Privacy Policy
What personal data Muzazaa collects, why, and how you can control it. We design for privacy from the start.
Last updated 30 June 2026.
Who we are and which law applies
Muzazaa is an independent catalog of the Ukrainian music scene. We process personal data under Ukraine's Law on Personal Data Protection (No. 2297-VI).
The service targets users in Ukraine; we also follow GDPR principles.
What data we collect
The personal-data surface is deliberately minimal: your email, your display name from your sign-in provider, OAuth provider IDs, and text you submit yourself (such as artist suggestions).
To protect the service and prevent abuse, we process technical data such as your IP address (via Cloudflare, rate-limiting, and form protection).
We collect no payment data, no health data, and no children's data.
How we use data
We use data to show the catalog, to sync your liked tracks to Spotify on your action, and to process the suggestions you submit. We do not sell personal data.
OAuth tokens
When you sign in with Spotify, refresh tokens are stored encrypted. Access tokens are held only in a short-TTL cache.
We do not write tokens to logs.
Scope minimisation
We request only the Spotify scopes we actually use. Currently these are user-library-modify, user-read-email, and user-read-private. For Google sign-in we take only basic profile and email. We take no speculative scope grants.
Third-party processors
We share the minimum necessary data with trusted processors: Spotify (sign-in and catalog), Cloudflare (protection and delivery), and hCaptcha (bot protection on forms).
Your rights
You have the right to access, rectify, and erase your data. Deleting your account triggers a cascade: your submissions are soft-deleted (moderation history is preserved), your listening history is permanently deleted, and your profile data is cleared.
To exercise your rights, delete your account in profile settings or contact us.
Contact
For privacy questions, write to [email protected].