Privacy Policy

This notice is provided under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). It describes how Classikal processes personal data when you create an account or use logged-in features.

Controller

The controller is Alin Sfirschi. Contact: a.sfirschi@gmail.com.

What we process

• Account data you submit: email address, optional display name, and a password stored as a bcrypt hash (we never store the plaintext password).
• Account content: favorites and playlists you create, including whether a playlist is public.
• Technical data needed to operate the site: IP address used for short-lived rate limiting, session cookie, and standard server logs.

The public encyclopedia (composers, works, recordings, performers, releases) is catalog data, not your personal data.

Purposes and legal bases

• Creating and operating your account, favorites, and playlists — contract (GDPR Art. 6(1)(b)).
• Securing the service (rate limits, abuse prevention, session integrity) — legitimate interests (Art. 6(1)(f)).
• Loading third-party players (Spotify embeds) only after you click to load them — your request to receive that content (Art. 6(1)(b)) / consent to communicate with Spotify (Art. 6(1)(a)). Until you click, we do not load Spotify cookies or trackers.

Classikal does not use Google Analytics, Google Tag Manager, or similar advertising/analytics pixels.

Recipients

Hosting and database providers that store this site process account data on our instructions. If you load a Spotify embed, Spotify (Spotify AB) receives the request from your browser according to Spotify's own privacy policy. We do not sell personal data.

Retention

Account data is kept until you delete the account. Session cookies expire after 7 days of inactivity at most. Rate-limit records are in-memory and short-lived (minutes). Server logs are rotated by the host.

Your rights

You may request access, rectification, erasure, restriction, and portability of your personal data, and you may object to processing based on legitimate interests. You can delete your account yourself at Account when signed in. To exercise other rights, email a.sfirschi@gmail.com. You may lodge a complaint with the Garante per la protezione dei dati personali (Italy) or with the supervisory authority of your EU/EEA country of residence.

Cookies

We set an HTTP-only session cookie after you sign in, strictly necessary to keep you authenticated. There is no advertising cookie wall. Optional third-party cookies from Spotify are set only if you choose to load an embed.

Children

The service is not directed at children under 16. Do not create an account if you are under 16.

Changes

Material changes to this notice will be reflected on this page with an updated date. Continued use of an account after an update constitutes notice of the new text; we do not use this as a substitute for consent where consent is required.