Privacy
Last updated 11 September 2026
LEITA is a music discovery site. It keeps as little about you as it can to work, never sells it, and lets you delete all of it from Settings at any time.
What LEITA stores
Only if you sign in:
| Account | Your email address and name, if the way you signed in shares them, and which methods you use to sign in (email, Google, Apple, Spotify). Google and Apple share a verified email; Apple can give LEITA a private relay address instead. |
|---|---|
| Sign-in links | When you ask for an email link, a scrambled copy of it and your address, deleted a day after it expires. |
| Spotify token | The access and refresh token Spotify issues when you connect Spotify. It lets LEITA build your daily playlist and record recent plays while you're away. |
| Listening history | Songs you played (title, artist, album, cover, time), captured from Spotify's recent-plays list every few hours, plus any Spotify data export you upload. Up to 6,000 plays; older plays are dropped as new ones arrive. |
| Listen Later | Albums and artists you save to your list. |
| Daily playlist setting | Whether Discovery Pulse is on, and when it last ran. |
Pages that read your top artists, playlists or saved music ask Spotify each time you visit; LEITA does not keep a copy. Playlists you build are saved to your own Spotify library.
Usage counts
LEITA counts how many people visit each day. It stores a one-way hash, never your IP address or Spotify id. For signed-in visitors the hash stays the same across days, so LEITA can count monthly users. For everyone else it changes daily, so a visitor cannot be followed from one day to the next. These rows are deleted after 400 days. There are no ads, analytics scripts or tracking pixels.
Cookies
One cookie keeps you signed in; it is removed when you log out. Signing in with Apple sets two short-lived cookies, for at most ten minutes, to check the answer came from the sign-in you started. LEITA sets no cookies for visitors who don't sign in.
Services LEITA talks to
- Spotify, for listening data and the playlists you create, if you connect it.
- Google and Apple, only if you sign in with them.
- Resend delivers sign-in emails, so it receives your address when you ask for a link.
- Apple Music, for charts, similar artists, artist photos and song previews. LEITA sends artist names and ids, never anything about you.
- Last.fm, for charts when configured.
- Bandsintown and Songkick, for tour dates, by artist name.
- Google Fonts serves the site's typeface, so your browser contacts Google when a page loads.
- PayPal, only if you choose to support LEITA.
- Railway hosts the site and its database in the United States.
Keeping and deleting
Everything above is kept until you delete it. Settings has a button that deletes your account, sign-in methods, listening history, Listen Later list, daily playlist setting and Spotify token at once. Playlists you built stay in Spotify. To stop LEITA's access entirely, also remove it from your Spotify apps. Deleted data can remain in backups for up to a month before they are overwritten.
Children
LEITA is not meant for anyone under 13, and does not knowingly store data about them.
Changes and questions
If this policy changes, the date at the top changes with it. For questions or requests, email lpheaney5@gmail.com.