Privacy Policy
Last updated: 9 September 2026
Who runs this site
Attracr is an independently run project, operated from Belgium by a single developer. Questions about this policy or about your data: hello@attracr.com.
What we store
When you sign in with Spotify or Google, Attracr stores:
- your email address, as supplied by the provider you signed in with;
- your Spotify and/or Google account identifier, and your Spotify display name;
- OAuth access and refresh tokens issued by that provider, used only to keep your session valid;
- the playlists you choose to track, and the follower counts and track changes we observe for them over time.
Attracr never sees or stores your Spotify or Google password. Sign-in happens entirely on the provider's own site; we only receive the tokens they hand back.
When you sign in by email, Attracr stores that address and sends one-time codes through Amazon SES in eu-central-1. Codes are stored only as hashes and expire after 10 minutes.
To stop bots abusing that form, it is protected by Cloudflare Turnstile. It loads only once you click into the email field, and Cloudflare then receives your IP address and browser signals to tell people from bots. See Cloudflare's Turnstile privacy addendum.
Cookies
Two cookies are set, both first-party and strictly functional: session_id, an HttpOnly cookie that keeps you signed in for 30 days, and logged_in, a flag the interface reads to decide which page to show. There are no advertising, analytics, or third-party tracking cookies on this site.
Who we share it with
Nobody. Your data is not sold, rented, or shared with third parties. It is stored in Amazon Web Services in the eu-central-1 (Frankfurt) region, which acts as our hosting processor; Cloudflare processes the bot check on email sign-in described above.
Your data
You can delete your account yourself under Settings → Delete account. Or email hello@attracr.com to request a copy of your data or the deletion of your account. Deletion removes your user record, your stored tokens, your sign-in data, and the playlists tied to your account. We aim to act on requests within 30 days.
Playlist data
Follower counts and track listings for public Spotify playlists are collected from publicly accessible Spotify pages. No private playlist is read, and nothing on your Spotify account is ever modified.