Privacy policy

This privacy policy explains how Listening Journal handles personal data. It is written with the EU General Data Protection Regulation (GDPR) and French data protection rules in mind.

Controller

The data controller is Unhook Studio, 59 rue de l'Aqueduc, 75010 Paris, France. Contact: support@listening-journal.com.

Data we process

We process account data such as your name, email address, password authentication data, theme preference, login/session records, email verification state, and account status.

We process the content you add to the service, including listening moments, notes, genres, catalogue entries, artists, works, recordings, albums, lists, list items, and workspace membership data.

We may process technical data such as IP address, request metadata, timestamps, logs, browser information, and security events needed to operate and protect the service.

Why we process data

We process data to provide the service, authenticate users, keep workspaces and lists available, send account emails, prevent abuse, troubleshoot errors, maintain backups, and comply with legal obligations.

Legal bases

The main legal basis is performance of a contract when we provide your account and journal functionality. We also rely on legitimate interests for security, diagnostics, abuse prevention, and service improvement, and on legal obligation where retention or disclosure is required by law.

Hosting and processors

The backend application is hosted on infrastructure from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The deployment is intended to run on European Hetzner infrastructure unless configured otherwise.

The frontend may be served through Cloudflare infrastructure. Account emails may be sent through an email delivery provider such as Resend. Media storage may use Cloudflare R2 if uploads are enabled.

International transfers

Where providers process data outside the European Economic Area, transfers should be covered by appropriate safeguards such as EU standard contractual clauses or equivalent legal mechanisms.

Retention

Account and journal data is kept while your account is active. Backups and operational logs are kept for a limited period for reliability and security. Deactivated accounts are retained only as long as reasonably needed for restoration, support, legal, or abuse-prevention purposes.

Your rights

Under GDPR, you may have the right to access, correct, delete, restrict, object to processing of, or receive a copy of your personal data. You can make a request by emailing support@listening-journal.com.

You also have the right to lodge a complaint with the French data protection authority, the CNIL, or with another competent supervisory authority.

Cookies and local storage

Listening Journal uses strictly necessary authentication/session storage and may store interface preferences such as theme. It does not currently use advertising cookies.

Security

We use reasonable technical and organisational measures to protect personal data, including access controls, encrypted transport, password hashing, backups, and operational monitoring. No online service can guarantee perfect security.

Changes

This policy may be updated as the service, providers, or legal requirements change. Material changes will be reflected on this page with an updated date.