Last updated: August 29, 2026
Privacy Policy
Tracklyst ("Tracklyst", "we", "us") is built by Darklight Audio. This policy explains what data we collect when you use tracklyst.app, why, and who we share it with.
The short version
Your audio files live in your own Dropbox or OneDrive — we never upload them to our own servers. We store the minimum needed to make sharing and feedback work (share links, comments, approval status). We don't sell your data. Analytics stay off until you explicitly accept them via the cookie banner.
Information we collect
Account & storage connection. When you sign in, you authorize Tracklyst via OAuth with Dropbox or Microsoft OneDrive. We receive an access/refresh token and your display name from that provider — enough to read and write files in the folders you connect. We don't receive your Dropbox/Microsoft password.
Your audio & files. Tracks, artwork, and folder structure stay in your own Dropbox or OneDrive account. We don't copy or host your audio files on our infrastructure.
Feedback & activity data. When someone leaves a comment, approves a track, or plays a shared link, we store that in our database (share link IDs, listener name if provided, comment text, timestamps, play counts, approval status) so the feedback thread and dashboard work.
Voice transcription. If you use voice-note transcription on a comment, the audio is sent to our transcription provider (Groq) to generate text, and the resulting transcript is stored with the comment.
Payment information. Subscription payments are processed by LemonSqueezy; paid track/download purchases are processed by Stripe. We never see or store your full card number — that's handled entirely by those processors. We do receive your email address and transaction status to activate your plan or unlock a purchase. If you're a creator receiving payouts, onboarding (identity verification, bank details, tax information) happens on Stripe's own hosted flow via Stripe Connect — that information goes directly to Stripe, not through our servers.
Support & email. If you email us or a recipient link triggers a notification, transactional email is sent via Resend.
Newsletter. If you choose to sign up for product updates, that goes through Kit (ConvertKit) and is entirely opt-in — we don't add you automatically.
Analytics. We use Google Analytics (GA4) to understand aggregate site usage. It's off by default on every page and only loads after you click "Accept" on the cookie banner. See Cookies below.
Standard logs. Like any web app, our hosting provider (Netlify) and database provider (Supabase) generate ordinary server logs (IP address, timestamps, request paths) for security and debugging.
Cookies & local storage
Tracklyst doesn't use tracking cookies. Sign-in state and app preferences (theme, connected account, consent choice) are stored in your browser's localStorage, not cookies, and never leave your device except when needed to authenticate a request. Google Analytics, if you accept it, sets its own cookies per Google's cookie policy.
Who we share data with
We share data only with the service providers needed to run Tracklyst: Dropbox, Microsoft (OneDrive), Supabase (database), Netlify (hosting), Groq (transcription), Stripe and LemonSqueezy (payments), Resend (email), Kit (newsletter, opt-in only), and Google Analytics (opt-in only). We don't sell personal data, and we don't share it with anyone else for their own marketing purposes.
Data retention
We keep share links, comments, and activity data for as long as your account is active, or until you delete a project/link. You can revoke a share link at any time, which stops new activity from being recorded against it.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data (for example under GDPR or CCPA). To exercise any of these, email support@tracklyst.app and we'll respond within a reasonable time. Disconnecting your Dropbox/OneDrive account revokes our access to your storage at any time from your provider's app permissions settings.
Children's privacy
Tracklyst is a professional tool for audio engineers, producers, and their clients. It isn't directed at children, and we don't knowingly collect personal information from anyone under 13.
Security
We use industry-standard measures (encrypted connections, provider-managed access tokens) to protect data in transit and at rest, but no system is 100% secure. Report suspected issues to support@tracklyst.app.
Changes to this policy
We'll update the date at the top of this page when this policy changes. Material changes will be noted in the changelog.
Contact
Questions about this policy: support@tracklyst.app.