Privacy Policy
1. Overview
Tarotune ("the Service") values your privacy. This policy explains what information is collected when you use the Service and how it is handled. Operator: Independent developer Contact: tarotuneapp@gmail.com
2. Information We Collect
The Service collects the following information: • Mood input text: The sentence you enter to generate a playlist (up to 60 characters) • Session metadata: Session ID, creation time, export status, feedback results • Generated playlists: Song titles, artists, album info (based on Apple Music catalog) • Skip/refill feedback: Reason selections for skipped tracks • Apple Music user identifier hash: A one-way SHA-256 hash used to track daily usage limits (cannot be reversed to identify you) • Storefront region: Your Apple Music region (e.g., kr, us) for region-based music search • AI-generated metadata: Playlist title, mood summary, and quality score The Service does not require account registration and does not directly collect personally identifiable information such as names, email addresses, or phone numbers.
3. Cookies & Local Storage
• NEXT_LOCALE cookie: Stores language preference (ko/en), expires after 1 year • localStorage: Recent search history (up to 5 entries, auto-deleted after 30 days), list of created session IDs • sessionStorage: Current session playlist data (deleted when browser tab closes) • Secure Storage (mobile app): Your Apple Music user hash is encrypted and stored in iOS Keychain / Android Keystore. This data is deleted when you uninstall the app.
4. Third-Party Services
The Service uses the following third-party services: • Apple Music (Apple Inc.): Music search and playlist saving via MusicKit JS. Apple Music auth tokens are used only within the browser session and are not stored on our servers. • OpenAI (GPT AI): Primary AI processing for mood analysis and song recommendations. Your mood text is sent to the API. • Anthropic (Claude AI): Fallback AI processing used when the primary provider is unavailable. Your mood text may be sent to the API. • Supabase: Session data and playlist storage. • Google Analytics: Anonymous usage statistics for service improvement. • Vercel: Web hosting and serverless function execution. • Tally (tally.so): Optional user feedback forms. Tally's own privacy policy applies when you submit feedback.
5. Data Retention & Deletion
• Session data is stored indefinitely in Supabase for service improvement and trending mood display. • Public playlists (sessions exported by users) may be visible to other users via shared links. • Client-side data expires automatically: search queries after 24 hours, track states after 7 days, search history after 30 days. • Mobile app Secure Storage data is deleted when you uninstall the app. • To request data deletion, please email tarotuneapp@gmail.com with your session ID.
6. Children's Privacy
The Service does not knowingly collect personal information from children under 14. If we learn that a child under 14 has used the Service, we will promptly delete their data.
7. Security
The Service takes reasonable technical measures to protect data: • HTTPS encrypted communication • API rate limiting (30 requests per 60 seconds) • Input validation and content filtering • Prompt injection defense
8. Changes
This policy may be updated as the Service evolves. Significant changes will be communicated through in-service notices. For questions, please contact tarotuneapp@gmail.com.