Privacy Policy

Dr Blender (“we”, “us”) runs the music identification service at www.drblender.com. We are the controller of the personal data described in this policy. You can reach us about privacy at any time at .

When you upload an MP3 or submit a link, we use the audio only to identify the tracks in it:

• Uploaded files are held in memory while they are processed and are never written to our disks.
• Audio from links is downloaded into a temporary folder for that one request and deleted as soon as it has been converted. An automatic cleanup removes anything left behind by an interrupted request.
• To identify tracks, the audio is sent to our recognition provider, AudD (see section 6).

We keep the results (artist, title, timestamps and links), not the audio.

• Account details from Google sign-in: your name, email address, profile picture link and Google account ID. We never see your Google password.
• Your blends: the links you submit or the names and sizes of the files you upload, the identified tracklists, and when each blend ran.
• Your Blend balance and purchases: how many Blends you have and have used, and for each purchase the plan, amount and PayPal order ID. We never receive or store your card or bank details.
• Spotify (only if you connect it): your Spotify user ID and display name, plus access tokens so we can create playlists you ask for.
• Emails and messages: whether you opted in to our newsletter, and anything you send through the contact form.
• Technical data: server logs with request times, errors and your account ID or email when something goes wrong, and your IP address, used briefly for rate limiting and security.

• To provide the service (identify tracks, keep your history, run your account, send blend summaries you request). Legal basis: performing our contract with you.
• To take payments and keep records. Legal basis: contract, and our legal obligation to keep financial records.
• To keep the service secure and working (logs, rate limits, fraud and abuse prevention). Legal basis: our legitimate interest in a safe, reliable service.
• To send our newsletter, only if you click “Yes, subscribe me” and confirm. Legal basis: your consent, which you can withdraw with the unsubscribe link in any newsletter email.

We don't sell your personal data, use it for advertising, or build advertising profiles. Tracklists we identify may be cached and shown again to anyone who submits the same link or file, and recently identified tracks may appear on the site, but never with your name or account.

We use these service providers. Each one only receives what it needs for its job:

• Railway: hosts our servers and database.
• Google: sign-in.
• AudD: music recognition. Receives the audio being identified.
• PayPal: payments. Handles your payment details directly, under PayPal's own privacy policy.
• Resend: sends our emails (welcome, blend summaries, newsletter, contact form).
• Spotify: only if you connect it, to create playlists.
• Network proxy providers: route our servers' downloads from YouTube and other platforms. They see the link being downloaded, not your account.

When you submit a link, our servers download it from that platform (YouTube, SoundCloud and others), and that platform's own terms and privacy policy apply to its content. We may also disclose data if the law requires it, or to protect our rights or our users' safety.

Some of these providers process data outside your country, including in the United States. Where the law requires it, these transfers rely on safeguards the provider offers, such as the European Commission's Standard Contractual Clauses.

• Audio: not kept (see section 2).
• Account, blend history and Spotify connection: until you delete your account or ask us to. Disconnecting Spotify deletes its tokens immediately.
• Purchase records: as long as tax and accounting law requires, even after account deletion.
• Server logs: rotated automatically and kept for a short time only.
• Cached tracklists: may be kept to answer future identical requests. They contain no personal data.

We only use what's needed for the site to work. No tracking, analytics or advertising cookies.

• Session cookie: set only during Google sign-in or Spotify connection, to protect that step against forgery.
• Local storage: your sign-in tokens and basic profile (so you stay signed in), your cookie-notice choice, and your accessibility-menu settings. The accessibility menu is loaded from the jsDelivr CDN and runs entirely in your browser.
• Offline cache: public pages and images, so the app loads faster and works offline. Your account data is never cached.

Signing out clears your sign-in data from the browser and ends the session on our servers.

All traffic is encrypted with HTTPS. Sign-in tokens are short-lived and are rotated automatically, refresh tokens are stored only as hashes, and access to personal data is limited to the people who run the service. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

Depending on where you live (for example under the GDPR in the EU/UK, or the CCPA in California), you can ask us to:

• give you a copy of your data, or send it to another service;
• correct it (you can change your name yourself on your account page);
• delete your account and data;
• restrict or object to how we use it; and
• withdraw consent (for example, unsubscribe from the newsletter) at any time.

Email from the address on your account and we'll respond within 30 days. We won't treat you differently for using these rights. You can also complain to your local data protection authority.

Dr Blender isn't meant for children under 16, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll delete it.

If we change this policy we'll update the date at the top. If the changes are significant, we'll also tell you by email or on the site before they take effect.