Legal
Privacy policy
Plain language, no surprises. Last updated 17 October 2026.
This policy explains what Crateseek (“we”) collects when you use crateseek.com and the Crateseek app, why, and what you can do about it. We collect as little as the product needs, and we do not sell personal data.
What we collect
- Account email. You sign in with a magic link sent to your email address. We store the address, the time you signed up and when you last signed in.
- Spotify tokens, if you connect Spotify. To show your playlists and Liked Songs we store the access and refresh tokens Spotify issues. They are kept server-side only, encrypted at rest by the database, used solely to read the playlists you ask for, and deleted when you disconnect Spotify or delete your account.
- Your library. The audio files you download through Crateseek or upload to it are stored on our servers, together with the metadata we derive from them (BPM, key, genre, loudness, waveform, duration, format) and the sets you build. Files are content-addressed: if two users save the same file, one copy exists and both libraries reference it.
- Search and activity records. The searches you run, the links you paste and the resulting downloads, so the app can show you what it did and so we can fix it when it fails.
- Technical logs. Standard server logs (IP address, user agent, timestamps, errors), kept briefly for security and debugging.
How we use it
- To run the service: sign you in, find and store music, analyse it, stream it to you and export it to your USB stick.
- To keep the service working and safe: rate limiting, abuse prevention, debugging.
- To contact you about your account or material changes to the service. No marketing emails unless you ask for them.
We do not sell personal data, we do not run advertising, and we do not share your library or activity with other users.
Analytics and cookies
- Analytics: Vercel Analytics, which is cookieless and aggregates page views without identifying you. No advertising or cross-site trackers.
- Cookies: a session cookie that keeps you signed in. That is all. Your theme preference (dark or light) is stored in your browser’s local storage, not sent to us.
Where data lives and how it is protected
Account data and metadata live in a managed database that encrypts data at rest; audio files live in object storage on our servers. Access is limited to the people who operate the service and is used only to run and fix it. Data in transit is encrypted (HTTPS).
Who else sees anything
- Hosting and database providers that run the infrastructure on our behalf.
- The Soulseek network. Searches and downloads happen from Crateseek’s own node under its own username. Other Soulseek users see the node, not you. Files in the shared library are made available back to the network from that node.
- Spotify, only if you connect it, under Spotify’s own terms.
- AcoustID and MusicBrainz, which receive audio fingerprints and track titles to verify recordings. No personal data is included.
- Authorities or rights holders, if the law requires it or under the takedown process described in our terms.
Retention and deletion
Your data is kept while your account exists. To delete your account, email hello@crateseek.com from the address you signed up with; we remove your account, your sets, your Spotify tokens and your library references. Because files are shared and content-addressed, a file is deleted from storage when no remaining library references it. Server logs expire on a rolling basis.
Your rights
Depending on where you live you may have rights to access, correct, export or delete your personal data, or to object to how it is used. Email hello@crateseek.com and we will act on it. You can export your entire library at any time from the app.
Children
Crateseek is not directed at children under 16, and we do not knowingly keep their accounts.
Changes
If this policy changes in a way that matters, we will say so on this page and, for significant changes, by email. The date at the top tells you when it was last revised.