Privacy Policy

Who we are

Stick is operated by Not a Soul, a partnership based in the UK. We are the data controller for the personal data described in this policy. Contact us at contact@stick.tools for any data-related requests. We are not required to appoint a Data Protection Officer at our current scale.

What we collect

• Account info: username, email address, and (if you set one) a passkey credential or avatar image.
• Listening history you import or log: artist, album, track, and play timestamps, plus the source (Last.fm, Spotify, Apple Music, Plex, or manually logged).
• Basic technical data needed to run the service, such as session identifiers and error logs.

How we use it

Your listening history is used solely to generate the stats, charts, and recommendations you see in the app. We don't sell your personal data, and we don't share it with anyone else.

Lawful basis for processing

We process your personal data under the following lawful bases (UK GDPR / GDPR Article 6):

• Account data & session — necessary to perform the contract of providing the service to you.
• Listening history you import — necessary to perform the contract (powering your stats and recommendations).
• Technical and error logs — our legitimate interests in operating and securing the service reliably.
• Sign-in and verification emails (Amazon SES) — necessary to perform the contract (sending codes you explicitly request to log in or verify your email).

Cookies & local storage

Strictly necessary (set without consent — required for the service to work):

• stick_session — a session cookie that keeps you signed in.
• stick-* keys in your browser's local storage — your theme, colour scheme, and other display preferences.

We don't currently set any advertising or analytics cookies.

Advertising

Stick does not currently show ads. If we introduce advertising in the future (e.g. via Google AdSense) to help cover hosting costs, we'll update this policy first and ask for your consent via an on-screen banner before any ad technology loads — Pro subscribers will never be shown ads, whether or not we introduce them for the free tier.

International data transfers

Some of our third-party processors are based in the United States:

• Amazon SES — processes sign-in and verification emails. Transfers from the UK/EEA are covered by the EU–US Data Privacy Framework adequacy decision and AWS's Standard Contractual Clauses.

MusicBrainz is operated by the MetaBrainz Foundation, a US non-profit. We send only artist, track, and album names to look up metadata — no personal data about you is sent to MusicBrainz. Email contact@stick.tools if you'd like more detail on any transfer.

Data retention & deletion

• Your listening history, account data, and session records are kept for as long as your account exists.
• When you delete your account (Settings → Danger Zone), all personal data is permanently deleted from our database immediately.
• Server access logs (including IP addresses) are automatically rotated and retained for a short period sufficient for security and debugging purposes. They are not tied to your account and are not deleted on account deletion.
• Records of plays you deliberately deleted (kept to prevent accidental re-import) are removed when your account is deleted.

You can also delete individual plays, an entire import, or your whole account via Settings → Danger Zone without waiting.

Your rights

Depending on where you live, you may have some or all of the following rights regarding your personal data. To exercise any of them, email contact@stick.tools — we'll respond within 30 days (45 days for California requests).

• Access — request a copy of the personal data we hold about you. You can also use Settings → Export to download your full listening history at any time.
• Rectification / Correction — ask us to correct inaccurate data.
• Erasure — delete your account and all associated data instantly via Settings → Danger Zone, or delete individual plays or imports there.
• Restriction — ask us to pause processing your data while a dispute is resolved.
• Portability — your listening history is always available as a portable export via Settings → Export.
• Object — object to processing based on our legitimate interests.
• Opt out of sale / sharing (California) — we don't sell your personal data or share it for cross-context behavioural advertising.
• Non-discrimination — we won't treat you differently for exercising any of these rights.

California residents (CCPA/CPRA)

If you're a California resident, here is the specific disclosure required by the California Consumer Privacy Act:

Categories of personal information we collect: Identifiers (username, email address); Commercial information (the listening history you provide); Internet or network activity (session data, error logs).

Purpose: To operate the service.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — Stick does not currently show ads.

To exercise your rights to know, delete, correct, or limit use of your personal information, email contact@stick.tools — we'll respond within 45 days. We will not discriminate against you for exercising your CCPA rights.

Third parties

• MusicBrainz — looked up to match your tracks/artists/albums to canonical metadata and cover art.
• Amazon SES — sends the sign-in and verification emails you request.

Contact

Questions about this policy? Email contact@stick.tools.

If you're in the UK or EEA and have a complaint we haven't resolved, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or your local EU data protection authority.