Privacy Policy

We collect only the data necessary to provide and protect the service. We do not ask for, and do not store, personal details such as your name, email, phone number, or payment information.

• No account data: the service works without sign-up or login, so we never collect registration information, passwords, or profile details.
• Server request logs: your IP address, browser user agent, and preferred locale are recorded automatically by our hosting provider for security, debugging, and abuse prevention. These logs are retained for up to 30 days.
• Conversion history: when you convert a Spotify link, we store the submitted URL, conversion status, track count, and duration of the request in our database. This record is retained for up to 90 days to prevent abuse and improve reliability.
• Cookies and analytics identifiers: anonymous identifiers placed by third-party analytics services (see the Cookies section below).

We use the limited data we collect strictly for the following purposes:

• Operate the conversion service: fetching Spotify metadata, producing MP3 files, and delivering them to your browser.
• Prevent abuse: detecting automated scraping, excessive requests, and security incidents through IP-based rate limiting.
• Improve the service: measuring aggregate usage patterns, feature adoption, error rates, and performance.
• Comply with legal obligations: responding to valid legal requests, enforcing our Terms of Service, and protecting the rights and safety of users and the public.

We use a small number of third-party services to operate and analyze the site. Each sets its own cookies or identifiers. You can block or delete these cookies in your browser at any time; the core conversion functionality does not depend on them.

• Google Analytics 4 (GA4) — measures aggregate page views, sessions, and traffic sources. Data is processed by Google; see Google's privacy documentation for details.
• Microsoft Clarity — records anonymized session heatmaps and interaction patterns to help us improve the user experience. IP addresses are truncated.
• Google Tag Manager — loads the analytics scripts above in a consent-aware manner.
• Ko-fi donation widget — loaded only when you interact with the donation button; subject to Ko-fi's own privacy policy.

We do not sell, rent, or trade your data to advertisers or data brokers. The limited data we collect may be processed by the following service providers strictly to run the site:

• Cloudflare — provides hosting, edge compute (Workers), the database (D1), and DDoS protection. Request logs and conversion records are stored in Cloudflare infrastructure.
• Google and Microsoft — process anonymized analytics events on our behalf under their respective data protection agreements.
• Law enforcement or regulators — only when required by a valid legal process, and only to the minimum extent necessary.

Server request logs are retained for up to 30 days. Conversion records are retained for up to 90 days. Analytics cookies follow each vendor's default retention (typically 2 years for GA4 and 1 year for Clarity). After these periods, data is automatically purged or anonymized. We do not retain audio files produced by the converter — they are delivered to your browser and discarded from our infrastructure immediately.

Depending on your jurisdiction (in particular the EU, UK, and California), you have the following rights regarding your personal information. Because we collect so little data and do not require an account, most requests can be resolved by clearing your browser state, but we will honor any lawful request:

• Right of access — request a copy of the data we hold about your recent activity.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — request deletion of your conversion history or log entries tied to your IP.
• Right to restrict processing — ask us to stop processing your data in certain circumstances.
• Right to data portability — receive your data in a common, machine-readable format.
• Right to object — object to processing based on legitimate interests, including analytics.

MusicFab is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

MusicFab is hosted on Cloudflare's global network, which means your requests may be processed in data centers outside your country. Where data is transferred out of the EU, UK, or other regulated regions, we rely on Standard Contractual Clauses and the compliance programs of our service providers to maintain an equivalent level of protection.

All traffic to and from MusicFab is encrypted in transit using HTTPS. We apply least-privilege access controls to our hosting and database, and we do not store the MP3 files produced by the converter. No method of transmission or storage is 100% secure, but we continuously review our practices to reduce risk.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The 'Last updated' date at the top of this page indicates when the most recent changes were made. Your continued use of the service after an update constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us at privacy@MusicFab. We will respond to reasonable requests within 30 days.