Legal
Privacy policy
Plain language, no surprises. Last updated 19 October 2026.
This policy explains what Scratch Storage (“we”) collects when you use scratchstorage.com and the Scratch Storage app, why, and what you can do about it. We collect as little as the product needs, and we do not sell personal data.
What we collect
- Account email. You sign in with a magic link sent to your email address. We store the address, the time you signed up and when you last signed in.
- Spotify tokens, if you connect Spotify. To show your Spotify playlists and Liked Songs in the app we store the access and refresh tokens Spotify issues. They are kept server-side, encrypted at rest by the database, used solely to read the playlists you ask for, and deleted when you disconnect Spotify or delete your account. If you also allow Spotify playback in DJ mode, a short-lived access token is passed to your own browser so Spotify’s player can stream previews there.
- Your library. The audio files in your library are stored on our servers, together with the metadata we derive from them (BPM, key, genre, loudness, waveform, duration, format), the tags you edit, and the playlists, USBs and mix recordings you keep. Files are content-addressed: if two accounts upload the same file, one copy exists and both libraries reference it.
- Activity records. The jobs the app runs for you, such as uploads and analysis, so the app can show you what it did and so we can fix it when it fails.
- Technical logs. Standard server logs (IP address, user agent, timestamps, errors), kept briefly for security and debugging.
How we use it
- To run the service: sign you in, store and analyse your music, stream it to you and export it to your USB stick.
- To keep the service working and safe: rate limiting, abuse prevention, debugging.
- To contact you about your account or material changes to the service. No marketing emails unless you ask for them.
We do not sell personal data, we do not run advertising, and we do not share your library or activity with other users.
Analytics and cookies
- Analytics: Vercel Analytics, which is cookieless and aggregates page views without identifying you. No advertising or cross-site trackers.
- Cookies: a session cookie that keeps you signed in. That is all. Your theme preference (dark or light) is stored in your browser’s local storage, not sent to us.
Where data lives and how it is protected
Account data and metadata live in a managed database that encrypts data at rest; audio files live in object storage on our servers. Data in transit is encrypted (HTTPS).
Who can see your library
Other users can’t see your account, your library or your activity. If you share a playlist or USB, anyone with its link sees that list’s song details (titles, artists, covers, BPM, key and your display name), never your files; turning sharing off makes the link stop working. The people who operate Scratch Storage can: an admin console shows account details, such as email and sign-in dates, and the tracks and files in each library. We use that access only to run the service, give support, investigate abuse, and respond to legal requests such as copyright complaints under our terms. We don’t browse libraries for any other reason.
Who else sees anything
- Hosting and database providers that run the infrastructure on our behalf.
- Spotify, only if you connect it, under Spotify’s own terms.
- Music metadata services (MusicBrainz, Spotify’s catalogue and AcoustID), which receive track titles, durations or audio fingerprints to identify recordings and fetch cover art. No personal data is included.
- Authorities or rights holders, if the law requires it or under the takedown process described in our terms.
Retention and deletion
Your data is kept while your account exists. To delete your account, email hello@scratchstorage.com from the address you signed up with; we remove your account, your playlists and USBs, your Spotify tokens and your library references. Because identical files are stored once, a file is deleted from storage when no remaining library references it. Server logs expire on a rolling basis.
Your rights
Depending on where you live you may have rights to access, correct, export or delete your personal data, or to object to how it is used. Email hello@scratchstorage.com and we will act on it. You can export your entire library at any time from the app.
Children
Scratch Storage is not directed at children under 16, and we do not knowingly keep their accounts.
Changes
If this policy changes in a way that matters, we will say so on this page and, for significant changes, by email. The date at the top tells you when it was last revised.