shhhift
Privacy policy.
This policy explains which personal data the shhhift app processes, for what purpose and what your rights are, under Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD").
1. Who the controller is
shhhift is run by Rafael, an individual resident in Brazil, who is the data controller. For any privacy matter, including exercising your rights, write to shhhift.contact@gmail.com. This is also the channel of the data protection officer (LGPD, art. 41).
2. What shhhift does
shhhift creates playlists on Spotify and YouTube Music from a text request, a song list, a transition between two artists or an existing playlist. Playlists are created in shhhift's own account on each platform, never in yours. You get the playlist link inside the app. shhhift doesn't ask for access to your Spotify or Google account.
3. Data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email and account identifier. If you sign in with Google or Apple, also the name and identifier they provide (Apple lets you hide your email). | Create and keep your account and let you sign in. | Performance of a contract (art. 7, V) |
| Password (only if you use email and password). It is stored encrypted by the authentication provider; shhhift has no access to it. | Sign-in. | Performance of a contract |
| History of the playlists created for you: name, platform, link, type, number of tracks and date. | Show your playlists in the Playlists tab. | Performance of a contract |
| Your "About you" answers: age range (required) and, if you choose to answer, the streaming services you use, whether you pay for any, what you'll use shhhift for, how you found it and the referral code. | The age range is used to apply the rules that protect children and teenagers. All answers are analyzed together with other users' answers, without identifying anyone, to choose shhhift's next platforms and plans and to understand how people find it. | Legitimate interest (art. 7, IX) |
| Your choice to receive news by email. | Send shhhift news only to those who opted in. You can opt out at any time in Profile > About you. | Consent (art. 7, I) |
| The text of the request, the song list, the transition artists or the link of the playlist to migrate. | Build the playlist and understand what was asked when we evaluate the recommendations. It is stored linked to your account and erased when you delete the account. | Performance of a contract and legitimate interest (art. 7, IX) |
| The songs shhhift proposed and which ones you kept (✓) or removed (✕) before creating the playlist. | Measure the quality of the recommendations and improve the model. When you delete the account, these choices are no longer linked to you. | Legitimate interest (art. 7, IX) |
| "Natural" or "odd" votes on the steps of a transition. | Improve transitions. Votes are stored without any link to your account. | Legitimate interest (art. 7, IX) |
| Technical access logs (IP address, date and time, route accessed). | Security, abuse prevention and bug fixing. | Legitimate interest and compliance with a legal obligation (Brazilian Internet Civil Framework) |
shhhift doesn't collect location, contacts, photos, payment data or sensitive personal data. It also doesn't use advertising, doesn't sell data and doesn't build profiles for third parties.
4. What is public on the platforms
Playlists live in shhhift's account: on Spotify, as public; on YouTube, as "unlisted", which only open for people who have the link. The playlist name (what you write or, if you leave it blank, the beginning of your request) and the tracks are visible to anyone who opens the playlist. Your name and email do not appear on it. So don't put personal data in the playlist name.
5. Who we share data with
Only with providers needed for the app to work, which process data on shhhift's behalf:
- Supabase: authentication and the accounts database.
- Server hosting provider: running the API and technical logs.
- Spotify and Google/YouTube: receive the playlist name and the track searches made by shhhift's account. Use of YouTube follows the YouTube Terms of Service and the Google Privacy Policy.
- Apple and Google, when you choose to sign in with those accounts.
We may also share data when required by law or a court order.
6. International transfer
Some of these providers store or process data outside Brazil. In those cases, the transfer follows art. 33 of the LGPD, with providers that offer contractual data protection guarantees.
7. How long we keep data
- Account, "About you" answers and playlist history: while the account exists. When you delete the account, we erase this data.
- Technical access logs: up to 6 months.
- Transition votes: indefinitely, because they don't identify anyone.
- Songs kept or removed in the review: indefinitely. When you delete the account, we erase the link to you and the request text.
Playlists stay in shhhift's account after you delete your account, with no link to you. If you want a specific playlist removed, ask through the contact email.
8. Your rights
Under the LGPD (art. 18), you may request at any time: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of unnecessary data; portability; information about who we share it with; and review of consent, when consent is the basis. You can delete your account in the app itself, in Profile > Delete my account, or ask by email. We reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).
9. Security
Communications are encrypted (HTTPS), passwords are stored encrypted by the authentication provider and access to data is restricted. No system is fully immune to incidents. If an incident brings relevant risk, we will notify you and the ANPD.
10. Children and teenagers
shhhift is not intended for children under 13, which is also the minimum age required by Spotify and YouTube. Teenagers should use the app with the supervision of their parents or guardians.
11. Changes to this policy
We may update this policy. The date at the top shows the version in force. Relevant changes will be announced in the app.