What we keep, and what we do not

If you never sign in

Everything works without an account, and using the site that way leaves almost nothing behind.

• A random id in a cookie, so that a streaming service you connect stays connected to this browser. It is not tied to a name, an email or an address.
• If you send us samples: the link or files, plus whatever handle and note you typed on the form.
• Counts, not visits. A track records how many times it was played, liked and downloaded in total — never who did it.

If you sign in with Google

Signing in asks Google for three things and nothing else: your account’s permanent id, your email address, and your name and picture. It grants us no access to Gmail, Drive, YouTube or anything else in your Google account.

• We store that id, email, name and picture link, and refresh them each time you sign in.
• We store whatever you put on your profile — display name, handle, bio, location, website, the gear you use, the genres and tempo you want. All of it optional, all of it editable, all of it there to make the samples we show you less irrelevant.
• We store a session so you stay signed in: a random token kept only as a one-way hash, its expiry, and the browser string it was created from. Signing out deletes the record, not just the cookie.

If you connect a streaming service

Connecting Spotify, Apple Music or YouTube is a separate choice from signing in, and works whether or not you have an account. We ask each service for read access only: nothing is ever posted, followed, added or changed on your behalf.

The access tokens are stored on our server and are never sent to your browser. Disconnecting deletes them.

Cookies, all of them

• fod_session — keeps you signed in. Thirty days. Only set if you sign in.
• fod_connection — the anonymous id above. One year.
• fod_auth_state and fod_oauth_state — ten minutes each, used to prove a sign-in or connection came back from where it was sent. They are what stops somebody forging that step.

All four are set for this site only, and none can be read by JavaScript. There is no advertising cookie, because there is no advertising.

Who else is involved

• Google, if you sign in or connect YouTube. Spotify or Apple, if you connect those.
• Our hosting and storage providers, who hold the database and the audio files.
• Cal.com, but only if you open the booking window — it loads their page inside ours, and they set their own cookies at that point.

Nothing here is sold, and nothing is shared with anybody for advertising.

Getting rid of it

• Signing out ends the session immediately, everywhere that session was used.
• Disconnecting a streaming service deletes its tokens.
• Clearing your cookies discards the anonymous id, and with it the link between this browser and anything it connected.
• To delete your account and everything attached to it, email hello@fourondafloor.com from the address you signed in with. It gets done by hand, and it gets done.

Changes

If what we store changes, this page changes with it and the date below moves. Questions go to hello@fourondafloor.com.