Privacy Notice

V0 Visualizer is a personal hobby project I made to view your Last.fm listening history with a nice interface. No company. No ads. No sales.

Here's what data I collect, how and why, the legal basis for it, and what rights you have. Cookie info is here too. Written to cover GDPR Art. 13-14 and Turkey's KVKK (Law 6698) disclosure duty, but kept as plain as I could.

• Your Last.fm profile: username, avatar, listening stats, country (already public on Last.fm)
• Last.fm library cache: loved tracks and recent scrobbles (synced from Last.fm, deleted when account is deleted)
• Login data: session cookies and session key
• Your Last.fm API key (optional, stored encrypted with AES-256-GCM)
• Community data: wall posts, reactions, notifications (if you use them)
• V0 Live / V0Rooms data (if you use listening rooms): rooms you create or join, room membership and roles, chat messages (including replies, mentions, and GIF links), track reactions, your DJ queue and play history, track bookmarks, event attendance, follows (who you follow on V0), your Live profile card (including a country code for the flag — read from your connection's Cloudflare country header, so your IP is never sent to any third party for this; hideable in settings), connection info (device type: desktop/mobile, connected surface: room/mini player, online/away presence), and moderation records (e.g. room bans and track-match reports you submit)
• Outbound scrobbling (opt-in, off by default): if you turn it on, tracks you hear in Live rooms are submitted to your own Last.fm account using the session key from your login; a per-listen scrobble log (what played, what was submitted, status) and any track-metadata corrections you submit (attributed to your account, possibly applied for other users after verification) are kept and deleted with the account
• Cosmetic badges: site-wide badge roles (e.g. developer, beta tester, hearts/stars/crowns/gems) shown next to your name — assigned manually, purely visual
• Feedback messages (if you send them) — including the optional screenshot, page URL, and browser info submitted with them
• Generated content: artwork story/collage data (deleted when account is deleted)
• Derived data: achievements, reputation points, and periodic profile snapshots (recommendations, taste match, timeline, daily facts) computed from your Last.fm history — deleted with the account
• Scrobble-integrity checks: listening histories are automatically analyzed for signs of scrobble manipulation (e.g. fake or duplicated scrobbles); results are kept as internal moderation logs and deleted with the account
• Browser storage: theme preference, UI state, announcement interactions
• Technical: IP hash, user-agent, login/logout activity logs (kept 30 days), error logs
• Optional V0Rooms playback diagnostics (only if you accept Performance): player state, page visibility, timing drift, buffering/loaded fraction, build id, room/play/video ids, and browser user-agent. Chat text and track titles are never included
• Profile analytics: total profile view count, last-7-day views, and unique visitor estimate — shown publicly on the profile page, and only collected if you accept measurement cookies
• Public visibility: your profile page, Wall of Fame posts, leaderboard rows, and Live rooms you join are visible to other users; the stats on your Live profile card (tracks you played, listen counts, reach, follower counts, last-seen presence across rooms) are visible to other users too; share preview images (OG cards) are generated from your public profile info

• Directly from you: when you log in with Last.fm, set preferences, or send content/feedback
• From the Last.fm API: your profile and library are fetched automatically once you connect your account, and a public profile's data is fetched when any user views it (see section 2a)
• Automatically: via cookies, server logs, and browser storage (technical data and — if you consent — analytics and V0Rooms playback diagnostics)

• To sign you in and keep you logged in
• To fetch and show your Last.fm data
• To run community features
• To run V0 Live listening rooms (synchronized playback, chat, presence)
• To stop spam and abuse
• To fix bugs
• Optional: to measure profile view stats (analytics)
• Optional: to diagnose V0Rooms playback interruptions and synchronization issues

• Sign-in, sessions, showing your Last.fm data, and the features you choose to use (community features, V0 Live rooms): necessary to provide the service you asked for — performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c)
• Essential cookies, security, and infrastructure: legitimate interest (GDPR Art. 6(1)(f), KVKK Art. 5/2-f)
• Spam/abuse prevention, error diagnostics, security logs: legitimate interest in keeping the service safe (GDPR Art. 6(1)(f), KVKK Art. 5/2-f)
• Caching viewed public Last.fm profiles (section 2a): legitimate interest (GDPR Art. 6(1)(f), KVKK Art. 5/2-f) — the data is already public on Last.fm
• Optional API key, optional outbound scrobbling, analytics (measurement) cookies, and V0Rooms playback diagnostics (performance): your consent (GDPR Art. 6(1)(a), KVKK Art. 5/1) — you can withdraw it any time
• Short retention after account deletion: legal obligation and legitimate interest in handling claims (GDPR Art. 6(1)(c) and (f), KVKK Art. 5/2-ç and f)

• Cloudflare: all traffic to the site passes through Cloudflare's network (DDoS protection, caching, TLS), so Cloudflare processes your IP address and request metadata as an infrastructure provider. It may set its own security cookies (e.g. bot protection) that count as required cookies
• Last.fm: Your music data and login verification
• CDNs: Album covers and photos (Last.fm, Spotify)
• YouTube (Google): plays music videos in V0 Live rooms via the embedded player in privacy-enhanced mode (youtube-nocookie.com). While a room is playing, your browser talks to Google directly, so Google sees your IP address and user-agent under the Google Privacy Policy (google.com/policies/privacy). Track searches and playlist imports go through the YouTube API Services from the V0 server, not your browser; the search cache is deleted within 30 days
• Spotify: track metadata lookups to verify queued videos are real songs — server-side only; no personal data of yours is sent
• Giphy: GIF search in Live chat is proxied through the V0 server (Giphy sees the search text, not who searched). The GIFs themselves load in your browser from Giphy's servers, which see your IP address like any image host
• Media links shared by users: images, videos, and GIFs posted in Live chat, custom profile banners, and room covers load directly from wherever they're hosted — that host sees your IP address and user-agent when your browser displays them. Only https image/video links from public hosts are embedded

• The site is served through Cloudflare's global network (US-based, worldwide edge servers). The app also talks to Last.fm (UK), serves album art via Last.fm and Spotify CDNs (EU/US), plays Live-room video through YouTube/Google (US), and fetches chat GIFs from Giphy (US), so some data may be processed on servers outside your country.
• Only the minimum needed for the feature is sent (e.g. a catalog query or an image request); these providers act as independent controllers under their own privacy policies.
• Explicit consent (KVKK Art. 9): when you create an account, a separate checkbox on the login form asks for your explicit consent to the international transfers listed here; the moment you grant it is recorded with a timestamp. The site can't run without these providers, so an account can't be created without this consent. To withdraw it, delete your account (section 12) — withdrawal doesn't affect processing done before.
• No data is sold or shared with third parties for marketing.

• Required: Session cookies (auth_token, auth_session, auth_presence), age gate, security checks — needed for the site to work; no consent required
• Measurement (optional, needs consent): profile visitor ID (profile_visitor_id) — used for anonymous unique visitor counting; only set if you accept measurement cookies on the banner
• Optional preferences: Theme and UI preferences; stored in browser storage under the ui_appearance_hint key
• Performance (optional, needs consent): browser-side data cache and V0Rooms playback diagnostics sent to the V0 backend; diagnostics exclude chat text and track titles, and collection stops if you withdraw consent
• Control: Manage your cookie preferences via the banner — "Accept" enables all optional categories, "Decline" keeps only the required cookies, and "Customize" lets you pick per category (preferences / measurement / performance)

• Session cookies: access token = 15 minutes, session = 30 days inactive / 90 days max
• If you delete your account: your account is flagged for deletion and sign-in is blocked right away, then your data is kept for up to 30 days for legal and security review and permanently deleted at that point — this includes sessions, login data, the Last.fm connection, settings, loved tracks, notifications, your Wall of Fame reactions, achievements, reputation, visitor analytics, and your V0 Live data (memberships, follows, bookmarks, queues, reactions, event attendance, Live profile).
• Wall of Fame posts: because they're part of the public yearly archive, your posts are not deleted — they're anonymized instead. Your username, avatar, and account link are removed and they show as "Anonymous". The same applies to Daily Spotlight / Legends records: your identity is removed, but the track stays in the archive.
• V0 Live chat messages and DJ play history: kept as part of the room's shared history but anonymized — your name and account link are removed from messages, system announcements, and track story cards. Rooms you created stay up for their members, with the creator shown as anonymous. Mentions inside messages other users wrote themselves (e.g. a chat line containing "@yourname") are their content and are not edited.
• Record of the deletion: after your account is permanently purged, a minimal deletion record (original username, deletion date and source) and its audit-log entry are kept so the deletion itself can be proven — this record contains no account data and exists only for accountability.
• Feedback and support threads: kept for support history, but unlinked from your account when it's purged — they no longer point to you
• Browser data: Until you clear it
• Visitor data (profile view tracking): 30 days
• Security logs: IP hashes and errors kept for abuse prevention (removed after 30 days)
• Optional V0Rooms playback diagnostics: kept in rotating backend logs for no more than 30 days

• Access: know what data is stored about you and get a copy as JSON (GDPR Art. 15, KVKK Art. 11)
• Rectification: ask me to fix incorrect or incomplete data (GDPR Art. 16, KVKK Art. 11)
• Erasure: delete your account and data; removed 30 days after the request (GDPR Art. 17, KVKK Art. 7 & 11)
• Restriction & objection: restrict or object to certain processing (GDPR Art. 18 & 21)
• Portability: get your data in a structured, machine-readable format (JSON) (GDPR Art. 20)
• Withdraw consent: for anything based on consent (analytics cookies, V0Rooms playback diagnostics, community features) any time — doesn't affect processing done before
• Complain: you can lodge a complaint with Turkey's Personal Data Protection Authority (KVKK Art. 13-14) or your EU supervisory authority (GDPR Art. 77)
• Requests: [email protected] — put "Data Export", "Correction", or "Account Deletion" in the subject (typically answered within 7 days)

• Included: Account info, profile settings, loved tracks, notifications, support history, and your activity logs — as separate JSON files
• Excluded: Internal security hashes, encrypted token material, your Last.fm API key, and internal moderation data
• Not in the standard export bundle: V0 Live data (chat messages, follows, bookmarks, queues) — mention it in your request if you want a copy