entry.

A few more services power the music side of the product. None of them receives anything that identifies you — no email, no username, no account identifier:

• MusicBrainz / MetaBrainz Foundation — the open music encyclopedia behind every artist, album, and track on the site. We send search terms and MusicBrainz IDs; never your email, username, or any personal identifier.
• Cover Art Archive — album art, looked up by MusicBrainz ID only.
• Deezer — supplies the 30-second preview clips you can play on the site, and helps us match a track to its recording. We send track and artist text, or a track identifier; nothing about you.
• Odesli — when you paste a streaming link into the app to add something, we send that link to Odesli to work out which record it points at. It receives the link you pasted, not who pasted it.

We do not sell or share your personal data with anyone for their own purposes, and we do not license your annotations or notes to train models.

How long we keep it

We keep your data for as long as your account exists. Delete your account and we delete it — your profile, your collections and playlists, every note and Diary entry, your likes, your follows, your uploaded avatar and cover images — in one operation, straight away. It is gone from the live service immediately; there is no grace period, no soft-delete, and no queue.

Two honest footnotes to that. First, backups: your data will still exist in the rolling database backups described above until those snapshots age out, which at present is roughly a week. We don’t touch backups to remove individual accounts — restoring one is an emergency measure, not routine — but they expire on their own and are not used to repopulate the live service. Second, a very small amount of usage data (which release a copy-to-search action came from) is not linked to any account in the first place, and stays as anonymous counts.

You can delete an individual collection at any time without touching the rest of your account. You can export everything you’ve made, in an open format, from your dashboard at any time — before or independent of deleting anything.

Your rights

Under the GDPR, you can ask us to:

• Access — a copy of the personal data we hold about you. Most of it already is: the “Account data” export in your dashboard (see Port, below) covers your profile, follows, likes, Top Four, Diary, saves, and dismissed-tips history in one file. It leaves out the internal note-mirror described above, and two long-retired features (an early listening-log and an early curator-notes tool) that predate the current site and hold almost nothing. Email us for those, or for anything else Access should have covered.
• Rectify — correct anything that’s wrong (most of this you can already edit directly from your profile and settings).
• Erase — delete your account and everything tied to it. Self-serve, from Settings, no need to ask us.
• Port — take your data with you in a usable format. Also self-serve, from your dashboard’s export page.
• Object — to processing based on our legitimate interest (the technical/logging category above).

For anything not already self-serve in the product, email privacy@permanentindex.com and we’ll handle it directly — there’s no support queue to get lost in yet.

If you’re in the EU and believe we’ve mishandled your data, you can complain to your local supervisory authority. In Portugal, where Permanent Index is based, that’s the Comissão Nacional de Proteção de Dados (CNPD).

Children

Permanent Index isn’t directed at children under 16. Please don’t create an account if you’re under 16.

Changes

If we change this policy, we’ll update the date at the top. A change that meaningfully affects how we use your data will be communicated before it takes effect, not just quietly dated.