Privacy notice

This explains what Music Cartel knows about you, why, and what you can make us do about it. It is written to be read rather than to be complied with.

1. Who decides what happens to your data

This service is operated by an individual resident in Serbia. Once a company is registered, its name, registration number and address will appear here.

2. What we hold

Because you gave it to us

• Your account — name, email address, password (stored only as a hash, never as text we could read), and a profile picture if you add one.
• Where you are — the place you choose when you sign up or edit a listing, kept as map coordinates. This is the heart of Music Cartel: distance is what the whole service is for. See section 3.
• What you post — listings, photographs, feed posts, replies, and the things you record as owning in a collection.
• Your conversations — messages and offers between you and another member, and the ratings and comments you leave after a trade.
• Your date of birth, which we ask for when you sign up and use only to check you are old enough to be here. It is never shown to anybody else.

Because using the service creates it

• When your account was made, and when things were posted or read.
• That you agreed to these documents when you signed up, and which version of each one you agreed to.
• Who you follow, who follows you, and which conversations you have opened.
• If you turn on push notifications, an address your browser gives us so notifications can be delivered to that browser. You can revoke it at any time.

We do not run advertising, we do not build a profile of you for marketing, and we do not sell your data to anybody. There is nothing to opt out of, because there is nothing running.

3. Location, specifically

You choose the place; we do not read your device’s GPS and Music Cartel never asks your browser for your position.

We keep the place you chose so we can work out how far away other members are. Other members see an approximate location, not a precise one. Distances are calculated from the more precise value, but the value shown and sent to anyone else is deliberately coarse.

The choice is yours and you can change it whenever you like. Pick your town rather than your street — the matching works just as well, and less of you is on the internet.

One thing you should know: when you type a place into the location box, your browser sends what you typed straight to OpenStreetMap’s public address-lookup service so it can be turned into coordinates. That request goes from you to them; it does not pass through us first.

4. What other people can see

Music Cartel is a public service and some of it is genuinely public — visible without an account, and findable through a search engine:

• Your name, profile picture, approximate location and rating.
• Your listings and their photographs.
• Your posts and replies in the feed.
• Ratings and comments other members have left about you.

These are not public and are not indexed:

• Your email address. It is never shown to other members and is never part of what a search engine can reach.
• Your exact location.
• Your conversations, offers and notifications — visible only to you and the person you are talking to.
• Your date of birth.

5. Why we are allowed to hold it

• To give you the service you asked for — your account, your listings, your conversations, and the matching that is the point of Music Cartel. Without this data there is no service.
• Because we have a legitimate interest in keeping the service safe and working — investigating reports, acting on abuse, and preventing people who have been removed from coming straight back.
• Because you agreed — push notifications only, and you can withdraw that at any time without losing anything else.
• Because the law requires it — where we have to keep or hand over something, which so far has never happened.

6. Who else it reaches

We use other companies to run Music Cartel. They act on our instructions and may not use your data for their own purposes.

• Vercel — Hosting and delivery of the application
• Neon — The database that stores your account and content
• Ably — Real-time delivery of messages and notifications
• Cloudinary — Storage and delivery of images you upload
• Google — Sign-in, if and only if you choose to sign in with Google
• OpenStreetMap (Nominatim) — Turning the place you type into map coordinates Your browser contacts this service directly when you use the location box, so what you type reaches it before it reaches us.
• Your browser vendor — Delivering push notifications, if you enable them Apple, Google or Mozilla, depending on the browser. We never choose this; your browser does.

Some of these are based outside the country we operate from, so your data may be stored or processed elsewhere. Where that is the case we rely on the safeguards those transfers legally require.

We will hand data to the police or a court where we are legally obliged to. We will tell you if that happens to your data unless we are forbidden from telling you.

7. How long we keep it

• Your account and what you posted — while your account exists.
• Conversations — while either participant still has an account, because a conversation belongs to both of you.
• Records of a serious rule-breach — for a limited period after an account is closed, so that somebody removed for harming another member cannot immediately return. We keep the minimum that achieves that and nothing more.

8. What you can make us do

• See it. Ask for a copy of what we hold about you.
• Fix it. Most of it you can correct yourself in your profile; ask us for the rest.
• Delete it. Ask us to delete your account and your data.
• Take it elsewhere. Ask for your data in a form you can move.
• Object, or ask us to stop. Including withdrawing agreement to push notifications.
• Complain — to us first, we would hope, and to your national data-protection authority regardless. You do not need our permission and you do not have to come to us first.

Ask by writing to legal@example.invalid. We will answer within a month and it will not cost you anything.

None of these is a button yet. Music Cartel has no “download my data” control and no “delete my account” control; every request above is carried out by a person, by hand, after you write to that address. Your rights are the same either way — this is about how long it takes and who does it, and we would rather tell you than let you find out.

One honest limit on deletion. Some of what you leave behind is genuinely part of somebody else’s record: the messages you sent them, the offers you made, and the rating you left after a trade. When you delete your account we remove your profile and your listings and detach your name from what remains, but we do not erase the other person’s side of a conversation you both took part in.

9. Keeping it safe

Passwords are hashed. Traffic is encrypted. Access to the database is limited to the people running the service. That is a small operation doing sensible things — not a certified security programme, and we would rather say so than imply otherwise.

If something happens to your data that puts you at risk, we will tell you and the relevant authority as quickly as we can.

10. Children

Music Cartel is for adults. Signing up asks for your date of birth and refuses an account under 18; that is a question, not a proof of age, so it stops the honest case and not a determined one. We do not knowingly collect anything about under-18s, and if we find out an account belongs to one we will close it and delete what we hold. If you believe a child is using Music Cartel, tell us at legal@example.invalid and we will act on it.

11. Cookies

Music Cartel sets one cookie, to remember which language you chose. It is needed for the site to work as you asked and there is nothing to consent to. We do not use advertising or tracking cookies.

Your sign-in is kept in your browser’s local storage rather than in a cookie. Signing out removes it.

12. Changes

If we change this notice in a way that affects you, we will publish the change here and move the version at the top of this page. We cannot email you about it — Music Cartel has no email sender — so this page is the notice, and the version is how you can tell that what you agreed to has moved. The version and date at the top always say which text is current.