Legal

Privacy Policy

Deadwax is a personal music journaling platform. This policy explains what data we collect, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR).

Last updated: June 25, 2026

Who we are

Deadwax (deadwax.space) is operated as a personal project. For any privacy-related matters, the data controller is reachable at noahnikolaj.c@gmail.com.

We do not have a formal legal entity at this time. If Deadwax becomes a commercial service this policy will be updated accordingly.

Data we collect

We only collect data you directly provide or that is generated by your use of the service:

Account dataEmail address, chosen username, and optional profile picture. Collected when you register.

Profile dataOptional biography text and your curated list of favourite albums.

Activity dataAlbum ratings (0.5–5 stars), written reviews, and your Listen Later list.

Social dataWho you follow and who follows you.

Moderation dataReports you submit about other users or reviews. Used solely for moderation.

Technical dataIP addresses and request logs retained by our infrastructure provider for security purposes. We do not actively process these.

We collect no payment information, location data, device fingerprints, or advertising identifiers.

Why we collect it

All data is collected under one of two legal bases:

Contract performance — your email and account data are required to provide the service you signed up for (logging in, saving ratings, following friends).
Legitimate interest — moderation data and technical logs are processed to keep the platform safe and functional.

We do not sell your data. We do not use your data for advertising or profiling. We do not share your data with any third party except those listed in section 5 below.

Cookies & local storage

Deadwax uses strictly necessary session cookies only. These are set by our authentication layer (Supabase) and store a short-lived token so your server-side requests can be authenticated. They are not optional — the service cannot function without them — and therefore do not require your explicit consent under GDPR.

We do not use tracking cookies, advertising cookies, or any third-party cookies.

Cookie summary

Necessary

sb-* (Supabase auth)

Session token. Expires when you log out or the token rotates. No personal data inside the cookie itself.

Your accessibility preferences(reduced motion, high contrast) are stored in your browser's localStorage. This data never leaves your device and is not transmitted to our servers.

Third-party services

We rely on the following sub-processors:

Supabase

Database, authentication, and file storage

Stores all your account and activity data. Supabase is GDPR-compliant and offers EU-region hosting.

Resend

Transactional email

Used to send account-related emails (ban notices, etc.). Only your email address is shared, and only when an email is sent.

MusicBrainz

Music metadata

We fetch album and artist metadata from the public MusicBrainz API. No personal data is sent to MusicBrainz.

Data retention

Your data is retained for as long as your account exists. When you delete your account via Settings → Account → Delete Account, all of the following is permanently erased:

Your profile (username, bio, avatar)
All ratings and reviews
Your follow relationships
Your Listen Later list
Any reports you submitted

Supabase infrastructure logs (IP, request metadata) are retained by Supabase according to their own retention policy and are outside our direct control.

Your rights under GDPR

If you are located in the European Economic Area, you have the following rights. To exercise any of them, email us at noahnikolaj.c@gmail.com.

Right to access

Request a copy of all personal data we hold about you.

Right to rectification

Correct inaccurate data — you can update most of it yourself in Settings.

Right to erasure

Delete your account and all associated data at any time via Settings → Account.

Right to portability

Request your data in a machine-readable format (e.g. JSON export of your ratings).

Right to object

Object to any processing we carry out under legitimate interest.

Right to complain

Lodge a complaint with your national data protection authority if you believe we have violated your rights.

Contact

For any privacy questions, data requests, or concerns, contact us at:

noahnikolaj.c@gmail.com

We aim to respond to all privacy-related requests within 30 days, as required by GDPR.

This policy may be updated from time to time. The “Last updated” date at the top of this page will always reflect when it was last changed. Continued use of Deadwax after a policy update constitutes acceptance of the new terms.

← Back to Deadwax