Privacy Policy
Effective date: July 25, 2026
Music Forest is a field notebook for your listening life — records released on this date, any year, and a private place to write. It is not a recommender, an ad product, or an engagement machine, and this policy reflects that: we collect as little as possible, we don't track you, and the notebook you write is end-to-end encrypted so that we cannot read it.
This policy covers the hosted service at musicforest.lol.
The service is operated by Music Forest LLC, a Connecticut limited liability company, at 781 Orange Street, New Haven, CT 06511. For any privacy question, or to exercise the rights below, contact us at info@musicforest.lol.
To sign in, you provide an email address and can add a mobile phone number for text sign-in. We send you a one-time code by email or text — or you sign in with Google. We use this only to authenticate you and to contact you about the service (for example, an invite or an account notice). Authentication is handled by our provider, Supabase (and Google, if you choose Google sign-in); text messages are delivered through Twilio.
Text-message sign-in. If you choose to sign in by text, we use your mobile number only to send you one-time sign-in codes. We do not sell your mobile number, and we do not share it — or any information gathered through text messaging — with third parties or affiliates for marketing or promotional purposes. We send a text only when you request a sign-in code, so message frequency depends on you. Message and data rates may apply. Reply STOP to opt out or HELP for help.
The notes, the records you keep, and platform availability marks you create are encrypted on your device before they reach us. We store only the encrypted result and the timestamps needed to sync it across your devices. Because the encryption key is derived from your Notebook password and never leaves your device, we cannot read your notebook, and neither can our hosting or database providers.
If you use the "Send feedback" button, we receive your message plus basic technical details (browser type, screen/window size, language, and the in-app URL). You can also tick a box to attach a snapshot of your current screen (a screenshot and a copy of the page) to help us fix what you're reporting — this is off by default and included only if you choose it. This is the one place your content is readable by us, and it is only ever sent when you click Send. If you do attach a snapshot, note that it captures whatever is on your screen at that moment — if you are viewing your notebook, that text may be included — so don't attach one from a screen you'd rather we not see.
If the service is invite-only and you ask for an invite, we collect the email address and any note you submit, plus your browser's User-Agent, so we can review and respond. We use this only to manage invitations.
Like any website, our hosting provider processes standard request information, including your IP address, to deliver and secure the service. We use your IP address transiently and in memory to rate-limit abuse of public endpoints; our own application logs record only non-identifying request metadata (the request method, the path without its query string, a status code, timing, an opaque request identifier, and your opaque account identifier) and do not record your IP address or anything you write.
We do not: run advertising or ad trackers; use analytics or behavioral profiling; build a profile of your tastes to "recommend" things; or sell, rent, or share your personal information with anyone for their own purposes.
We share data only with the service providers needed to run the app, and only for that purpose:
| Provider | Role | What it handles |
|---|---|---|
| Supabase | Authentication + encrypted database + feedback storage | Your email or phone number and login; your encrypted notebook data (unreadable to Supabase); feedback you send |
| Twilio | Text-message delivery | Your mobile phone number, to deliver one-time sign-in codes (only if you use text sign-in) |
| Render | Hosting | Serves the app; processes standard request data including IP addresses |
| Optional sign-in provider | Only if you choose "Continue with Google" | |
| jsDelivr (CDN) | Serves two open-source security libraries to your browser | Your IP address, as with loading any web resource |
| Apple (mzstatic) and the Cover Art Archive / Internet Archive | Album cover images | Your browser loads cover images directly from these services, which means they receive your IP address and which covers you view |
To provide album information and "listen on" links, our servers (not your browser) also contact music data services — Apple's iTunes Search API, Odesli, Deezer, MusicBrainz, Wikipedia, and Spotify. These receive the album or artist being looked up, but not your IP address or identity.
When you click a "Listen on …" link (Spotify, Apple Music, YouTube Music, Deezer, TIDAL, Amazon Music, Pandora, or Bandcamp), you leave our app and that service's own privacy policy applies. We send those links with a "no-referrer" policy, so we don't disclose which page you came from.
The Service is operated from and intended for users in the United States. Our hosting is in the United States (Render, Oregon) and our database/auth provider stores data in the United States (Supabase, AWS us-east-2, Ohio). If you access the Service from outside the United States, you do so on your own initiative and consent to your information being processed in the United States.
Whatever your location, you can:
Depending on where you live, you may also have rights to access, correct, restrict or object to processing, and to data portability, and the right to withdraw consent and to lodge a complaint with your data protection authority. To exercise any of these, contact us at info@musicforest.lol. We won't discriminate against you for exercising your rights.
Note on our ability to help with access/correction requests: because your notebook is end-to-end encrypted, we can't read, retrieve, or correct its contents for you — only you can, using the in-app export and editing tools. This is a privacy feature, not an evasion. We can delete the encrypted data and your account on request.
The Service is directed to users in the United States. To the extent the GDPR or UK GDPR nonetheless applies to you, we rely on:
The data controller is Music Forest LLC, a Connecticut limited liability company, reachable at info@musicforest.lol; the mailing address is 781 Orange Street, New Haven, CT 06511.
We do not sell or share personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising. California residents have rights to know, delete, and correct their personal information, and not to be discriminated against for exercising them. Contact info@musicforest.lol to make a request.
The service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact us and we will delete it.
Your notebook is protected with end-to-end encryption (AES-GCM, with keys derived from your Notebook password using Argon2id); we hold only ciphertext and cannot decrypt it. We serve the app over HTTPS with a strict Content-Security-Policy and related protections, pin our third-party scripts with Subresource Integrity, and guard server-side fetches against abuse. No system is perfectly secure, but we design to hold as little readable data as possible. When you set up your notebook you are shown a recovery code (once, at signup): either your Notebook password or that code can unlock your notebook, and the code is the reset path if you forget your Notebook password — we store only wrapped keys we cannot open. Important: if you lose both your Notebook password and your recovery code (and haven't enabled device unlock), your encrypted notebook cannot be recovered — by you or by us.
We may update this policy; we'll change the effective date above and, for material changes, provide a more prominent notice.
Questions or requests: info@musicforest.lol, Music Forest LLC, 781 Orange Street, New Haven, CT 06511.