Privacy Policy

Skrtt is operated from Italy. For any privacy question or request, contact: info.skrtt@gmail.com.

2.1 Your Discord account. Browsing Skrtt needs no sign-in. Voting and uploading do: you sign in with Discord, and Discord then shares with us your Discord user ID, your display name (or username), and the address of your avatar image. We ask Discord only for its “identify” permission, so we do not receive your email address. Our sign-in software also stores the access and refresh tokens Discord issues at sign-in; with that permission they reach nothing beyond the same basic profile, and we do not use them for anything after you have signed in. We keep all of this, plus a record of your sign-in session, in our database.

Your Discord user ID is what your votes, your producer profile and any moderation action (such as a ban) are linked to. Skrtt is therefore not anonymous: we know which Discord account cast each vote and which one owns each producer profile. Your Discord name and avatar are not shown publicly on Skrtt — only back to you, in the “Sign out” link — and your producer name is what the public sees. Our moderators can see the Discord user ID behind a beat that has been reported.

2.2 Content you submit. If you upload a beat: the audio file, cover art image, beat title, producer name, country, genre, BPM, musical key, mood tags, and optional preview start time. If you fill in a producer bio or contact link, that too. Your producer profile is linked to your Discord user ID (not shown publicly).

2.3 Votes. Each vote records the beat, the week, and the Discord user ID that cast it — that is how the one-vote-per-beat-per-week rule is enforced.

2.4 IP address (hashed). In our own application database, we hash (irreversibly scramble) your IP address to enforce rate limits — per hour for votes and reports, per rolling week for uploads — and to detect abuse. We never store it in readable form there, and we do not use it to identify you personally. Separately, our hosting provider's infrastructure logs raw IP addresses briefly as standard technical/security practice — see 2.7.

2.5 Reports. Reporting a beat needs no sign-in. We store which beat was reported, when, and a hash of the reporter's IP address (to prevent spam reporting).

2.6 Captcha on uploads. The upload form runs Cloudflare Turnstile, which checks in your browser that you are not a bot. To confirm the result, we send Cloudflare the token it produced along with your IP address.

2.7 Standard server logs. Our hosting infrastructure (Cloudflare) automatically logs requests (e.g., IP address, browser type, timestamps) for security and reliability, as is standard for any website.

2.8 On-device storage. Your browser also remembers, purely on your own device (never sent to or readable by us), which beats you've voted for this week and which you've already reported — so the buttons reflect that if you revisit. Clearing your browser's site data resets this, on your device only. The Community status-animation pause preference is also stored only on your device.

2.9 Community suggestions, votes and private reports. Suggestions store your Discord user ID, original title and text, timestamps and moderation state. Administrators review the private original and may publish separate edited wording. Feature votes store the feature and your Discord user ID to prevent duplicate votes; public counts do not identify voters. Private bug reports store your Discord user ID, title, description, optional page path, status and timestamps. Only you and authorized administrators can read your reports. Internal notes are visible only to administrators. Moderation audit records store the action, item reference, version, time and an admin actor label. Account/IP-derived protected buckets support rate limiting. Avoid putting passwords, credentials or unrelated personal information into free text.

We do not collect your email address, any password (sign-in is handled by Discord), or any government ID. Personal information may also appear in content you choose to submit, including a bio, contact link, Community suggestion or private report.

• Your beat, profile, and associated data are kept until you ask us to delete them or until they are removed for violating our Terms.
• Your Discord account record (user ID, display name, avatar, sign-in tokens) is kept while you use Skrtt and deleted on request. A sign-in session stops working after 30 days without use.
• Individual beat votes — which account voted for which beat — are deleted when the scheduled weekly reset processes completed weeks, after their results are saved. The saved results record each beat's rank and vote count, not who voted. Community feature votes follow the separate retention practices described below.
• A ban record (the banned Discord user ID) is kept for as long as the ban applies.
• Report records are kept for a reasonable moderation period, then may be deleted.
• Community suggestions, votes, private reports, internal notes and audit records have no automatic time-based deletion job. Closing, archiving or soft-removing an item restricts its visibility but does not erase its stored text. Deletion requests require identity verification and manual review through the contact address below; any retained moderation records or exceptions are addressed as part of that review.
• Standard server/security logs are retained according to Cloudflare's standard log retention (typically a matter of weeks), not controlled directly by us.

We don't sell your data. We use the following processors to run the Service:

Cloudflare (hosting, database, file storage, content delivery, and the Turnstile captcha on uploads) — Cloudflare may process data on servers outside the EU as part of its global network. Cloudflare is GDPR-compliant and offers Standard Contractual Clauses / a Data Processing Addendum for this purpose.

Discord (sign-in) — when you choose to sign in, you are sent to Discord, which confirms who you are and shares with us the data described in 2.1. What Discord itself does with your account is governed by Discord's own privacy policy.

We do not share your data with advertisers. If this changes in the future (e.g., we add analytics or advertising tools), this Policy will be updated first, and a cookie consent banner will be added for any new non-essential cookie before it's used.

If paid features launch: when Skrtt introduces paid placement (as noted in our Terms of Service), a payment processor (e.g., Stripe) will be added to this list to handle transactions. Skrtt will not itself store your card details — the processor handles that directly under its own privacy policy. This Policy will be updated before payments go live.

Cookies

Over a secure connection the sign-in cookie names carry a __Secure- or __Host- prefix. Earlier versions of Skrtt also set an anonymous ID cookie (skrtt_voter); it is no longer set or read, and if your browser still has one it will expire on its own — you can delete it at any time.

Local storage (kept only on your device, never sent to us)

Skrtt does not currently use analytics, advertising, or marketing cookies. If we add any in the future, we will show a consent banner before setting them, as required by law.

You can exercise these rights by emailing info.skrtt@gmail.com with enough detail to locate your data (e.g., your Discord username, producer name, beat titles):

• Access — get a copy of the data we hold linked to your profile
• Rectification — correct inaccurate data (e.g., an editable bio field already lets you do this yourself)
• Erasure — ask us to delete your Discord account record, profile, beats, and associated data
• Restriction / Objection — ask us to limit or stop certain processing
• Portability — receive your data in a portable format
• Complaint — you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it) or your own country's equivalent authority

We will respond to verified requests within the timeframe required by law (one month from receipt, extendable by up to two further months for complex requests, in which case we'll tell you why within the first month).

Under Italian law, the digital age of consent is 14 (Art. 2-quinquies of the Privacy Code) — this is the number referenced in our Terms of Service. We do not knowingly collect data from children below the minimum age stated in our Terms. If you believe a child has used the Service in violation of this, contact us and we will remove the relevant data.

We use reasonable technical measures (rate limiting, hashed IP addresses, file validation, restricted admin access) to protect data. No online service can guarantee perfect security. We don't store readable IP addresses or passwords, which limits what could be exposed in the event of a breach; what we do hold about your Discord account is listed in 2.1, including the sign-in tokens, which with the “identify” permission reach only your basic Discord profile.

Skrtt is based in Italy but accepts users worldwide, consistent with our leaderboard's country filter. Wherever you are, your data may be processed in Italy and on Cloudflare's global infrastructure as described in Section 5.

We may update this Policy from time to time. Material changes will be highlighted on this page with an updated date at the top.

Questions or requests about this Policy: info.skrtt@gmail.com.