Privacy Policy
What personal data Muzazaa collects, why, and how you can control it. We design for privacy from the start.
Last updated 30 June 2026.
Who we are and which law applies
Muzazaa is an independent catalog of the Ukrainian music scene. We process personal data under Ukraine's Law on Personal Data Protection (No. 2297-VI).
The service targets users in Ukraine; we also follow GDPR principles.
What data we collect
The personal-data surface is deliberately minimal: your email, your display name from your sign-in provider, OAuth provider IDs, and text you submit yourself (such as artist suggestions).
To protect the service and prevent abuse, we process technical data such as your IP address (via Cloudflare, rate-limiting, and form protection).
We collect no payment data, no health data, and no children's data.
Your display name may be shown publicly next to your smart links, together with the number of times they were viewed.
How we use data
We use data to show the catalog, to sync your liked tracks to Spotify on your action, and to process the suggestions you submit. We also use aggregate, cookieless page-load statistics to measure how fast the site loads. We do not sell personal data.
OAuth tokens
If an admin enables Spotify for your account and you connect it from your profile, a Spotify refresh token is stored encrypted and used only to add and remove tracks in your Spotify Liked Songs when you like or unlike them. Disconnecting deletes it. Access tokens are held only in a short-TTL cache.
We do not write tokens to logs.
Scope minimisation
We request only the Spotify scopes we actually use. Currently these are user-library-modify, user-read-email, and user-read-private. For Google sign-in we take only basic profile and email. We take no speculative scope grants.
Third-party processors
We share the minimum necessary data with trusted processors: Google (sign-in), Spotify (catalog and liked tracks), Cloudflare (protection, delivery and cookieless aggregate page-load statistics), and hCaptcha (bot protection on forms).
Your rights
You have the right to access, rectify, and erase your data. Deleting your account triggers a cascade: your submissions are soft-deleted (moderation history is preserved), your listening history is permanently deleted, and your profile data is cleared.
To exercise your rights, delete your account in profile settings or contact us.
Contact
For privacy questions, write to [email protected].