Add a song

Tap a song to add it to your setlist, or tap it again to take it out.

    Privacy policy

    Last updated

    This page describes what data SongTree collects, why we collect it, how long we keep it, and what you can do about it.

    In short

    No accounts. No tracking cookies. Your setlists and songs stay on your device unless you share them.

    What we collect

    When you submit a song via /submit:

    • Your name and email, so a moderator can contact you about your submission. These are never shown publicly.
    • The song content itself becomes public after a moderator approves it.
    • An optional public "submitted by" credit, only if you choose to fill it in.

    When you subscribe to the newsletter via /subscribe or the site footer:

    • Your email, and your name if you provide one.
    • Held in our email-delivery provider's audience list until you unsubscribe.

    When you share a setlist:

    • A copy of that list is stored so the link works: its name, notes and handout text, and each song with your note, transpose and capo. Your other lists, and songs from My Songs, are left out.

    Whenever you visit the site:

    • Standard server logs (IP address, user agent, requested URL, timestamp), used for abuse detection and operational debugging.

    Why we collect it

    • Moderation: to contact submitters about their songs.
    • Transactional email: submission confirmations, moderator notifications, newsletter confirmations, approval/rejection notices.
    • Newsletter delivery.
    • Abuse mitigation and basic operational debugging.

    Who processes data on our behalf

    SongTree uses a small number of third-party services. Each handles a specific slice of the data described above:

    • Supabase: database. Stores songs, submissions, shared setlists, and moderator records.
    • Vercel: hosting and edge computing. Serves the site and runs the API.
    • Resend: email delivery and newsletter audience storage.
    • Cloudflare Turnstile: anti-spam check on the submit and subscribe forms. It loads only on pages with one of those forms, and the newsletter form in the site footer loads it only once you start filling it in.
    • YouTube: song videos are embedded from youtube-nocookie.com, YouTube's privacy-enhanced mode, and only on song pages that have a video.
    • Umami: privacy-friendly, cookie-free page-view analytics. Collects aggregate pageviews, referrer, device type, and country. No fingerprinting, no cross-site tracking, no personal identifiers.
    • Vercel Web Analytics: cookie-free page-view analytics from our host. Collects aggregate pageviews, referrer, browser, device type, and country. Visitors are told apart by a hash of the request that is discarded after 24 hours; no personal identifiers.

    Neither analytics tool runs on My Songs, your setlist and its booklet, the moderator pages, or the newsletter confirmation page, and neither records the part of a web address after a ? or #. A shared setlist is counted like any other public page.

    Fonts are served by SongTree itself, so no font request goes to Google Fonts or any other third party.

    How long we keep it

    • Song submissions: kept indefinitely. The song itself is the point of the catalog; submitter contact info is kept so we can reach you if needed. Removal on request (see below).
    • Newsletter subscribers: kept until you unsubscribe. Every newsletter email includes a one-click unsubscribe link.
    • Server logs: short-term retention as set by our hosting provider's defaults.

    Your rights

    You can ask us to:

    • Access the data we hold about you.
    • Correct anything inaccurate.
    • Delete any of the above.

    Email contact@songtree.org with your request and we'll handle it within a reasonable timeframe.

    If you submitted a song and now want it removed from the public catalog, the same email address works. Please include the song title or URL.

    Cookies

    SongTree uses a minimal set of cookies:

    • Moderator session: stores the signed moderator-dashboard token so moderators don't need to paste the URL each time. Set only on the moderator pages.
    • Moderator flag (songtree_mod_ui): tells the site to show moderator links, such as Edit on a song page. It holds no secret and is set only for moderators, alongside the session cookie.
    • Cloudflare Turnstile: may set a short-lived cookie during the anti-spam check.

    No analytics cookies, no advertising cookies, no third-party trackers. Both our analytics tools, Umami and Vercel Web Analytics, are cookie-free.

    Stored on your device

    Some things SongTree remembers for you stay in your browser's local storage, on your device. They are not sent to us, and clearing your browser's data for this site removes them:

    • Your setlists, with their notes (songtree:setlists:v2).
    • The songs you write in My Songs (songtree:local-songs:v1).
    • The transpose and capo you set on each song (songtree:chart: plus the song's id).
    • Your print settings: font and size, setlist layout, and booklet layout (songtree:print-type:v1, songtree:setlist-print:v1, songtree:booklet-print:v2).
    • Your reading preferences on song pages, such as text size and chords on or off (songtree:reading:v1).
    • Daylight or Firelight, if you picked one (songtree:theme).

    When you send one of your own songs to the songbook, its text is handed to the submit form for that browser tab only (songtree:submit-prefill, cleared when the tab closes). Sharing a setlist is the one time a list leaves your device, as described above.

    Changes to this policy

    If we change this policy, the "Last updated" date at the top will reflect that. For material changes, we'll notify newsletter subscribers.

    Contact

    For anything about this policy or your data, email contact@songtree.org.