played.fm

Privacy Policy

Last updated: 12 September 2026

This Privacy Policy explains how Played (“we”, “us”) collects, uses and shares information when you use played.fm (the “Service”). We keep it short and try to only collect what we need to run the Service.

Information we collect

  • Account data — your email, handle, display name, bio, and profile details you provide.
  • Content — the music, artwork and text you upload, and metadata about it.
  • Billing data — handled by our payment provider, Stripe. We receive confirmation and subscription status, not your full card details.
  • Fan data you collect — fan emails collected by your Follow button belong to you, and you can export them at any time. We store them so you can see and download that list; we never email your fans.
  • Usage data — basic logs, device/browser info, and analytics needed to operate and improve the Service.

How we use it

  • To provide, maintain and improve the Service and your storefront.
  • To process subscriptions, credits and (where applicable) merchandise orders.
  • To run creative tools you choose to use (cover art, mastering, descriptions).
  • To surface your public content in discovery, and to communicate with you about your account.
  • To detect abuse, enforce our Terms, and comply with the law.

Service providers we share with

We use trusted third parties to run the Service. They only receive what they need for their function:

  • Supabase — authentication, database and file storage.
  • Vercel — hosting and delivery.
  • Cloudflare — DNS, security and email routing.
  • Stripe — payment processing for subscriptions and credits.
  • Resend: account and transactional email delivery. We do not send artist newsletters or fan broadcasts.
  • AI tool providers (for example the services powering cover art, mastering and text) — process only the input you submit to a tool.
  • Printify — print-on-demand production and shipping, where you use merchandise.

We do not sell your personal information.

Cookies

We use essential cookies to keep you signed in and to run the Service, and minimal analytics to understand usage. You can control cookies in your browser; disabling essential cookies may break sign-in.

When you play music, a first-party listener cookie helps us estimate unique browsers and limit repeated chart votes. It lasts up to one year. Qualified-listen records include a hashed browser ID, track, playback surface, limited campaign tags and a referrer hostname. We strip arrival-page query strings apart from those limited campaign tags and do not store raw IP addresses with listens. Daily network hashes help limit abuse. These estimates do not identify verified individual listeners.

Saved tracks and your playback queue stay in your browser. They are not an account library and do not sync across devices. Clearing browser storage removes saved tracks. You can also remove saves from Your Library.

Listener cookies are partitioned by the site containing the player where the browser supports it. This lets embedded players count listening without using one shared ID to follow a browser across unrelated websites.

A separate browser-session cookie measures visits to our public landing and pricing pages and clicks on plan links. We store a hashed session identifier, page group, selected plan, broad device class and acquisition channel. We do not join this anonymous session to your account. This measurement respects the browser's Do Not Track setting.

We also record server-confirmed subscription checkout and account-claim milestones to check that signup is working. This measurement uses a hashed subscription reference, event type, plan and payment/trial state, separate from anonymous browser sessions.

Data retention

We keep your data while your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes and enforce agreements. You can delete your account, after which we delete or anonymise personal data except where we must retain it (for example billing records).

Detailed listening and anonymous signup-measurement records are removed after 90 days by the daily cleanup. Published chart snapshots retain aggregate counts and public track details. Artists can exclude their tracks from charts in the dashboard.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise these rights, email hi@played.fm. If you are in the EEA/UK or California, you have additional rights under the GDPR/UK GDPR and CCPA/CPRA respectively.

International transfers

We and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for such transfers.

Children

The Service is not directed to children under 18 (or the age of majority where you live), and we do not knowingly collect their data.

Changes

We may update this policy and will post the new version here with an updated date.

Contact

Questions or requests? Email hi@played.fm.