Privacy Policy

What's public

Community is for sharing tags, so your profile is public by default: your handle, display name, bio, profile picture, and the music and tags you add on Community. If you use Tagify on your computer, you choose there what to publish, and you can pause or stop sharing at any time in Settings → Privacy.

Ratings, tagging stats, your status, links and badges are public only when you turn them on or add them. Comments and guestbook posts you write are public. Direct messages are visible only to the people in the conversation, and to moderators when someone reports a message.

What we collect

• Account: your email address (never shown to anyone), handle, display name, bio and profile picture.
• Your library: the tags, ratings, BPM, energy, key and playlists you add on Community or back up from Tagify on your computer, including local files' artist, album and title.
• Social: follows, blocks, comments, status posts, direct messages and reports.
• Connections you choose: your Discord account number (for the Discord badge), your Apple Music storefront country and library song IDs (when you connect Apple Music), and your answers to the optional sign-up question.
• How you found Community: when you create your account, the kind of place you arrived from (for example a search engine, an invite link or someone's profile card) and the kind of page you first opened (for example a guide or a tag page). Never the address of either.
• Now playing: the song you're playing is used only to find it on Community and isn't kept; when Community can't find it, its title and artists alone, never who's playing it, wait up to 10 minutes while Tagify searches Spotify for it, and stay as a stand-in song you can tag right away until the real song is found. Your tags on a stand-in are shown only to you. Once you add your Last.fm username, the song you're playing on Last.fm and your public tags on it show on your profile to everyone, unless you choose Mutual followers or Nobody in Settings › Now playing; Community reads it from Last.fm when someone views your profile and doesn't keep it. Songs read from your own Spotify app are never shown to anyone.
• Supporters: if you support Tagify on Buy Me a Coffee, the email address Buy Me a Coffee sends us, so we can show your Supporter badge.
• Security: network addresses are kept only as one-way scrambled codes, to limit abuse. Records of moderation decisions are kept as described below.
• Usage: see Analytics.

We don't sell or rent your data, and we don't use it for advertising.

Why we use it

• To run Community for you (our agreement with you): your account, profile, library, sharing, messages and connections.
• To keep Community safe (legitimate interest): rate limits, reports, moderation and preventing someone who was suspended from rejoining.
• To see how people find Community (legitimate interest): the kind of place you arrived from when you joined, counted only in totals.
• To improve Community (your consent): product analytics, only if you say yes.
• To meet legal obligations, such as answering a valid legal request.

Analytics

Community counts page visits and page speed with Vercel Web Analytics, which uses no cookies and doesn't identify you.

If you're signed in and say yes, Community also sends PostHog a fixed list of events, such as “added a tag”, so we can see which features help people. Events never include your name, email, music, tag names, messages or anything you typed, and PostHog doesn't record your network address or location. Each member is counted under a random-looking ID instead of their account. You can change your answer any time under “Share usage stats” in Settings → Privacy, and nothing is sent if your browser sends a Global Privacy Control signal.

When you delete your account, nothing links those events to you any more, so they stay only as anonymous counts. For accounts created before October 27, 2026, the ID was derived from the account's profile number in a way someone with access to both could have matched; deleting your account removes that link too.

Your browser keeps where you first arrived from (for example “a search engine”, never the address) only after you agree to analytics. Community also stores your sign-in and some settings in your browser so the site works.

Who helps us run Community

These services process data for Community, each only for its part:

• Supabase: database, sign-in and file storage.
• Vercel: hosting (Montreal, Canada) and cookie-free web analytics.
• PostHog: product analytics, in the United States, only with your consent.
• Resend: sending sign-in, unread-message and streak reminder emails.
• Discord, Spotify, Apple Music, Last.fm and YouTube: only when you connect, sign in with or play something from them. Their own privacy policies apply to what you do there.
• Buy Me a Coffee: tells us who supported Tagify.

Some of these services store data outside your country, including in the United States and Canada. Where the law requires, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep things

• Your account, profile, library and messages: until you delete them or your account.
• Discussion posts and comments you wrote: they stay after you delete your account, shown as “Deleted member” without your name.
• Answers to the sign-up question, how you found Community, Tagify usage counts and surveys: 24 months.
• Buy Me a Coffee supporter emails that don't match a Community account: 24 months after the last support. A supporter email that matches your account is deleted with it.
• Deleted tags you can restore: 30 days. Spotify links you added: 90 days. Rate Your Music imports in progress: 7 days after you last worked on them.
• If an account was suspended and then deleted, the moderation record and a scrambled code of its email: one year, to prevent rejoining during a suspension.

Your choices and rights

In Settings → Privacy you can download everything Community stores about you, change what's shared, block people and delete your account. Deleting your account removes your profile, library, messages, backups and connections straight away.

Depending on where you live (for example under the GDPR in the EU and UK, the CCPA in California, or PIPEDA and Québec's Law 25 in Canada), you also have the right to access, correct, delete or move your data, to object to or restrict how it's used, and to withdraw consent. Email privacy@tagify.fm and we'll answer within 30 days. You can also complain to your local data protection authority, or in Canada to the Office of the Privacy Commissioner.

Age

You must be 16 or older to use Community. If we learn an account belongs to someone younger, we delete it.

Security

Connections are encrypted, private data is readable only by its owner, and access to the database is limited. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

Changes

If we change this policy in a way that matters, we'll say so on Community before the change takes effect. See also the Terms and the legal notice.