Privacy Policy

Sortune ("we", "us", "our") operates the sortune.com website. This Privacy Policy explains what data we access via YouTube API Services and, if you connect Spotify, the Spotify Web API, how we use it, how long we retain it, and your rights.

When you sign in with Google, we access (via YouTube API Services):

• Your Google account profile (name, email, avatar) — used for authentication
• Your YouTube Music library (playlists, liked videos, video metadata) — accessed via YouTube Data API v3 (part of YouTube API Services)
• What Sortune writes to your YouTube account: playlists it creates, changes or deletes, tracks it adds to or removes from them, and likes on the tracks it brings over from Spotify (always with Align and Keep in sync; in a transfer unless you switch that off); only when you ask — yourself, through an AI agent you authorized, or by setting a playlist pair to Keep in sync. It never deletes your own videos or removes your likes, and Align and Keep in sync never remove anything.
• AI-classified genre data for your tracks — stored in our database when you use the MCP integration or Sort

We store minimal data in our database:

• Your authentication session (managed by better-auth)
• If you connect Spotify: your Spotify user id and the tokens Spotify gives Sortune to read and change your Spotify library
• MCP API tokens you generate for AI agent access (hashed)
• AI-classified genre metadata for your tracks (video ID, artist, title, genres)
• Spotify → YouTube transfers you start: the playlist name, its track list and the result for each track, including whether its like went through
• The status of your Sortune Pro subscription, received from our payment provider
• The track lists of your YouTube and Spotify libraries shown in “All music” (titles, artists or channels, lengths), kept at most 30 days after they were read; Spotify's part is deleted when you disconnect Spotify, YouTube's part when Sortune next finds its Google access revoked, and everything when you delete your account
• For Align: the playlist pairs you chose or set to Keep in sync; the YouTube videos Align looked at for Spotify (video id, title, channel, length), the Spotify tracks it found or offered for each, and which one each went to, so none is added twice; and which tracks have been on both sides of a pair (only their ids, or artist and title for a track from a file), so a track you removed is not added back
• For Sort: your sort chats (your messages, the replies and the proposed plan), the sorts you confirmed (the playlist names Sortune made and the tracks planned for each), a genre record (title, channel, genres) for each track a sort takes, and how many chat messages and genre lookups you used each day

We do NOT store your music files, listening history, watch history, or your YouTube or Spotify passwords.

Account data, OAuth tokens (Google's, and Spotify's if you connect it), MCP tokens, AI-classified metadata, transfers and the subscription record are retained for as long as your account is active, except as described below. When you delete your Sortune account (or contact us to request deletion), all associated data is permanently removed from our database within 30 days. Cached YouTube data is kept in our servers' memory for at most 5 minutes, so after you sign out, revoke access or delete your account it is gone from our servers within 5 minutes at most (at once from the server that handled your sign-out or deletion). The track lists the “All music” screen reads from your YouTube and Spotify libraries (titles, artists or channels, lengths) are stored in our database so it can show them again without reading everything anew; each is deleted at the latest 30 days after it was read, at once when you disconnect Spotify (for its part), when Sortune next finds its Google access revoked (for YouTube's part), and with your account. Spotify tokens are deleted when you disconnect Spotify. Align's record of the YouTube videos it looked at for Spotify: their titles, channels and lengths are deleted at the latest 30 days after they were read, and when Sortune next finds its Google access revoked; the rest (ids and outcomes) stays until you unpair the playlists or delete your account. Disconnecting Spotify does not delete this record. Align's record of which tracks have been on both sides of a pair: its YouTube part (video ids) is deleted once no read of your YouTube library has seen it for 30 days, and when Sortune next finds its Google access revoked. Its Spotify part is kept while the track is still on that side of the pair, and is deleted when you disconnect Spotify, unpair the playlists, or delete your account.

Sort chats are deleted 30 days after they started. The daily counts of chat messages and genre lookups are deleted after 30 days. Sort keeps a genre record (title, channel, genres) for every track it sorts, whether Claude found the genre, it came from YouTube, or there is none; it is kept with your other genre data, its title and channel are read again from YouTube every 30 days, and it is deleted when the video is gone. A confirmed sort keeps its playlist names, which Sortune made itself. Deleting your account deletes all of it.

Sortune does NOT train any machine-learning or AI models on YouTube user data. AI classification of tracks (genre detection) is done in real time, solely to organize your own playlists: by third-party AI agents you authorize via MCP, or by Claude (Anthropic) when you use Sort (see below). Classified metadata is stored only against your account and is not aggregated, sold, or shared.

The same applies to data read from Spotify: it is not used to train AI models and is not shared with AI agents or other third parties.

Sortune uses YouTube API Services (specifically YouTube Data API v3) to read and manage your playlists and, if you choose, to like videos for you. Your use of Sortune is also subject to the YouTube Terms of Service, the Google Privacy Policy, and the Google API Services User Data Policy, which Sortune complies with, including the Limited Use requirements.

When you generate an MCP token, third-party AI agents you authorize can access your YouTube Music library through Sortune. You control which agents have access and can revoke tokens at any time on the MCP API Access page. Sortune does not share YouTube data with any third party other than the AI agents you explicitly authorize, and Anthropic when you use Sort.

Sortune reads your Spotify music in two ways: from what you give it — a playlist link or a file — and, if you connect your Spotify account, through the Spotify Web API. Connecting Spotify is a beta, open by invitation for now. Without a connection we do not sign in to your Spotify account and cannot see anything inside it.

• Playlist links: we read the playlist's public Spotify page — its name and track list (title, artists, album, duration). Private playlists cannot be read this way.
• Uploaded files (a Spotify data export or a CSV): parsed in memory on our server to read playlist names and tracks. The file itself is never stored, and everything else in a Spotify export archive is ignored.
• Connecting Spotify: Sortune asks Spotify for permission to read and change your Liked Songs and your playlists, private and collaborative ones included — not for your email address. It reads your Spotify user id and display name, your Liked Songs, your playlists and the tracks of those you own or collaborate on (Spotify does not let it read the tracks of playlists you only follow).
• What Sortune writes to your Spotify account: tracks it adds to your playlists, private playlists it creates for YouTube playlists that have none on Spotify, and tracks it saves to your Liked Songs — only when you use Align or set a pair to Keep in sync. It never removes a track, a playlist or a saved track. Likes Sortune itself added on YouTube for tracks from Spotify are not copied back to your Liked Songs.
• The tokens Spotify gives Sortune are stored on our server. Spotify ends the connection after 180 days; then you connect again. Disconnect Spotify (in the account menu) deletes the tokens and the track lists read from Spotify.
• Each transfer keeps the playlist name, the Spotify playlist id, every track with its Spotify id, and the YouTube video each track went to (and whether its like went through, if you chose likes), so you can follow progress and review tracks — and so synced playlists know which tracks are new.
• Track matches are kept in a shared cache as anonymous pairs — a Spotify track and the YouTube video found for it — with no record of who asked, so the same track is not searched for twice.

Payments for Sortune Pro are processed by Creem (Armitage Labs OÜ, Estonia), our Merchant of Record. Creem collects and processes your payment details, billing address and tax information as the processor of payment data, under its own privacy policy; Sortune never sees your card number. From Creem we receive and store, against your account: Creem's customer, subscription and order ids, the product, the subscription status, the billing period and, if there was one, the refund date.

We use essential session cookies for authentication. We use no tracking or advertising cookies and no analytics cookies. Page performance and visit counts are measured with Vercel Web Analytics and Speed Insights, which are cookieless and report aggregated figures, not individual visitors.

All data is transmitted over HTTPS. OAuth tokens (Google's, and Spotify's if you connect it) are stored in a private PostgreSQL database (TLS in transit; database-level encryption depends on infrastructure provider). Access tokens are short-lived (typically 1 hour) and refreshed automatically. MCP tokens are stored as one-way hashes and can be revoked at any time.

You can:

• Revoke Sortune's access to your Google account at any time via the Google Account permissions page
• Revoke your MCP tokens on the MCP API Access page
• Disconnect Spotify in the account menu, which deletes Sortune's Spotify tokens and the track lists read from Spotify; to remove Sortune on Spotify's side too, use the Apps page of your Spotify account
• Delete your Sortune account and everything stored with it yourself, with Delete account in the account menu (⋯ next to Sign out). This also cancels an active Sortune Pro subscription, withdraws Sortune's access to your Google account and deletes its Spotify tokens.
• Request deletion of all your data by contacting us at newiqa@gmail.com

For privacy questions or data deletion requests, contact us at newiqa@gmail.com.