turntable privacy policy

Last Updated: November 2, 2026

SCOPE

Turntables ("turntable", "we", "our", or "us") provides the Turntable v2 mobile application, the website at turntable.fyi (including its waitlist and the web version of Turntable), and the backend services that support them (the "Services"). This policy describes how we handle personal information in those Services. It does not cover the original Turntable web application. If you choose to import information from an original Turntable account, this policy covers our handling of the information in v2; it does not change how the original service handles its own records.

The Services are intended for adults in the United States. Third-party music services, app stores, and websites have their own privacy practices for information they collect independently. This policy does not replace their policies.

INFORMATION WE HANDLE AND WHERE IT COMES FROM

Account and profile information

We handle your phone number and verification information when you sign in by text message, account and profile identifiers, username, display name, biography, profile photo, account settings, and timestamps such as account creation. We may also receive an email address or other account information through an existing account, an import, or a support message. Your sign-in phone number and email address are not displayed as public profile fields unless you choose to include them in profile text or other shared content.

Waitlist

If you join the waitlist on turntable.fyi, we store the phone number you enter, the time you joined, and a record of your consent to text messages: the wording shown beside the button, the page you joined from, and your IP address and browser information. We use your number to manage the waitlist and to send you recurring automated text messages, including invitations to join, updates about the Services, and marketing messages, as described in the Terms. Reply STOP to any of these messages to stop receiving them. If the number you enter already has an account, the website sends that number a sign-in code instead of adding it to the waitlist. The waitlist is not visible to other people, and joining it does not create an account. We do not sell phone numbers or share them, or your consent to receive text messages, with third parties or affiliates for their own marketing. We keep the consent record, and any request to stop texts, for as long as needed to show that you agreed and to make sure we do not text you after you opt out. To be removed from the waitlist, contact contact@turntable.fyi.

Age eligibility

The app checks whether you meet its 18-or-older requirement. Where available, it requests age-range information from Apple's Declared Age Range service; otherwise, it may ask you to confirm that you are at least 18. The app uses the result to decide whether you can continue and stores a passed-check flag on your device. This check does not ask for or send a full date of birth to our backend.

Content and social activity

We store the content you submit and records needed to organize and share it, including:

• Collections, My Stack, Favorites, and Recommendations; their titles, descriptions, custom cover images, visibility settings, and music or collections placed in them;
• Notes on collected items, recommendation messages and replies, and the items, people, and collections associated with them;
• Follows, follow requests and decisions, collection subscriptions, blocks, and related preferences;
• Activity and notification records, including who collected, recommended, replied, followed, or subscribed, what the action concerned, and when it occurred; and
• Import status, source identifiers, and saved information used to match music or restore imported items.

The app also processes the current song, playback progress, playback queue, and selected playback service on your device. These features do not upload a continuous listening history or playback-position feed to our backend. Music lookup requests and content you save or share can still reveal what music you are interested in.

Apple Music

If you grant music-library access, the app can read your library playlists and their tracks, including titles, descriptions, artwork references, and music identifiers, so you can choose playlists to import. Selected playlist information is copied into Turntable collections. Playback uses Apple's music services and, where available, previews. Full playback depends on your permissions, subscription, and device capabilities. The app also uses your music-service catalog region to find available music. Apple handles its own music authorization and playback information; a playlist import does not give us your Apple account password.

Spotify public links

You can supply a public Spotify playlist or profile link. Our backend retrieves public playlist and profile information, such as playlist names, descriptions, artwork, owner identifiers, track lists, and music identifiers, to display or import the playlists you select. We can save the public Spotify profile identifier you provide for future imports; providing it does not verify that you own that Spotify profile. This feature uses public information and does not connect your private Spotify account or request your Spotify password. Selecting Spotify for playback opens Spotify or its website. An import makes a copy; it does not keep the source playlist and Turntable collection continuously synchronized.

Importing from the original Turntable

The v2 backend supports a transfer from an original Turntable account. A requested transfer uses a session token from the original account to verify access; we retain the association between accounts and import records. The current mobile sign-in flow does not offer an original-account login or linking screen, but v2 can hold information copied by earlier or separately requested transfers. The transfer can copy profile information, saved music, playlists, descriptions, custom covers, ordering, and visibility information, including private playlists. It is a transfer of supported content, not a continuous sync or a deletion of the original account. Review the resulting collections and their visibility settings before sharing them.

Safety and moderation

We process reports you submit, including the report category, explanation, reporter and target identifiers, and review status. We also keep moderation records, such as the submitted field, rejected text or excerpts of hidden content, image-moderation decisions and category scores, timestamps, and related account or collection identifiers. Text that is rejected before publication may still be recorded for moderation.

New profile-photo and custom-cover uploads are sent to OpenAI's image-moderation service for automated safety checks. Our backend sends the image for classification; it records the result and may reject the upload. The current text filter runs in our database rather than sending the submitted text to OpenAI for classification. Staff can review reports and moderation records and take action. Copies of report information may also be sent to our team's Slack workspace when that reporting integration is enabled.

Device, request, and notification information

Our servers and service providers process technical information needed to receive and handle requests, such as IP addresses, request times, requested resources or search terms, authentication/session identifiers, response status, and errors. Social activity records include timestamps, and we keep operational and security logs. If you enable push notifications, we store the device's notification token, its association with your account, notification-delivery status and errors, and notification preferences. We also record when notifications are marked read in the app. Apple processes notification payloads to deliver them.

Support

If you contact us by email, we receive what you send, including your email address, message, and any attachments. The app's Support link opens your email application; it does not automatically attach a playback log or a diagnostic report.

On-device storage

The app and its authentication library use local storage to maintain your session and preferences. The app also keeps caches, including images and music-matching results, and a local age-check flag. Some cached information can remain after you change an account setting or sign out. The website keeps your session and some preferences, such as panel widths, playback service, and collection order, in your browser's local storage. Neither the app nor the website uses cookies for sign-in, analytics, or advertising. Websites you open from the app may use cookies and other technologies under their own policies.

HOW WE USE INFORMATION

We use the information described above to authenticate accounts; provide profiles, collections, search, imports, playback, recommendations, feeds, and notifications; apply visibility and interaction settings; match music across catalogs; respond to support requests; diagnose failures and improve reliability; prevent misuse; moderate content and investigate reports; and comply with legal obligations or establish, exercise, or defend legal claims.

Text messages from the v2 sign-in flow contain verification codes. That flow does not enroll you in a waitlist or a marketing-text program; joining the waitlist does, as described above. The app can send social push notifications with your device permission. We do not sell personal information or use it for targeted advertising or tracking across other companies' apps and websites in these Services. We may use aggregated information to understand operation of the Services; information that can identify you is treated as personal information.

WHO CAN SEE INFORMATION

Other users, visibility settings, and links

Your username, display name, biography, profile photo, and profile statistics can be visible to other signed-in users. Requiring approval for new follows does not make your entire profile private or hide collections whose visibility is Everyone. It limits certain follow, recommendation, and follower-list interactions. A relationship may also be visible through another person's profile or activity.

Collection visibility controls discovery in the app. Everyone, Mutuals, and Private settings do not restrict access exclusively to you or selected people. A signed-in person who obtains a direct collection link or identifier may be able to view its contents even when it is not discoverable. Direct-link access can also apply to My Stack or Recommendations: a shared collection can expose recommendation messages and replies associated with its items. A signed-in person with a standard collection or Favorites identifier may also be able to subscribe to its activity despite its discovery setting. Do not use these features for confidential communications.

Notes and social activity may appear in feeds or on item and collection pages when eligible for those views. Blocking limits discovery and interactions, but does not guarantee that every copy, shared reference, or view of information disappears. Other users can retain information they have already seen, received, or copied.

Profile photos and custom collection covers accepted and stored by the Services have public image URLs. Anyone who obtains one of those URLs may view the image without signing in, even if the associated collection is hidden from discovery. A visibility change does not itself revoke an image URL.

Providers and integrations

We disclose information as needed for the functions described in this policy, including to:

• Supabase for account authentication, the application database (including the waitlist), file storage, and backend processing;
• Vercel for hosting the website;
• Linq for sending sign-in codes to your phone number, and our text-messaging providers for sending waitlist and marketing texts;
• Apple for music authorization, library access and playback, age-range checks, and push-notification delivery;
• OpenAI for checking uploaded profile and cover images, and Slack for operational handling of reports when configured;
• Music and artwork providers, including Apple/iTunes, Spotify, Cover Art Archive/Internet Archive, and Deezer, to search, retrieve artwork or metadata, or match music; and
• Providers of hosting, network delivery, and communications that support these functions.

We also operate infrastructure using MusicBrainz catalog data. Catalog requests can include search terms, music titles, artists, and music identifiers. Some requests go through our backend; the app also fetches music or images directly from their hosts, which receive ordinary connection information such as your IP address. These interactions occur when using the relevant features and are not limited to services with which you have connected an account. Providers may also handle information independently under their own policies when you use their services.

Push notifications can include another person's name, an item title, the type of activity, and identifiers that open the related content. Notification delivery shares that payload with Apple, and previews may be visible on a device's lock screen according to its settings.

Legal and organizational disclosures

We may disclose information when reasonably necessary to comply with law or legal process; protect users, the public, or the Services; investigate misuse; or enforce our terms. Information may also be disclosed in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable law.

RETENTION, REMOVAL, AND ACCOUNT DELETION

We keep account and content records to provide the Services and retain operational, safety, and support records according to their purpose, outstanding issues, and applicable obligations. There is no single retention period for all categories.

Removing an item from a collection or Stack removes that placement, not the underlying shared music record or every other person's copy. Deleting a collection removes it from ordinary views, but its metadata and associated activity history can remain in backend records. Saved import/recovery records can contain earlier content, including notes, after the visible content is changed or removed. Replacing or removing a cover does not necessarily delete every previously stored image file immediately. Please contact us if you need help with a retained copy.

You can request deletion of your v2 account in Settings. When the deletion completes successfully, the account and its profile, owned collections and content, account links, notification records, and account-linked moderation-log entries are removed from the active v2 systems through the deletion workflow. Recommendations already delivered to other people may remain without the deleted sender's profile association. Reports you filed about others, including unresolved reports, and resolved reports about your content may remain with references to the deleted account removed. Free-text report details can still identify a person. Removing a database link is not the same as anonymizing every word in a record.

Account deletion is not a promise that every copy disappears immediately. Backups, request and security logs, support correspondence, report copies in operational tools, cached images, and information retained by recipients or independent services are not all erased by the account-deletion request. Retention may also be necessary for legal obligations, security, disputes, and enforcement. Deleting a v2 account does not delete an original Turntable, Apple, or Spotify account, cancel a music subscription, or erase information those services hold independently. Uninstalling the app does not delete your v2 account.

YOUR CHOICES AND PRIVACY REQUESTS

• Profile and content. Edit supported profile fields and your collections and notes in the app. Collection visibility and follow-approval settings have the limits explained above. Use report and block controls for unwanted content or interactions.
• Music access and imports. Manage the app's Apple Music permission through your device settings. You choose which available playlists to import. Changing a permission or playback preference does not remove copies already imported into Turntable; remove those collections or request account deletion separately. Public Spotify-link imports do not create a private Spotify account connection to disconnect.
• Notifications. The app can request notification permission and open device settings, where you can change permission or lock-screen previews. Disabling notifications does not delete your account or all existing notification records.
• Account deletion and assistance. Use Settings to delete your v2 account or contact contact@turntable.fyi for help, including when the in-app request fails. Do not send us your password or verification code.
• Privacy rights. Depending on where you live and which laws apply, you may have rights to access, correct, delete, or receive a copy of personal information; restrict or opt out of certain processing; use an authorized agent; or appeal a decision about a request. Contact contact@turntable.fyi to make a request or appeal. We may need to verify your identity and authority before responding. We will handle requests as required by applicable law and will not unlawfully discriminate against you for exercising your rights.

The Services do not implement a separate response to browser Do Not Track signals. The no-sale and no-targeted-advertising practices described above apply regardless of such a signal. Third-party apps or websites opened from the Services control their own responses and settings.

SECURITY AND PROCESSING LOCATIONS

We use safeguards such as encrypted network connections, authentication, access controls, and restrictions on server credentials. Public images and shared content remain subject to the visibility limits described above. No system is completely secure, so we cannot guarantee absolute security. Protect your device and account credentials and contact us if you suspect unauthorized access.

Information may be processed in the United States and other places where our providers operate. Applicable data-protection laws may differ from those where you live. The intended United States audience does not mean all providers store or process every record only in the United States.

CHILDREN AND MINORS

The Services are intended for people aged 18 or older. The age check is described above; it is not a collection of a full birth date or a guarantee that every account holder's age has been independently verified. If you believe a person under 18 has provided account information to us, contact contact@turntable.fyi so we can investigate and take appropriate steps, including deleting information where appropriate.

CHANGES AND CONTACT

We may update this policy as the Services or our practices change. We will update the date above, make the revised policy available through the Services, and provide additional notice or obtain consent where required by law. For questions or requests about this policy, contact contact@turntable.fyi.