Privacy

When you sign in with Spotify, Basis requests these OAuth scopes: user-top-read (your top artists and tracks), user-read-email, and user-read-private. We use these to fetch your display name, profile picture, and your top artists/tracks.

Basis may also offer Apple Music as a sign-in provider. When you connect via Apple Music, we access your playcounts and library data through the Apple Music API. We store only the top artists and tracks derived from that data.

Genres are derivedfrom the artists' MusicBrainz metadata — we don't request them from Spotify. We do not request your playlists, your followers, or your full listening history.

Your Spotify data is stored in a Postgres database (hosted on Supabase, EU region) alongside the public profile fields you provided (display name, bio, country). Cached data (MusicBrainz artist metadata, album art URLs) is fetched from the public MusicBrainz API and stored alongside your Spotify rows. Access and refresh tokens are stored in the users.providers jsonb column — see "Security" below. We do not store your raw Spotify audio. Your profile is visible to other signed-in users by default, but you can change visibility to public or private in your settings.

• Display your top artists, tracks, and genres on your profile
• Show your reviews to your followers
• Compute a taste profile used for friend recommendations
• Generate shareable OG images for your profile

Nothing else. We do not analyse your listening for advertising or benchmarking. We do not export your data to any other service. We do not train machine learning models on Spotify data.

You can disconnect your Spotify account at any time from /settings. The Disconnect button is shown only to the signed-in account owner. Clicking it shows a confirmation; on confirm, Basis:

1. Deletes your top artists, top tracks, top genres, reviews, badges, follows, and comparisons
2. Deletes your user row (cascade handles anything missed)
3. Calls Spotify's token-revoke endpoint to invalidate the refresh token
4. Clears your session cookie and redirects to /welcome

After disconnect, every /u/<your-username> page is a 404. The data is unrecoverable.

We use a single signed session cookie (HttpOnly, Secure, SameSite=Lax) to keep you signed in. Mutating requests (logout, account disconnect) are additionally protected by an HttpOnly double-submit CSRF cookie. OAuth callbacks are protected by a one-time HMAC-signed state nonce — the standard CSRF guard for OAuth2. We do not use third-party tracking cookies or analytics scripts.

Access and refresh tokens are stored in the database as plain JSON in the users.providers column (the tokens are short-lived and the column is only readable by the application role, not exposed to the public schema). The session cookie is signed with an HMAC of AUTH_SECRET. OAuth callbacks are protected by a one-time HMAC-signed state nonce. Auth routes (login, logout, disconnect, callback) are protected by a Redis-backed rate limiter (10 requests per IP per minute).

The following security headers are set on every response: Strict-Transport-Security (HSTS, 2 years), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin), X-Frame-Options via Content-Security-Policy frame-ancestors 'none', and a Content-Security-Policy that restricts scripts/styles/images/connects to known-good sources.

Questions or data requests: privacy@basis.fm. We respond within 30 days.

Want a reminder when Basis opens to everyone? Drop your email below — no spam, just one ping when we launch.