Privacy Policy

1. Overview

Work of Chart ("we," "us," or "the site") tracks publicly available Spotify streaming chart data, organized by artist, album, and song, and offers an optional account so you can support the artists you follow and customize a public profile. This Privacy Policy explains what information is collected when you visit or create an account on workofchart.com (the "Site"), how it's used, who it's shared with, and the choices and rights available to you. It applies to everyone who visits the Site, regardless of location.

By using the Site, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Site. If you create an account, Section 2.1 explains specifically how and when you agree to this policy.

2. Who We Are

Work of Chart is built and operated independently by a single developer. For the purposes of privacy laws that use this terminology (such as the GDPR), Work of Chart is the "data controller" for information collected through the Site. We do not have a dedicated data protection officer or an EU-based representative, but you can reach us directly using the contact details at the end of this policy.

2.1 Consent to This Policy When You Sign Up

Browsing the Site does not require an account. If you choose to create one, the sign-in page requires you to affirmatively check a box confirming you have read and agree to this Privacy Policy and our Terms, and that you are at least 13 years old, before the "Continue with Google" or "Continue with Spotify" buttons can be used. We record the date and time your account was created as your acceptance of the policy in effect at that time. If we make material changes later, see Section 18 (Changes to This Policy).

3. Information We Collect

3.1 Information you provide

You do not need an account to browse the Site's chart data. If you choose to create an account (Section 3.4) or email us directly (for example, through the Contact page), we will have whatever information you provide through those channels. We do not otherwise knowingly collect your name, email address, payment information, or other directly-identifying information just from browsing the Site.

3.2 Information collected automatically

Like most websites, when you visit the Site our hosting provider (Vercel) automatically logs standard technical information, which may include your IP address, browser type and version, operating system, device type, referring/exit pages, the pages you visit, and timestamps. This information is used for security, fraud prevention, debugging, and understanding overall traffic to the Site.

3.3 Analytics information

We use Google Analytics to understand how visitors use the Site — for example, which pages are viewed, how long visitors stay, what device or browser they're using, and approximately where traffic is coming from (typically derived at the country or city level from IP address, not precise location). Google Analytics uses cookies and similar technologies (see Section 5) to collect this information and assigns your browser a pseudonymous identifier. We do not use Google Analytics to attempt to identify you personally, and we do not combine analytics data with any other information that could identify you.

Google acts as an independent processor of this data under its own privacy policy, available at policies.google.com/privacy. You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

3.4 Account information (if you sign in)

Creating an account is optional and requires signing in with Google or Spotify. When you do, that provider shares the following with us, depending on which you choose:

• Your name;
• Your email address;
• Your profile picture; and
• A unique account identifier from that provider, used to recognize you on future sign-ins.

We do not request, receive, or store your Spotify listening history, top artists/tracks, playlists, or any other data about what you listen to. Signing in with Spotify only uses Spotify's basic identity scope (technically, the user-read-email permission) to confirm who you are — it does not grant us access to your listening activity. If that ever changes as a future feature, we will request your explicit, separate permission at that time and update this policy first.

We also store what you choose to add to your Work of Chart profile directly: a username, a short bio, and the list of artists you mark as "supported." See Section 4 for how this information is displayed.

Google's and Spotify's own privacy policies govern how they handle your information as the identity provider: policies.google.com/privacy and spotify.com/legal/privacy-policy.

4. Public Profile Information

If you create an account and set a username, a public profile page becomes viewable by anyone at workofchart.com/@ [your-username] — no account or sign-in is required to view it. That page displays:

• The name and profile picture from whichever provider you signed in with;
• Your chosen username;
• Your bio, if you've written one; and
• The list of artists you've marked as "supported" on the Site.

Only set a username, bio, or list of supported artists if you're comfortable with that information being publicly visible. Your email address is never shown on your public profile. You can change your username and bio, or remove artists from your supported list, at any time from your account page; removing your username takes your public profile page down.

5. Cookies and Similar Technologies

A cookie is a small text file placed on your device that helps a website remember information about your visit. We use (or may use) the following categories of cookies:

• Strictly necessary cookies — required for the Site to function correctly. If you sign in, this includes a session cookie (set by our authentication system) that keeps you signed in between visits. These cannot be disabled through our systems because the Site would not work properly, or you would be unable to stay signed in, without them.
• Analytics cookies — set by Google Analytics (for example, cookies commonly named _ga and _ga_*) to distinguish visitors and sessions and to report on how the Site is used, as described in Section 3.3.
• Advertising cookies — if and when the Site displays advertising (see Section 6), our advertising partners may set cookies to serve ads, measure ad performance, and, where permitted and consented to, personalize the ads you see based on your browsing activity.

Most browsers let you refuse or delete cookies through their settings. Doing so may affect how parts of the Site or embedded content function, including staying signed in. The Site does not currently respond to browser "Do Not Track" signals, as there is no common industry standard for how sites should interpret them.

6. Advertising

Work of Chart may display advertisements served by Google AdSense and/or other third-party advertising networks, now or in the future. If and when ads are displayed:

• Google and its advertising partners may use cookies and similar technologies to serve ads based on your prior visits to this and other websites, and to measure ad performance.
• Where required by law (including for visitors in the European Economic Area, the United Kingdom, and Switzerland), we will obtain your consent before serving personalized advertising or using non-essential advertising cookies, through a consent management tool.
• You can opt out of personalized advertising from Google by visiting Google Ads Settings. You can also opt out of many third parties' use of cookies for personalized advertising by visiting optout.aboutads.info (US) or youronlinechoices.eu (EU).

We do not directly sell your personal information to advertisers. Some privacy laws, described in Section 13, define certain advertising-related data sharing as a "sale" or "share" of personal information even without money changing hands; the opt-out mechanisms above and your rights in Section 13 apply to that activity as well.

7. How We Use Information

We use the information described above to:

• Operate, maintain, and improve the Site;
• Create and maintain your account, if you choose to sign in, and display your public profile as you've configured it;
• Understand how visitors use the Site so we can improve it;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Respond to inquiries sent to us directly; and
• Comply with legal obligations.

8. Legal Bases for Processing (EEA/UK Visitors)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR/UK GDPR to process your information:

• Consent — for creating an account (given via the checkbox described in Section 2.1), non-essential cookies, analytics, and personalized advertising, where required;
• Contract — to provide the account features you've asked for (your profile, your supported-artists list) once you've signed up;
• Legitimate interests — for strictly necessary site functionality, security, and fraud prevention, balanced against your rights and interests; and
• Legal obligation — where we're required to process or retain information to comply with the law.

9. Third-Party Service Providers

We share information with the following categories of third parties, each acting under their own privacy policy:

• Vercel (hosting and server logs) — vercel.com/legal/privacy-policy
• Neon (database hosting for the Site's chart data and account data — your account, profile, and supported-artists information is stored here) — neon.tech/privacy-policy
• Google — as an identity provider (Google Sign-In, if you choose it), for Google Analytics (usage analytics), and for Google AdSense (advertising, where applicable) — policies.google.com/privacy
• Spotify — as an identity provider (Spotify Login, if you choose it — identity only, see Section 3.4), and separately, we retrieve publicly available artist, album, and track metadata (names, images, release dates) from the Spotify Web API to display on the Site. Streaming and chart figures shown are compiled from publicly published Spotify chart data and third-party chart-tracking sources, not provided to us directly by Spotify.

We do not sell your personal information for money. We do not share personal information with third parties for their own independent marketing purposes, other than the advertising and analytics functions described above.

10. International Data Transfers

The Site is operated from the United States and uses infrastructure and service providers (including Vercel, Neon, and Google) that may process information in the United States and other countries. If you are located outside the United States, information about you — including account information if you sign in — may be transferred to, stored in, and processed in a country with different data protection laws than your own. Where required, our providers rely on mechanisms such as Standard Contractual Clauses to lawfully transfer data from the EEA/UK to other countries.

11. Data Retention

Server logs are generally retained by our hosting provider for a limited period for security and operational purposes before being deleted or aggregated. Google Analytics data is retained according to the retention settings on our Google Analytics property, currently configured to the standard retention period offered by Google Analytics 4. Emails sent to us are retained as long as reasonably necessary to address the inquiry and for our own records, unless you ask us to delete them sooner.

If you create an account, we retain your account, profile, and supported-artists information for as long as your account exists. We don't currently offer a self-service "delete my account" button; to delete your account and associated data, email us at the address in Section 19 and we will delete it, typically within 30 days, except where we're required or permitted to retain certain information longer (for example, to resolve disputes or comply with legal obligations).

12. Data Security

We use reasonable technical and organizational measures, and rely on providers (Vercel, Neon, Google, Spotify) that maintain their own security practices, to protect information from unauthorized access, alteration, disclosure, or destruction. We never receive or store your Google or Spotify password — sign-in is handled entirely by Google/Spotify's own OAuth systems. No method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

13. Your Privacy Rights

13.1 European Economic Area, UK, and Switzerland (GDPR / UK GDPR)

If you are located in these regions, you have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of your information, including your account (see Section 11);
• Request restriction of, or object to, our processing of your information;
• Request a portable copy of information you've provided to us;
• Withdraw consent at any time where processing is based on consent, without affecting processing that occurred before withdrawal; and
• Lodge a complaint with your local data protection supervisory authority.

If you don't have an account, most of these requests in practice relate to analytics or advertising cookie data tied to your browser; the opt-out tools in Sections 3.3 and 6 are the most direct way to exercise them. If you do have an account, contact us using the details in Section 19 for access, correction, export, or deletion of your account data.

13.2 California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose, and the categories of third parties involved;
• Request deletion of your personal information, including your account;
• Request correction of inaccurate personal information;
• Opt out of the "sale" or "sharing" of personal information, including for cross-context behavioral advertising — see Section 6 for how to opt out of advertising cookies, which covers this;
• Not be discriminated against for exercising any of these rights; and
• Designate an authorized agent to make a request on your behalf.

We do not sell personal information for money. Depending on how California law defines "sharing," our use of advertising cookies described in Section 6 may be considered "sharing" for cross-context behavioral advertising; the opt-out tools listed there apply to this as well.

13.3 Other U.S. State Privacy Laws

Residents of certain other states with comprehensive privacy laws (including, as of this writing, Virginia, Colorado, Connecticut, Utah, and others that have since enacted similar laws) may have similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising and certain profiling. You can exercise these rights using the contact details below, and we will respond consistent with applicable law.

14. Children's Privacy (COPPA)

Work of Chart is a general-audience site about music streaming statistics and is not directed at children under 13. We do not knowingly collect personal information from children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act ("COPPA"). Creating an account requires affirmatively confirming you are at least 13 years old as part of the sign-up checkbox described in Section 2.1. If you are a parent or guardian and believe your child under 13 has created an account or otherwise provided us with personal information, please contact us using the details below and we will promptly delete it.

15. FERPA

The U.S. Family Educational Rights and Privacy Act ("FERPA") applies to educational agencies and institutions that receive funding from the U.S. Department of Education and to the education records they maintain. Work of Chart is not an educational agency or institution, does not receive such funding, and does not create, maintain, or receive "education records" as defined by FERPA. FERPA therefore does not apply to the Site, and this section is included solely for completeness.

16. CAN-SPAM Act

We do not send marketing or promotional emails. Creating an account does not sign you up for a mailing list. If you email us, we will only use your email address to respond to you, and the CAN-SPAM Act's requirements for commercial email (such as unsubscribe mechanisms) are not applicable because we do not send commercial email of that kind.

17. Third-Party Links

The Site may link to third-party websites, such as Spotify, that are not operated by us. We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policy of any site you visit.

18. Changes to This Policy

We may update this Privacy Policy from time to time, including to reflect new features (such as the addition of advertising, or expanded use of account data) or changes in the law. Material changes will be posted on this page with an updated "Last updated" date above. If you have an account and we make a material change to how we use your account data, we will make reasonable efforts to notify you (for example, by email) before the change takes effect. We encourage you to review this page periodically.

19. Contact

Questions about this policy, requests relating to your privacy rights, or account deletion requests can be sent to workofchartcontact@gmail.com.