Effective date: October 15, 2026
This policy explains what personal data the YMusicExport website (ymusicexport.com, the "Service", "we") collects, how we use it, and what rights you have. This policy applies only to the website; the Telegram bot has a separate policy.
1. Who we are
The Service is developed and maintained by a private individual. Contact for data matters: hi@aleqsanbr.dev.
2. What data we collect
Without signing in:
- the playlist link or other data you enter for an export. It is used only to fulfill the request and is not stored.
Account:
- your email address — if you sign in by email;
- profile data provided by a third-party sign-in service (for example, Telegram): ID, name, username, profile photo;
- information about sign-in code requests: email address, time of the request, and the code in hashed form. The code is valid for a limited time.
Connected music services:
- the access token issued by the music service after your confirmation. It is stored encrypted. We never receive the passwords to your accounts;
- the login or account ID in the music service;
- a copy of your music library to the extent you have granted access: playlists, liked tracks, albums and artists;
- for Spotify — the Client ID of your own Spotify app through which access is granted. We do not request or store the app's secret key (Client secret). We do not request the email or payment details of your Spotify account.
Access to the music service is used to read your library and, only when you start a transfer yourself, to write to it: create playlists, add tracks to them and add likes.
Technical data:
- IP address, date and time of the request, the requested page, browser information. Email addresses, sign-in codes and tokens are automatically excluded from technical logs;
- Service usage statistics: actions taken (visit, export, sign-in, transfer), their result and number of tracks, the domain of the referring website, device type. If you are signed in, the statistics are linked to your account. Visits without signing in are counted by an identifier that is renewed daily and does not make it possible to identify you; the IP address is not stored. Playlist contents are not recorded in the statistics.
We do not collect payment data, phone numbers or special categories of personal data.
3. How we obtain data
- From you — when you enter data on the website.
- From sign-in services — when you sign in through a third-party service and confirm the data transfer.
- From music services — when you connect an account and allow access to your library.
- Automatically — technical data when you access the website.
4. How we use data and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Signing in and account operation | email, sign-in service data, sign-in codes | providing the Service at your request |
| Sending sign-in codes | providing the Service at your request | |
| Displaying, exporting and transferring your library | token, login, copy of the library | your consent when connecting the service |
| Export without signing in | the link you entered | providing the Service at your request |
| Security and abuse prevention | technical data | our legitimate interest in keeping the Service operational |
| Statistics and improving the Service | usage statistics | our legitimate interest in developing the Service |
| Responding to inquiries | contact details, content of the inquiry | your request |
We do not make automated decisions that have legal or other significant effects on you, and we do not use data for profiling.
5. Marketing
We do not send promotional emails and do not show ads. Emails are sent only in connection with your account — for example, sign-in codes. We do not sell or rent out your data.
6. Who we share data with
Only with providers without which the Service cannot operate, and only to the extent necessary:
- hosting provider — hosting the website and data;
- email service — delivering emails with sign-in codes;
- music services you have connected (Yandex Music, Spotify) — requests to your library and searching for tracks by title during transfers. These services process data under their own privacy policies.
Providers may be located outside your country of residence, so data may be processed in other countries. Apart from this, we may disclose data only if we are required to do so by law — for example, under a court order.
7. How we store data and for how long
- Data is transmitted over a secure connection (HTTPS), access tokens are stored encrypted, sign-in codes are hashed, and access to the server is restricted.
- Account data is kept for as long as the account exists.
- Tokens, Client IDs and library copies are kept while the corresponding service is connected and are deleted after it is disconnected.
- Technical logs are kept for no more than 30 days.
- After an account is deleted, the data associated with it is deleted within 30 days.
8. Your rights
You have the right:
- of access — to find out what data we hold about you and to receive a copy of it;
- to rectification of inaccurate data — you can change your name, email and linked Telegram in your account settings;
- to erasure of your account and the data associated with it — you can do this yourself in your account settings;
- to restriction of processing and to object to processing based on our legitimate interest;
- to data portability — to receive your data in a machine-readable format;
- to withdraw consent — at any time, disconnect a music service on the "Accounts" page or revoke access in the settings of the service itself (for Spotify — at spotify.com/account/apps). Withdrawal does not affect the lawfulness of processing before it.
To exercise your rights, write to hi@aleqsanbr.dev. To protect your data, we may ask you to confirm that the account belongs to you, in a way that depends on how you sign in to the Service. We will respond as soon as possible.
9. Cookies and browser storage
How we use them. The website stores a session key in your browser's local storage (localStorage) so that you stay signed in and the interface language you selected. While you are signed in, the website also sets a cookie marking that you are signed in.
What types we use. Only those strictly necessary for the website to work. No analytics or advertising cookies are used; visit statistics are collected without cookies or third-party counters.
How to manage them. The key and the signed-in marker are deleted when you sign out. You can also delete them by clearing the site data in your browser settings — after that, you will need to sign in again.
10. Third-party services and websites
If you sign in through a third-party service (for example, Telegram), when you click the sign-in button the website loads that service's code from its servers. In doing so, the third-party service receives technical data about your visit — for example, your IP address and browser information — and processes it under its own privacy policy. The website also contains links to third-party services; this policy does not apply to them.
11. Children
The Service is not intended for persons under 14 years of age. We do not knowingly collect their data. If you believe a child has provided us with their data, write to us and we will delete it.
12. Changes to this policy
We may update this policy. The current version is always available on this page with its effective date. We will announce significant changes on the website in advance.
13. How to contact us
14. Where to complain
If you believe we are processing your data unlawfully, please write to us first — we will try to resolve the issue. You also have the right to contact the personal data protection authority of your country of residence.