Traklyst
Sign in
Legal

Privacy policy

Last updated 12 October 2026.

Traklyst is built to need as little about you as possible: no advertising, no analytics cookies and no selling of data. This page explains what it does store, and why.

Who is responsible

Traklyst is run by Sander de Vries in the Netherlands, who is the controller for the personal data described here. You can reach him through the contact form.

What Traklyst stores

When you browse

Traklyst stores nothing about you when you browse. It does count which pages are opened, whether a page was the first of a visit, and a few anonymous actions such as copying or sharing a tracklist, seeing an offer or choosing a plan. With each count it keeps where the visit came from (the kind of site and its address, such as google.com, or the tag on the link), the country and region Cloudflare places it in, and whether it came from a phone, tablet or computer. To tell which clicks belong to one visit, a page gets a random number that lives only in its memory: it is not stored in your browser and is gone when you reload, so two visits cannot be linked. The counts hold no IP address, city, cookie, identifier stored in your browser or account, so they cannot be traced back to anyone. To deliver pages and keep attacks out, the network provider in front of Traklyst (Cloudflare) processes your IP address and basic request details.

When you scan a set

  • The link you paste and the tracklist Traklyst builds are stored and published on a public page. Only paste links to sets that are publicly available.
  • Without an account, Traklyst sets a cookie called traklyst_visitor with a random, signed ID, and keeps a keyed hash of your IP address. Both are used only to count free scans. The hash cannot be turned back into your address and is deleted when its counting period ends, after at most 31 days.
  • If you are signed in, the scan is linked to your account.
  • To tell people from automated scripts, scan requests can be checked by Cloudflare Turnstile, which looks at signals from your browser.

When you have an account

  • Your email address and, if you give one, your name.
  • When you ask for a sign-in link: a one-time code tied to your email address, deleted when it is used and useless after 5 minutes.
  • The tracklists you save.
  • If you join the waitlist for Starter or Pro: which plan, so we can tell you when it opens.
  • Your login sessions, including the IP address and browser they came from, to keep you signed in and to spot misuse of your account.
  • If you sign in with Google: your Google account ID and the email address it shares.

When you send a message or a correction

Your message and the link it is about. Your email address when you give it: the contact form asks for one, a correction to a tracklist does not.

Why, and on what legal basis

  • Providing scans and accounts is necessary to deliver the service you ask for (Article 6(1)(b) GDPR).
  • Counting free scans, preventing abuse and keeping Traklyst secure rest on a legitimate interest: keeping a free service available and its costs under control (Article 6(1)(f)).
  • Answering messages rests on a legitimate interest in replying to you (Article 6(1)(f)).

Traklyst does not send marketing email and does not build profiles of visitors. The only email about plans is the one you ask for by joining a waitlist.

Who else processes data

  • Cloudflare: network delivery, protection against attacks and bot checks.
  • Audio recognition services, such as ACRCloud: receive short audio fragments of the public mix for recognition. They receive nothing about you.
  • Anthropic: receives the public description and comments of a scanned set, to read the tracklist out of them. Those comments can include the usernames of the people who wrote them. Apart from that public text, it receives nothing about you.
  • Discogs: receives the artist and title of tracks, to look them up in its music database. It receives nothing about you.
  • Resend: sends account emails such as login links, and passes a message from the contact form on to the mailbox that answers it.
  • Google: only if you choose to sign in with Google.
  • Polar: sells Starter and Pro as merchant of record. If you buy a plan, it receives your account id from Traklyst, and collects your email address, payment details, billing address and tax details itself. Traklyst never sees your card.

Traklyst itself runs on its own server in the Netherlands. Where a provider above processes data outside the European Economic Area, it relies on the EU–US Data Privacy Framework or standard contractual clauses.

How long data is kept

  • Account data: until you delete your account, which you can do yourself at the bottom of your tracklists, or ask us to.
  • Login sessions: until they expire or you sign out.
  • IP hashes for counting scans: at most 31 days.
  • The traklyst_visitor cookie: up to 400 days, or until you clear it.
  • Messages: up to 12 months after they are handled.
  • Public tracklists: until they are removed.

Cookies

Traklyst only uses cookies it needs to work: traklyst_visitor to count free scans, and session cookies starting with better-auth. to keep you signed in. Because they are strictly necessary, they do not need your consent. Only in the browsers of Traklyst's own administrator, traklyst_admin keeps those visits out of the counts.

Your rights

You can ask to see, correct, delete or export the personal data Traklyst holds about you, ask for processing to be limited, and object to processing based on legitimate interest. Use the contact form. If you think your data is handled wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

When this policy changes, the date at the top changes with it. Significant changes that affect account holders are announced by email.