Undersong Mood library and mood sync — Privacy Policy

Version 1.0 · Effective 2026-10-30 · https://moods.bshk.app/privacy

Short version

Browsing the library and adding moods don't need an account.
To share moods or sync them between your devices, you sign in with your email. One account covers both. We keep your email, your display name and your sign-in sessions.
If you turn on sync in Undersong, we store your moods privately so all your devices have the same ones. Nobody else can see them.
Moods you share are public. Your email is never shown.
The library has no analytics. We don't sell your data, show ads or track you across other sites.
Your tracks, songs, hearts and skips stay on your Mac. A song used to make a mood never leaves it.

1. Who is responsible

Aleksandr Beshkenadze, a private individual in Finland who publishes Undersong under the BSHK brand ("BSHK", "we", "us"), is responsible for your personal data. Contact: support@bshk.app.

This policy covers https://moods.bshk.app and the account features in Undersong: signing in, sharing moods to the library, My moods, and private mood sync between your devices. It doesn't cover the error reports and analytics of the Undersong app itself.

2. What we collect and why

Data	Why we use it	Legal basis (EU and UK)
Email address	To send your sign-in codes, and to write to you about your moods, reports about them, our decisions and important changes to our terms	Contract
Sign-in codes — a one-time 6-digit code	To sign you in. There is no password. A code works for 10 minutes	Contract
Display name — 2 to 32 characters	To show who shared a mood, unless you hide it	Contract
Acceptance of the terms — a record that you accepted the Terms of Use	To show that you agreed to them	Contract and legitimate interests: handling legal claims
Sessions — a session token and when it was created and last used	To keep you signed in on the website and in Undersong	Contract
App sign-in — your consent to let Undersong sync, and the tokens the app uses: access tokens that expire after 5 minutes and a refresh token to renew them. On your device they are kept in the Keychain or Windows Credential Manager. We don't record a device ID	To let Undersong sync without asking you to sign in every time	Contract
Synced moods — each mood's full definition (name, symbol, tags and words of both ends, BPM; for a mood made from a song, also technical details of its sound guide, but not the song's file name), every saved version of it, the history of changes, and markers for deleted moods	To keep your moods the same on every device you sign in on, and to resolve edits made on two devices at once	Contract
Moods you share — name, symbol, description, tags and words of both ends, preview, the "Show my name" setting, dates, the number of adds, and the link to your account	To run the library	Contract
Add records — which mood and which version of it was added, when, and a key of your Undersong installation in hashed form (SHA-256)	To count how many times each mood was added, without counting the same installation twice	Legitimate interests: showing how many people added a mood
Your IP address, for rate limits	Cloudflare's rate limiting counts requests per IP address in 60-second windows, to limit how often codes, shares and reports can be sent and to stop abuse	Legitimate interests: keeping the library safe
Cloudflare Turnstile signals — IP address, TLS fingerprint, browser user agent	On the website, to check that a request for a sign-in code or a report is sent by a person and not a bot. Requests from the Undersong app don't use Turnstile	Legitimate interests: keeping the library safe
Technical logs — Cloudflare Workers logs and traces of requests and errors	To find and fix problems. Our own error records contain only what happened and a random request ID	Legitimate interests: keeping the library working
Reports — the reason, what happened, your email and your confirmation; for formal copyright notices also your name, postal address, phone number and signature	To handle the report and tell you what we decide	Legal obligation (EU Digital Services Act) and legitimate interests
Counter-notices — name, postal address, phone number, statements	To handle the counter-notice. US law requires us to pass it to the person who reported	Legitimate interests: handling legal claims
Disputes, decisions and strikes	To apply the Copyright and Content Policy and to keep repeat infringers out	Legal obligation and legitimate interests
Messages you send us	To answer you	Legitimate interests

IP addresses. We don't store your IP address or a hash of it in our database, and sessions don't record it. Cloudflare sees your IP address when it delivers the site and uses it for rate limits and Turnstile (section 4).

Adds. Pressing Add on the website sends us nothing; your browser only remembers it (section 11). When you save an added mood, Undersong sends us an add record. It contains no account, name or email. But the same installation key appears on every add from one installation of Undersong, so add records from one Mac can be linked to each other.

Sync is private. Synced moods are visible only to you. Sharing a mood to the library is a separate step that you take yourself. Sync is off until you turn it on in Undersong.

What we don't collect: passwords, payment details, your tracks, your songs or their sound, your hearts and skips, your preferences, or what you listen to.

No analytics. The library doesn't use Umami, PostHog, Google Analytics or any other product analytics.

3. What is public

Public: everything in a mood you share, your display name on moods that keep your name, the date it was shared and how many times it was added.
Never public: your email, your sessions, synced moods, add records, and reports.
Shared anonymously: if you turn off "Show my name", other people see "Shared anonymously". The mood stays linked to your account. We reveal who you are only when the law requires it (for example, a court order or a subpoena), or when you send a counter-notice (section 4).

Cloudflare, Inc. hosts the library and sync, stores their data, applies rate limits, keeps technical logs and sends our emails, including sign-in codes, through Cloudflare Email Service (Cloudflare acts as our processor under its Data Processing Addendum). It also runs Turnstile. We don't pass your IP address to Turnstile's check ourselves. Cloudflare processes Turnstile signals for us to protect the site, and on its own behalf to improve Turnstile's bot detection. See https://www.cloudflare.com/turnstile-privacy-policy/.
People involved in a report, as the Copyright and Content Policy explains. The publisher learns what a report says. We share the reporter's name only when it is strictly necessary, and never their email, address or phone number unless they agree or the law requires it. If you send a counter-notice, we pass your name, address and phone number to the person who reported. US law requires this.
Authorities, when the law requires it, or when information suggests a crime threatening someone's life or safety.
Whoever takes over Undersong, if that happens. This policy will still protect your data.

We don't sell personal data and don't share it for advertising.

5. Where your data is processed

Cloudflare runs a global network, so your data may be processed outside your country, including in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework. Its Data Processing Addendum adds the EU Standard Contractual Clauses as a fallback. The Mood library's database and file storage are in Cloudflare's EU jurisdiction. The code that handles requests runs on Cloudflare's global network.

6. How long we keep data

Data	How long
Email address and display name	Until you delete your account
Sign-in codes	Until used. A code stops working after 10 minutes and is deleted within a day after it expires
Sessions	Until you sign out or delete your account. Otherwise a session ends 90 days after you last used the library; using it extends the session, at most once a day. Expired sessions are deleted within a day after they expire
Moods you share	Until you delete them or your account. A deleted mood leaves the library within 7 days, usually at once
Add records	While the mood is in the library. They are deleted together with the mood or your account; only the total count stays
Synced moods, their earlier versions, the change history and deletion markers	As long as your account exists. When you delete a synced mood, it is marked as deleted on all your devices, but its earlier versions stay in the history until you delete your account. Deleting your account deletes all of it, except the deletion markers below
App sign-in	Access tokens: 5 minutes. A refresh token works for up to 30 days from when it was issued, and each renewal replaces it with a new one. Access can end sooner if you sign out in Undersong, access is revoked, or you delete your account
Backups	Up to 30 days after deletion
IP addresses	We don't store them. Cloudflare's rate limiting counts requests in 60-second windows
Turnstile	We don't store Turnstile tokens or check results. Cloudflare's notice explains how it handles the signals
Technical logs	Up to 7 days
Reports, notices, counter-notices, disputes, decisions, strikes, moderation records, proof that you accepted the terms, a mood's version and preview kept for a case, and the contact details in them	Up to 3 years
What we need to keep a closed account from coming back	A keyed hash (HMAC) of its email: up to 3 years. A temporary suspension: until it ends
After you delete your account	We keep technical deletion markers. They contain your account's pseudonymous ID, the deletion's IDs and times and a hash of the deletion event, and for each mood you published a removal marker: its old link, revision number, removal time and total add count. They contain no email, display name, sign-in codes, tokens, mood contents, words, tags, sound guides, audio or songs. They have no set end date: they stop a deleted account and its moods from coming back, including through sync
Messages you send us	As long as we need to answer, or with the report they are about

7. Deleting your data

Delete a mood or your whole account in My moods, on the website or in Undersong. To delete your account, you must have signed in within the last 10 minutes, and you confirm the deletion.
Account deletion finishes in the background; until then My moods shows it as processing. It removes your email and display name, sessions and sign-in tokens, your synced moods and their history, and the moods you published, with their versions, previews and add records.
For 10 minutes after the request, we keep a hash of your old session cookie so the browser can check the deletion's status; then it is erased. The original cookie isn't stored.
What stays after deletion is listed in section 6: deletion markers without your profile, moods or tokens, and records kept for legal reasons for up to 3 years.
Moods you delete leave the library. Copies that other people already added stay on their Macs, and we can't reach them.
Signing out of sync in Undersong stops syncing on that device but doesn't erase what we store. To erase your synced moods and their history, delete your account. The moods on your own devices stay there.
Some records stay for the periods in section 6.

8. Your rights

Wherever you live, you can ask us to:

show you the personal data we hold about you and give you a copy;
correct it — you can change your display name yourself in My moods;
delete it — you can delete your account yourself;
give you your moods, shared and synced, in a format you can reuse;
stop or limit using it, or object to uses based on our legitimate interests.

Write to support@bshk.app. We may ask you to confirm that you control the account's email address. We answer within one month. You can also complain to the data protection authority where you live, or to ours: Finland's Data Protection Ombudsman (https://tietosuoja.fi/en).

9. Security

The library uses HTTPS. There are no passwords to steal. Sign-in codes expire after 10 minutes, and limits slow down guessing. The sign-in cookie can't be read by scripts on the page. Undersong keeps its sign-in tokens in the Keychain or Windows Credential Manager, and access tokens expire after 5 minutes. We don't store your IP address, and we let as few people as possible access personal data.

10. Children

Accounts are for people aged 16 or older. If we learn that a younger person has an account, we delete it.

11. Cookies

Sign-in: one cookie, __Secure-better-auth.session_token, keeps you signed in. It is sent only over HTTPS, can't be read by scripts on the page, works only on moods.bshk.app and lasts as long as your session (section 6). Signing out deletes it. It is needed for the site to work, so it doesn't need your consent.
Account deletion status: after you ask to delete your account, the cookie __Secure-undersong.deletion_status lets this browser check how the deletion is going. It works only on moods.bshk.app and only for the deletion status, can't be read by scripts, and contains only the deletion's ID and dates — not your account, email or profile. It expires exactly 7 days after the request. It is needed for what you asked us to do, so it doesn't need your consent. While the deletion is in progress, local storage also keeps a note (undersong:deletion-pending) with its stage and ID. It gives no access to your account and is removed once the deletion is confirmed or you go back to My moods.
Added moods: when you press Add, your browser stores a note (undersong:opened:<mood>) in local storage so the page can show that you added it. It never leaves your browser and stays until you clear the site's data.
Turnstile: on the sign-in and report forms, Cloudflare may use what it needs to tell people from bots. See its Turnstile notice.
No analytics or advertising cookies.

12. Automated decisions

We don't make decisions about you that have legal or similarly significant effects by automated means alone. Limits and Turnstile block automated abuse, and a person reads every report and every dispute.

13. Changes

For important changes, we'll tell you at least 30 days in advance, in Undersong, in the library or by email.

14. Contact

Aleksandr Beshkenadze (BSHK), Finland · support@bshk.app