Privacy — SongTree

This page describes what data SongTree collects, why we collect it, how long we keep it, and what you can do about it.

What we collect

When you submit a song via /submit:

Your name and email, so a moderator can contact you about your submission. These are never shown publicly.
The song content itself becomes public after a moderator approves it.
An optional public "submitted by" credit, only if you choose to fill it in.

When you subscribe to the newsletter via /subscribe or the site footer:

Whenever you visit the site:

Standard server logs (IP address, user agent, requested URL, timestamp), used for abuse detection and operational debugging.

Moderation — to contact submitters about their songs.
Transactional email — submission confirmations, moderator notifications, newsletter confirmations, approval/rejection notices.
Newsletter delivery.
Abuse mitigation and basic operational debugging.

SongTree uses a small number of third-party services. Each handles a specific slice of the data described above:

Supabase — database. Stores songs, submissions, and moderator records.
Vercel — hosting and edge computing. Serves the site and runs the API.
Resend — email delivery and newsletter audience storage.
Cloudflare Turnstile — anti-spam check on the submit and subscribe forms.
GitHub (via Giscus) — comments on song pages. Comments live in GitHub Discussions, not on SongTree's servers.

Song submissions — kept indefinitely. The song itself is the point of the catalog; submitter contact info is kept so we can reach you if needed. Removal on request — see below.
Newsletter subscribers — kept until you unsubscribe. Every newsletter email includes a one-click unsubscribe link.
Server logs — short-term retention as set by our hosting provider's defaults.

You can ask us to:

Email contact@songtree.org with your request and we'll handle it within a reasonable timeframe.

If you submitted a song and now want it removed from the public catalog, the same email address works — please include the song title or URL.

SongTree uses a minimal set of cookies:

Moderator session — stores the signed moderator-dashboard token so moderators don't need to paste the URL each time. Set only on the moderator pages.
Cloudflare Turnstile — may set a short-lived cookie during the anti-spam check.

No analytics cookies, no advertising cookies, no third-party trackers.

If we change this policy, the "Last updated" date at the top will reflect that. For material changes, we'll notify newsletter subscribers.

For anything about this policy or your data, email contact@songtree.org.