Privacy notice

What Tonaris keeps

• Your account: your email address, the display name you choose, and when you agreed to these terms.
• Your collection: albums with their links and artwork addresses, lists, folders, custom fields, descriptions, and how you arrange and view them.
• Sharing: the addresses you invite, who accepted, and your share links.
• Signing in: your sessions, each with the browser it's in; sign-in codes until they're used or expire; and the apps you connected, such as an AI assistant, with what you approved for them.
• Passkeys, if you add any: each one's public key, its name, the password manager it's in when that's known, and when you added it. Your face, fingerprint or PIN is checked on your device and never reaches Tonaris.
• Records for safety: a log of account changes, such as a new email address or a deletion, and a list of deletions by ID only, so restoring a backup never brings deleted data back.

Tonaris shows no ads, uses no analytics, doesn't track you on other sites, and never sells or shares your data for marketing.

On your device

Tonaris sets one cookie, which keeps you signed in, and a second for 5 minutes when you open the sign-in page or add a passkey, so a passkey can sign you in. Your browser also keeps a copy of your collection and any changes not yet saved, so Tonaris loads quickly and works offline. Signing out removes them.

Services Tonaris runs on

• Render runs Tonaris's servers and database, with its backups, in Frankfurt, Germany.
• Cloudflare answers for Tonaris's addresses, secures connections, caches album artwork, and keeps the list of deletions.
• Resend sends Tonaris's email, such as sign-in codes and invitations. It sends from Ireland, and keeps account data and logs in the US, under the EU–US Data Privacy Framework and standard contractual clauses.
• Sentry receives reports of errors, in its EU region, without your email address, cookies or what you typed.

The feedback board

Tonaris's feedback board, at feedback.tonaris.app, runs on Fider, a service of Northern App Labs. If you sign in to it with Tonaris, it receives your display name and email address. Anyone can read what you post and comment there, with your name but never your email. Deleting your Tonaris account doesn't remove them: delete them, or your account there, in the board's settings.

Where album details come from

When you add a link, Tonaris's server asks MusicBrainz and the Cover Art Archive about the album, and, depending on the link, Apple's iTunes lookup, Spotify, Qobuz's or Tidal's album page, or YouTube. They receive the link, or the album's title and artist, from Tonaris's server: never your name, email or IP address.

Tonaris uses YouTube API Services to identify YouTube Music links. It reads an album's title, artist, release date and track count from the YouTube Data API only to find the album in MusicBrainz, and keeps nothing YouTube returns. YouTube's data is covered by the Google Privacy Policy.

How long

Your account and collection are kept until you delete them. Deleted data is removed from the live service immediately and disappears from encrypted backups within 30 days. If we ever restore a backup, your deletion is re-applied before the service reopens.

Your choices

• Export your collection at any time in Settings → Data.
• Change your email address, or delete your account, in Settings → Account.
• For anything else, such as a copy of what's kept, a correction or an objection, write to [email protected]. In the EU or the UK, you can also complain to your data protection authority.

Changes

If this notice changes, Tonaris asks you to agree again before you go on.