Privacy

There is no account. The collection is stored in IndexedDB in this browser. Clearing site data deletes it, which is why the backup exists.

A lookup sends the barcode, or the artist and album you typed, to this app's server. That server asks MusicBrainz and, if needed, Apple's iTunes Search API. Cover images may then load from the Cover Art Archive or Apple. Those requests are the lookup you started, not a sync of your shelf.

Ask Music Ledger answers shelf questions on the device, including counts and whether you own something. The collection is not uploaded for those answers. If you ask it to find a song, album, or artist, that phrase is sent to this app's server so it can ask MusicBrainz. A question it cannot answer from the shelf can go to Vercel AI Gateway, which authenticates with OIDC on Vercel. No model provider key is stored in the repository.

Voice search on Chrome uses the browser's speech recognition and does not upload audio. On browsers without that API, a short clip is sent to this app, which transcribes it through Vercel AI Gateway and then discards the audio. The words are used for the lookup you started.

Dropbox, Google Drive, OneDrive, and pCloud run only if you connect them. A WebDAV server (Nextcloud, ownCloud, or a NAS) runs only if you enter its address and an app password. Sign-in stays in this browser. The token and that app password stay on this device. A backup file includes the shelf, the background, the type, and a custom background photo. The share sheet can save that file to Files, iCloud Drive, Mail, or a message. Emailing a backup opens your mail app. The file is not sent through a Music Ledger server.

A preview asks Apple's iTunes Search API from this browser and then streams a 30-second clip from Apple. The audio is not downloaded, stored, or sent through this app. The lookup text (not the audio) is cached on this device for a week. A Listen on Apple Music link can include an affiliate token if one was set when the site was built. If Apple has no preview, this browser asks Deezer for a fresh clip at the moment you press play. That signed address is not stored. Finding it can use the barcode, an ISRC from MusicBrainz (asked through this app's server), or an artist and title search. A Watch on YouTube link opens YouTube. It is not a player. An official video is used only when MusicBrainz already lists one. An optional YouTube key, if set, stays on the server and is off by default.

Sponsored links, when you enable them, are ordinary Amazon search links with an Associates tag. Amazon can see that you followed the link. Those rows are separate from previews.

Google Drive, when you connect it, uses only the drive.file scope (https://www.googleapis.com/auth/drive.file). Music Ledger can create and read the backup files it put in a Music Ledger folder. It cannot see the rest of the Drive.

Music Ledger does not sell personal data. There is no account, and the shelf is not uploaded for advertising.

Music Ledger does not include analytics.

Contact: privacy@musicledger.app (placeholder — replace this address before you publish).