Alpha · policies
Privacy Policy
Updated 2026-11-05 · Pending final operator/legal review
Music is the Key is an invited alpha Community. This baseline describes the current MITK implementation, not a legal certification. Some optional features may not be enabled on your installation.
This baseline is not yet cleared for alpha invitation: external analytics/security configuration and remaining retention/legal details require verification.
Operator and contact
The current alpha is operated by Daniel Widström, Sweden, using Music is the Key as the service and Community name. Contact info@mitkcollective.com for privacy questions and requests. No company or separate legal entity is implied.
Accounts and access
We process your login username, email, personal display name, protected password representation, verification and session information, Community status, roles and explicit access grants. These support sign-in, verification, membership review, security and authorized Community workflows. Your email and technical login username are not ordinary public Community identity fields.
Public Artist and Community content
Published Artist biographies, artwork, external links, Releases, Tracks and public Playlist information are public content. Account-to-Artist management relationships are stored for authorization; displayed manager identity follows the configured visibility rules. Hidden Playlists and private administrative state are not public merely because some catalog content is public.
Applications and Participation
MITK records Playlist applications, placements, review decisions and responsible Accounts. Participation stores weekly policy and placement snapshots, contributions, progress, review decisions, waivers and history. Test Mode is neutral and does not create live Met/Missed standing. Only authorized people may view private submissions and review evidence according to their scope.
Feedback and manual evidence
Track Feedback includes your Account, selected Track, submitted feedback, review status and any awarded credit. Manual Evidence stores the selected image privately with your Account and Participation period, optional note and reviewer decision. Do not submit passwords, tokens or other people’s unnecessary personal information. Images are not ordinary public media-library uploads.
Community Chat
DIRECT Messages are private to authorized participants under the messaging rules. Rooms are accessible to current eligible members. We store Message content and identity, membership, read state, block/report state, mentions, personal notification preferences, Saved references and Room Highlights. Saved and Highlights reference source Messages and do not bypass access. Reports provide bounded evidence to authorized reviewers; administration does not grant unrestricted private-message access.
Alpha Feedback and Support
Where the existing Alpha Feedback launcher is available, it stores the submitting Account, message, bounded form answers, product-context category and review state. It is not a public post. Availability depends on configuration and authorization. A broader Support Center is not yet implemented.
Optional listening connection
If you choose to connect ListenBrainz, MITK verifies your ListenBrainz identity and asks you to confirm it. The supplied ListenBrainz token is used for verification and is not persisted by MITK. We store the confirmed provider username, Account binding and connection/sync state. While connected and enabled, MITK retrieves listening metadata and timestamps and matches them against the eligible Community catalog for Playlist Listening and Artist Discovery credit. This is not a record of Spotify playback supplied directly by Spotify.
Disconnecting listening
Disconnect from Listening settings to stop new collection for that connection. It does not immediately erase previously recorded contributions, binding history or evidence; retention and legitimate Participation-history requirements remain separate. Reconnecting requires verification and confirmation again. Reassignment to another listening identity is not a silent reset.
Spotify and external services
Optional Spotify connections use limited OAuth authorization; MITK does not receive your Spotify password. Access/refresh tokens for that feature are protected server-side, unlike the non-persisted ListenBrainz verification token. Permissions depend on the explicit read/write authorization and enabled features. Spotify artwork may load from Spotify image servers when a page is displayed. Loading a Spotify player connects your browser to Spotify. External links take you to the linked provider, which has its own policies.
Retention that is implemented
Newly imported normalized listening events, including unmatched, uncertain, out-of-scope and observation-held activity, have a 30-day retention deadline from ingestion. This covers the maximum 14-day Recovery pending window without confirming eligibility. Earlier saved deadlines remain unchanged. Raw provider responses are not retained by this rule. Expiry workers preserve required aggregate evidence before removing detail, so removal can be delayed if safe sealing is not complete. Optional listening projections have a 24-month deadline from the Participation week end. Canonical Participation decisions/history are separate and are not all erased by those listening deadlines. Reviewed Manual Evidence images use the period policy’s retention setting: default 90 days after review, configurable from 1 to 365 days. Pending images remain pending rather than expiring on that review deadline.
Other retention and security
Account, Chat, feedback, governance/audit and core Participation records do not currently have one blanket automatic deletion deadline. We retain operational records needed for the service, review and security; the operator must establish the remaining retention schedule before opening the alpha. Registration throttling uses keyed representations of network/email inputs rather than raw IP values in MITK throttle keys. Verification and reset links expire. Hosting and installed security services may separately process network addresses and request/error logs.
Who processes data
The alpha is hosted using Spaceship infrastructure and uses WordPress and Loginizer. Exact hosting/security log settings and retention require operator confirmation. Transactional verification, recovery and Community emails use the site’s configured mail delivery service; its actual provider and processing locations require confirmation. Spotify, ListenBrainz and linked media services receive data when their features are used. Their processing may occur outside your country. Processor arrangements and transfer safeguards have not been certified by this technical audit.
Analytics — verification outstanding
The operator reports that Analytics is enabled through Google Site Kit. Its actual connection/tag placement, identifiers, retention and consent behavior have not yet been verified. No Google tracking tag was identified in the inspected anonymous Home and Artist views, but this does not establish site-wide absence of tracking. No claim that it is anonymous or cookie-free is made. Optional tracking must not start before the appropriate choice. This disclosure is a launch blocker, not a completed analytics policy.
Your choices and requests
You can edit your display name and manager visibility, manage notification preferences, disconnect optional providers and use the relevant Account settings. Contact info@mitkcollective.com to request access, correction, deletion or restriction of personal data, or to ask about an objection or withdrawal of optional consent. Requests are reviewed with identity, other people’s privacy and applicable obligations in mind; immediate deletion of all shared history is not promised. You may raise concerns with the relevant supervisory authority, including IMY in Sweden.
Updates and remaining legal review
We will update this policy when processing changes. Legal bases, remaining retention periods, processor/transfer details and external analytics/security configuration still need operator/legal review before invitation. This alpha baseline is not a guarantee of GDPR or ePrivacy compliance.
Contact the operator: info@mitkcollective.com