Privacy notice

Who is responsible

41BIT LLC operates song-voyage.xyz and is the controller for the personal data it uses to provide this website.

Contact us at info@41bit.io. This notice covers Song Voyage, not every product distributed by 41BIT.

Guest sessions and saved choices

Starting a voyage creates a guest identifier and a session cookie. We store the session token, timestamps, expiry, and available IP address and browser information. Our authentication software also creates a generated placeholder email address. You do not provide that address or receive mail through it.

We store the song pairs, your choices, the catalog version, creation and completion times, and random result identifiers. Daily voyages also store the UTC challenge date. A replay also stores a reference to the original result. If you add a name, we store it with that result. A name is optional and does not verify identity.

These records let you continue in the same browser, save choices, and compare the same songs with a friend. Request counters help prevent abuse. Guest access is pseudonymous, not fully anonymous.

We use your saved choices to avoid repeating song pairs in new custom voyages. When all eligible pairs have been used, we prefer pairs you have compared fewer times. Daily voyages and shared replays keep their saved pairs.

We use the choices to count broad musical styles and show a taste label. That label has no legal or similarly significant effect. Song Voyage does not access your Spotify account, playlists, or listening history.

Administrator accounts

Administrators sign in with an email address and password. We store their name, email address, password hash, role, and session records to restrict editing of daily song selections. Public visitors do not need an administrator account. Administrator previews do not save song choices or add to public totals.

What a result link reveals

A completed result is accessible to anyone who has its random link, even before you press Share. It shows the selected songs, optional name, and any source result used for a replay.

Results show both songs in each pair and how often each was chosen. Totals include saved choices from unfinished voyages. Daily results count choices for that challenge date, with one saved entry per guest. Custom results show global counts for each song pair; another custom voyage can contribute again. These counts contain no guest identifiers.

A comparison shows both completed sets of choices, both optional names, and the number of matching choices. Guest identifiers, session tokens, IP addresses, and private voyage identifiers are not included in public result responses.

Links can be forwarded, copied, or published elsewhere. A random link is not a password. Use a nickname or leave the name blank if you do not want your name associated with your choices.

Cookies and your browser

Our guest session cookie is needed to recognize your browser and protect your saved progress. Its name is better-auth.session_token, with a __Secure- prefix on HTTPS. Its lifetime is seven days and can renew when you return. Cookie expiry does not delete saved voyages.

Blocking or clearing this cookie can prevent you from continuing or editing your result. Clearing browser data does not delete server records or disable an existing public link.

Song Voyage adds no analytics, advertising pixels, or session-replay tools. Fonts are served with the site. This does not describe the separate data practices of embedded Spotify content.

Spotify and YouTube

Spotify embeds and its playback script load automatically when an active song pair opens. Your browser connects to Spotify before you press Play. Spotify receives connection information such as your IP address, browser information, and the site origin. It may use cookies or recognize an existing Spotify session.

Spotify controls playback and its own data use. See its privacy policy and cookie policy. This notice does not make those cookies necessary for saving your Song Voyage choices.

YouTube is a separate link, not an embedded player on Song Voyage. It opens only when you follow a YouTube link. Google's privacy policy then applies to that service.

Hosting, providers, and international processing

Vercel hosts the website and handles network requests and operational logs. Neon provides the database for guest sessions and voyages. Better Auth is authentication software running within our service, not a separate sign-in account provider.

41BIT LLC is a United States company. Hosting, support, and provider operations may involve processing outside your country, including in the United States. A database hosted in Europe does not mean every provider operation stays in Europe.

Provider terms describe the transfer safeguards that apply, including standard contractual clauses where applicable. Read Vercel's data-processing terms, Vercel's subprocessor information, and Neon's data-processing terms. Contact us for information about safeguards relevant to your data.

We may disclose information when required by law or needed to handle a legal claim. If you email us, we use your address and message to respond.

Why we use this data

Where the GDPR applies, we use guest and voyage data to provide the service you request under Article 6(1)(b). Our interests in keeping the website secure, preventing abuse, and answering general inquiries support processing under Article 6(1)(f). Legal duties may require processing under Article 6(1)(c).

Session data and song choices are needed to save a voyage. You can leave the optional name blank. Spotify's separate privacy policy explains its processing and legal bases.

How long records remain

Guest records and saved voyages do not expire automatically. They remain stored to keep progress, shared results, and comparisons available. Expired sessions can be removed when they are next checked. There is no fixed automatic deletion period for all server records.

Security counters and provider logs have separate lifecycles. The rate-limit window is not a promise that all associated data is erased when that window ends.

You can request deletion at info@41bit.io. Include a result link if available. We may need to verify that a request concerns your data. Do not send session cookies or authentication tokens by email.

Deleting an original result can make its comparisons unavailable. Another person's independent replay and copies already shared outside Song Voyage may remain. Legal obligations or claims can require some records to be kept longer.

Your privacy rights

Depending on applicable law, you may request access, correction, deletion, restriction, or a portable copy of your data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to info@41bit.io. You may also complain to a data-protection authority, including one where you live or work. Find an EEA supervisory authority.

We update the date on this page when this notice changes. The legal notice contains the company details and music rights information.