Privacy Policy

The short version

I don’t sell your data and I don’t run ads. There is one analytics tool, counting page views — it sets no cookies, records no IP address, and cannot follow you to any other site. Beyond that, TinySet keeps the small amount of information it needs to sign you in and remember what you’ve saved, and you can ask me to delete all of it any time.

What I keep

• Your account. A username, and your password stored as a secure hash — never the password itself, which means I can’t see it and can’t tell you what it is. An email address only if you add one for password recovery.
• What you’ve saved. Your setlists and their names and tags, the setlists you’ve bookmarked or given flowers to, the songs you’ve liked, and the songs you’ve hidden.
• What you’ve sent me. Anything you type into the contact form, the “request an addition” form, or a problem report on a song — including an email address, if you choose to give one.
• Supporter status. If you donate, the date your supporter mark runs until, and a record of the donation itself so I can match it to your account and fix it if something goes wrong.
• Ordinary server logs. My hosting provider records standard request information, including IP addresses, to run the site and stop abuse — for instance rate-limiting the request form so it can’t be flooded. This isn’t used to build a profile of you or follow you anywhere else.

What stays in your browser

One cookie, and a few settings. The cookie is a secure, HTTP-only session cookie that keeps you signed in — it isn’t used for advertising or tracking, and no third-party script on the site can read it. The analytics below sets no cookie of its own.

Three other things are stored locally in your own browser and never sent to me: whether you chose light or dark mode, your player volume, and any setlist you’re part-way through building. Clearing your browser data clears all three — including an unsaved setlist, so save one you care about.

Page-view analytics

I use Vercel Web Analytics to see which parts of the site people actually use — which performances get played, whether anyone finds the artist pages, that sort of thing. It is the only measurement on the site. There is no Google Analytics, no advertising pixel, and nothing that follows you anywhere else.

It sets no cookies and stores no IP address. A visit is identified by a hash derived from the request, and that hash is thrown away after 24 hours — so it cannot tell that today’s visitor is the same person as yesterday’s, and cannot reconstruct where you went before or after TinySet.

Each page view records:

• the time, and which page you were on
• the site you arrived from, if any
• roughly where you are — country, region, city
• your browser, operating system, and whether you’re on a phone, tablet or desktop

Nothing on that list is tied to your account, and none of it identifies you. I see totals, not people. Vercel’s own privacy documentation covers their side of it.

What I use it for

Running the site: signing you in, saving and sharing setlists, keeping your liked and hidden songs straight, showing a supporter mark to people who’ve donated, and replying when you get in touch. Also keeping the site working — blocking spam submissions, and looking into problems people report. That’s the whole list.

Who else is involved

I don’t sell your information and I don’t share it, except with the services that make the site run and where the law requires it. Those services are the host that serves the site and counts page views (Vercel), the database that stores it, and the email service that sends password-reset messages.

Donations. These go through Buy Me a Coffee, which handles the payment. I never see your card details. What reaches me is what they pass on — typically the name and email you gave them, and the amount — which is how a donation gets matched to a TinySet account. Their privacy policy covers everything on their side.

YouTube. Videos play through YouTube’s embedded player. Once one loads, YouTube and Google can see that it’s playing and may set their own cookies, under Google’s Privacy Policy. That part isn’t mine to control, and it happens whether or not you have a TinySet account.

Your data is yours

You can delete your own setlists, unlike a song, or unhide a song from your account at any time, without asking me. For anything bigger — a copy of everything I hold about you, a correction, or deleting your account and all of it — email tinysetter@gmail.com and I’ll do it. There’s no form to fill in and no retention period I’m holding you to.

If you’re in the UK or the EU, those are your rights under the GDPR and I’ll honour them as written. The lawful basis for holding what’s listed above is that it’s necessary to give you the account and features you asked for, plus a legitimate interest in keeping the site secure and free of spam. The site and its database are hosted in the United States, so using TinySet means your information is stored there.

Children

TinySet isn’t aimed at children under 13, and I don’t knowingly collect anything from them. If you think a child has given me information, contact me and I’ll remove it.

Changes

If this changes, the date at the top changes with it. If a change ever affects what I collect or who I share it with — a sponsor, say, or a new service behind the scenes — this page will say so plainly rather than burying it.

Getting in touch

Questions about any of this? Email tinysetter@gmail.com. It’s me who reads it.