Legal

Privacy Policy

There are no accounts here, so there is no profile of you to keep. What the server actually holds is a link while it is being processed, the audio it produced while that stays cached, a request log, and one number counted against your IP address for the length of a day. This page says what each of those is, how long it lasts, and who else your request touches on the way.

Last updated 2026-08-26

What this site never collects

• No account. There is no sign-up form, no login, no password and no email address needed to use anything here, the downloader included.
• No connection to your Spotify account. You are never asked to authorise one, and the service cannot see your library, your private playlists or your listening history — only what is publicly visible behind the link you paste.
• No download history attached to a person. Nothing stored ties a link to a name, an email or an account, because none of those exist. The request log is the one place an address and a path sit on the same line, and how long that lasts is stated below.
• No advertising identifiers, no fingerprinting script, and nothing sold, rented or handed to a data broker.
• No payment details. There is nothing here to buy.

What the server does hold, and why

• The link or search text you submit. It goes to the server, which reads the public metadata behind it — track titles, artists, durations, artwork addresses — and sends that list back to your browser. The result is cached for about ten minutes so a reload or a second paste of the same link does not repeat the lookup, and the expired copy is held about a day longer as an outage fallback — when Spotify stops answering, a day-old track list beats an error page. That cache is keyed by the link, never by whoever pasted it, and nothing beside it records who pasted it.
• Your IP address. Two uses, both defensive: rate limits, which stop one visitor saturating the download workers, and the daily track quota described in the next section. It is not used to build a profile, and the quota counter itself holds no list of what you downloaded.
• Request logs. Each request writes a line carrying its IP address, path, response status, user agent and timing. A download job writes more than that, and it is worth naming rather than hiding behind “internal ids”: the link you pasted, and for each track its title, its artist and its Spotify URL, alongside the job and track ids. That is what makes a failed download diagnosable, and it does mean a line describing what you downloaded sits beside your address for as long as the window below allows. Those lines are how a failed download gets diagnosed and how abuse gets found. They go to two places: a size-capped file on the host, which rotates — when it fills a new one starts and the oldest is deleted — and a search index on the same machine, which is what actually gets queried when something breaks. That index keeps 90 days, or five gigabytes of lines, whichever runs out first. So 90 days is the outside limit for a log line about your request, and a busy month reaches it sooner.
• The audio files. A job writes into its own folder, and a janitor pass deletes finished jobs and their folders twenty-four hours after they end. Separately, a finished track is kept in a shared cache keyed by a hash of the track, the format and the bitrate — never by who asked for it — so a popular song is fetched from its source once rather than a thousand times. That cache has two tiers and they expire differently: the copy on our own disk lasts seven days, or less when the size cap evicts it, while the copy in object storage behind it is kept indefinitely, because re-fetching a track nobody has asked for in a year still costs a download. Neither tier holds a visitor id — the key is the hash, so what is kept is audio, not people.
• Usage analytics. Page views, referrer, country, browser and screen size, plus a few product events — a link was resolved and how many tracks it held, a search happened, a track was saved, an interaction-latency measurement. Deliberately not in any of them: the link you pasted, the words you searched for, or the title of anything you played or saved. Analytics rows are kept for more than a year and are grouped into a visit, so a URL or a song title in one would be exactly the durable record of your listening that this page says does not exist. Each event is a row rather than a running total, and the rows are grouped by an id the tracker derives from your address and your browser instead of storing the address itself. Those product events run on our own infrastructure and their retention is in the table below. A separate production-only Google Analytics tag receives standard page views only; Enhanced Measurement is disabled for that data stream. It is loaded with analytics and advertising storage denied, Google Signals and ad personalisation disabled, and it is not sent the product-event stream or its job ids.

The one counter tied to your IP address

The counter is a single integer per address per day. It records how many tracks were accepted, not which ones — there is no list of songs beside it, and no way to reconstruct one from it. It is mirrored to a file on disk because the service restarts often, and a memory-only counter would hand out a fresh budget on every deploy. At 00:00 UTC the day rolls over and the previous day’s counts are dropped. If you share an address with other people — an office, a campus, a mobile carrier’s NAT — you share the budget with them too. That is the honest cost of running a quota without accounts, and the alternative would be asking you to create one.

Cookies, and the one thing kept in your browser

This site sets no analytics cookies. The Google tag is told that analytics and advertising storage are denied before it loads, and that state is never upgraded; it can send cookieless measurement requests to Google but cannot create or read analytics cookies. The quota is counted server-side against an address, and language is not stored in a cookie. There is no consent banner because this site offers no control that grants cookie storage.

One value is written to your browser’s own localStorage: your theme choice, stored under site-theme as system, light or dark. It stays on your device, is never sent anywhere, and the server has no idea what it says. Clearing site data removes it and the page goes back to dark.

The CDN in front of this site may set a security cookie of its own for bot mitigation. It belongs to that network rather than to us, carries no profile of you, and is not read by anything on this site.

How long each thing lasts

Who else your request reaches

• The CDN in front of this site. Every request passes through Cloudflare before it reaches the server, so that network terminates TLS and sees your address and the URL you asked for, and applies its own bot mitigation. It handles that as our infrastructure provider, under its own terms.
• Object storage for the shared track cache. It holds audio objects named by hash. No visitor identifier appears in a key or in an object.
• The audio sources. When a track has to be fetched, our server fetches it over its own outbound connection — not yours. The source sees a request from us and never learns your address. For the downloader, your browser only ever talks to this domain.
• Spotify. The same: the public metadata behind your link is read server-side. Pasting a link here tells Spotify nothing about you and does not touch your account.
• Apple, but only on the album art page. Searching by name there asks Apple’s public iTunes Search API, and the covers it returns are loaded from Apple’s image hosts — both by your browser directly rather than through this server, because that is the only way the bytes can be saved under a real filename. So for that one tool Apple receives your address, your browser and the words you typed, under Apple’s own terms. The Spotify half of the same page is read server-side and proxied, so it is not affected.
• Google Analytics. The production site loads Google's tag for cookieless page-view measurement. Enhanced Measurement is disabled, so Google does not receive the site's automatic scroll, outbound-click or file-download events. The page-view request still gives Google the ordinary network and browser information it carries, under Google's own terms. Analytics/ad storage, Google Signals and ad personalisation are disabled, and blocking the tag leaves every feature working normally. Product events remain in the self-hosted analytics described above.
• No ad network, data broker or mailing list. Google Analytics is the only third-party measurement service used here.

Your rights

Depending on where you live you may have the right to access, correct, erase, port or object to the processing of your personal data, and to complain to your local supervisory authority. Californian readers also have the right to know what is collected and to have it deleted, and to opt out of its sale — nothing here is sold, so that last one has nothing to act on.

The practical answer is that almost nothing held here is personal data in a shape we could look you up by: there is no record keyed to a name, an email or an account, and most requests resolve to “there is nothing to hand over”. What can genuinely be acted on differs by item, so here it is plainly. The daily quota count for an address can be reset on request. Log lines cannot: the store ages entries out on the 90-day and size-cap windows described above and has no selective delete, so an erasure request for them is answered with that fact and the date they expire, rather than with a deletion that did not happen.

How to ask

Email support@spotmp3.net with what you want done and enough detail to find it. Replies go out within 30 days and usually much sooner. Copyright complaints are not privacy requests and are handled separately — the copyright policy lists the address and the elements a notice should contain. What the service is, and what it may be used for, is set out in the terms of service.

Changes to this policy

The date under the heading moves whenever this text does, and because there is no account and no mailing list, that date is the only signal — check it if the wording matters to you. This policy covers spotmp3 and nothing else; a site you reach from a link here has its own.