Privacy policy

Identify Genre is a free web tool at identifygenre.com that turns a public Spotify artist or track URL into a genre intelligence report for music marketing research.

It is built and operated by Luke Byatt, a sole trader based in Australia. For privacy purposes, Luke Byatt is the data controller — the person responsible for deciding how your personal information is handled. You can reach us through lukebyatt.com.

In this policy, “we” and “us” mean Identify Genre, and “you” means the person using the tool.

This policy explains what we collect when you use identifygenre.com, why we collect it, who else processes it, how long it lasts, and what you can ask us to do about it. It covers the analyser, the marketing pages, the blog, the mailing list, and the playlist feedback forms.

It does not cover other websites. When you follow a link out to Spotify, Last.fm, MusicBrainz, Every Noise at Once, Substack, or lukebyatt.com, those services are governed by their own privacy policies.

Information you give us

• —Spotify URLs. When you paste an artist or track URL, it is sent to our server, where we extract the Spotify ID so we can look up public metadata. We do not keep a record connecting a lookup to you.
• —Mailing list details. If you choose to subscribe, we store your name, your email address, the date you subscribed, and which of the two optional boxes you ticked (the Substack newsletter, and news about other products). This is entirely optional and is never required to view a report.
• —Playlist feedback. If you flag a playlist as a bad match or suggest one we have missed, we store the playlist ID, the playlist name where you supply one, your written reason (up to 500 characters), the artist ID you were viewing, your IP address, and a timestamp. The stored IP address is capped at 20 characters, which shortens long IPv6 addresses but keeps a typical IPv4 address intact, so please treat it as a full address rather than an anonymised one. Please do not put personal details in the free-text reason.

Information we collect automatically

• —IP address. Your IP address is visible to our server on every request. We use it for two things: in-memory counters that enforce rate limits (30 analyses, 10 feedback submissions, and 5 mailing list signups per hour), and a copy saved alongside playlist feedback to deter spam. Rate-limit counters exist only in server memory and are wiped whenever the app restarts or is redeployed. Beyond those two uses, we do not log or store your IP address ourselves.
• —Request and device metadata. Our hosting provider records standard server log data such as the URL requested, the HTTP method, your browser user-agent, an approximate location derived from your IP address, and response timings.
• —Aggregated usage data. Page views and performance measurements, described under Analytics below.

Information stored in your browser

The tool keeps two small entries in your browser’s local storage. Neither is a cookie, and neither is sent to us:

You can remove both at any time by clearing site data for identifygenre.com in your browser settings.

The report itself is held in your browser’s memory while you read it and disappears when you refresh. PDF and CSV exports are generated entirely inside your browser, so an exported file is never uploaded to us.

• —Spotify passwords, or any Spotify account access. The tool authenticates to Spotify with our own server credentials, so you are never asked to authorise anything.
• —Payment details. Identify Genre is free and there is nothing to buy.
• —Sensitive or special category information. We do not ask for, want, or knowingly store anything about your health, race, religion, sexual orientation, politics, biometrics, or precise location.
• —Government or financial identifiers.
• —Advertising and social media tracking data. There are no Meta, Google, TikTok, or LinkedIn pixels on this site.
• —Anything sent to an AI provider. Nothing you submit is passed to a large language model or used to train one.

Where the GDPR applies, we must have a lawful basis for each use of your personal information. Ours are set out below.

Where we rely on legitimate interests, we have weighed them against your rights and kept collection to the minimum the tool needs to work. You can object to any of it — see Your rights and choices.

Identify Genre sets no cookies. There is no cookie banner because there is nothing to consent to on the storage side: no advertising cookies, no analytics cookies, no cross-site tracking, and no third-party cookie scripts. The only browser storage is the two functional local storage entries listed above.

Web fonts are bundled and served from our own domain, so visiting the site does not send a request to Google Fonts.

One thing worth knowing: artist artwork is loaded straight from Spotify’s image CDN (i.scdn.co). Your browser makes that request directly to Spotify, which means Spotify can see your IP address and user-agent for images. That request is covered by Spotify’s privacy policy, not ours.

We use Vercel Web Analytics and its Web Vitals measurements. It is cookieless: instead of storing an identifier on your device, visitors are counted using a hash generated from the incoming request that resets every day, so you cannot be followed from one day to the next or from one website to another. We only ever see aggregated reports — page views, referrers, country, browser, and load timings.

We do not run Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, PostHog, or any advertising tracker. We do not use session recording or heatmaps.

Because that hash is derived in part from your IP address, some regulators treat it as personal data even though nothing is stored on your device. We rely on legitimate interests for it. If you would rather not be counted at all, a standard browser tracker blocker will stop the analytics script loading and the tool will still work normally.

We keep the stack deliberately small. These are every organisation that touches data on our behalf or receives data as part of building a report:

Calls to Spotify, Last.fm, and MusicBrainz are made by our server rather than your browser, so those providers do not receive your IP address. The one exception is artist artwork, as described under Cookies and browser storage.

We have no advertising networks, data brokers, or ad-tech partners. We do not sell, rent, or trade personal information, and we do not disclose it to anyone else except where we are legally required to.

Reports describe recording artists, not the people using the tool, so it is worth being clear about that side too.

The information in a report — artist names, artwork, genre tags, similar artists, playlist placements, and market signals — is professional information that the artist or their distributor has already published through Spotify, or that contributors have added to open music databases such as MusicBrainz and Last.fm. We do not add private details, contact information, or anything about an artist’s personal life.

Where that information relates to an identifiable person, we process it on the basis of legitimate interests in providing music industry research using already-public professional data.

Genre labels, similar-artist lists, and market estimates are automated best guesses rather than statements of fact, and they can be wrong. If you are an artist or a representative and something in a report is inaccurate, or you object to it appearing, get in touch and we will review it. Because most of the underlying data comes from third parties, a lasting correction usually has to be made at the source — Spotify for artist profile data, MusicBrainz or Last.fm for community tags — and we will point you to the right place. Our own cached copy clears within 24 hours either way.

Cache entries are keyed by the artist’s Spotify ID, not by you, which means the same cached report is served to everyone who looks up that artist. We do not build a profile of what you have searched for.

Identify Genre is run from Australia, but the infrastructure is global. Vercel and Upstash are United States companies, and their systems may store or process data in the United States, the European Union, and other regions where they operate.

If you are in the EU, the UK, or Switzerland, your information may therefore be transferred outside your country, principally to the United States. Those transfers rely on the safeguards in our providers’ data processing terms — the Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU–US Data Privacy Framework where a provider is certified under it.

If you are in Australia, this is an overseas disclosure under Australian Privacy Principle 8. We take reasonable steps to use providers that handle personal information consistently with the Australian Privacy Principles, but we cannot guarantee an overseas provider’s conduct, and you may not be able to seek redress in Australia for a breach by one of them.

• —The site is served only over HTTPS, with HSTS enabled.
• —A strict Content-Security-Policy is sent on every response, alongside X-Frame-Options, Referrer-Policy, and Permissions-Policy headers, to limit what can run in your browser.
• —API keys and secrets are held server-side as environment variables and are never exposed to the browser.
• —Access to our Redis store is authenticated and limited to our server.
• —Every API route is rate-limited per IP address.
• —The mailing list endpoint deliberately returns the same response whether or not an address is already subscribed, so it cannot be used to test whether you are on the list.
• —Free-text input is length-limited and sanitised before it is stored.

No system is perfectly secure, and Identify Genre is a small independent project rather than an enterprise platform. Please do not send us anything sensitive or confidential.

Wherever you live, you can ask us to:

• —Give you a copy of any personal information we hold about you.
• —Correct anything that is inaccurate or out of date.
• —Delete it.
• —Stop using it, or restrict how we use it, where we rely on legitimate interests.
• —Provide it in a portable, machine-readable form.
• —Stop emailing you, by withdrawing your consent.

Some of this you can do yourself, without asking us:

• —Clear your search history yourself, by clearing site data for identifygenre.com in your browser settings. It only ever existed on your device, so there is nothing for us to delete.
• —Block the analytics script with any standard browser tracker blocker. The tool still works.
• —Simply never submit a form. The analyser works fully without your name or email.

To make a request, contact us through lukebyatt.com. There is no charge, and we will respond within 30 days. We may need to ask a question or two to be confident we are dealing with the right person.

In practice, deletion requests are simple, because we hold so little. For most people the only record of them is a mailing list entry; everything else has already expired on its own.

The data controller is Luke Byatt, operating as a sole trader in Australia, contactable through lukebyatt.com.

Under the EU GDPR and the UK GDPR you have the rights of access (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20), objection (21), and withdrawal of consent (Article 7(3)). Withdrawing consent does not affect processing that already took place while it was in force.

You also have the right to complain to a supervisory authority: the Information Commissioner’s Office in the UK, or your national data protection authority in the EU. You can go to them without contacting us first, though we would appreciate the chance to put things right.

You are never required to provide personal information to use the analyser, and we do not use your information for advertising or profiling.

Identify Genre is operated from Australia by Luke Byatt as a sole trader. As a small business we may fall outside the direct coverage of the Privacy Act 1988 (Cth), but we handle personal information in line with the Australian Privacy Principles as a matter of policy.

That means we tell you what we collect and why (APP 1 and APP 5), we use it only for the purpose we collected it for (APP 6), we tell you when it is disclosed overseas (APP 8), we take reasonable steps to protect it (APP 11), and we give you access to it and correct it on request (APP 12 and APP 13).

If you are unhappy with how we have handled your personal information, please contact us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner.

Under the California Consumer Privacy Act as amended by the CPRA, in the twelve months before the date at the top of this page we collected these categories of personal information:

• —Identifiers — name and email address from mailing list subscribers, and IP addresses in server logs and feedback records.
• —Internet or network activity — pages visited, referring page, browser and device type, and requests made to our API.
• —Geolocation data — coarse, country or region level, inferred from IP address. We never collect precise location.

We collected it for the business purposes set out under Why we use it. It comes either from you, when you paste a URL or submit a form, or automatically from your device. We disclose it only to the service providers listed above, for those same purposes.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never have, including for consumers we know to be under 16. We do not collect sensitive personal information as the CPRA defines it, so there is no right to limit for you to exercise, and we do not use or disclose personal information for purposes incompatible with those described here.

You have the right to know and access your personal information, to correct it, to delete it, to opt out of sale or sharing (which does not apply, since we do neither), and not to be discriminated against for exercising any of those rights. We offer no financial incentives for your data. You may use an authorised agent, and we verify requests by matching the details you give us against what we hold.

Residents of other US states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon — have comparable rights to access, correct, delete, and port their information, and to opt out of targeted advertising, sale, and profiling. We carry out none of those three activities. Requests are handled the same way, through the contact route below.

Identify Genre is a marketing research tool intended for people aged 16 and over, and it is not directed at children. We do not knowingly collect personal information from anyone under 16. Realistically the only way a child could give us anything is a mailing list signup — if you believe that has happened, tell us and we will delete it promptly.

Genre classification, similar-artist scoring, and market estimates are produced automatically, by combining several data sources with weighted rules. Those outputs describe artists and their music, not you.

We do not carry out automated decision-making or profiling that produces legal effects for you, or that otherwise significantly affects you. No decision about you is made anywhere in this tool. The pipeline is rule-based, and nothing you submit is sent to a machine learning provider for training or inference.

If a breach occurred that was likely to result in serious harm, we would notify the individuals affected and the Office of the Australian Information Commissioner, as required by Australia’s Notifiable Data Breaches scheme. Where the GDPR applies, we would notify the relevant supervisory authority within 72 hours of becoming aware of it.

We update this page whenever the tool changes in a way that affects your privacy. The date at the top always reflects the current version.

If a change materially affects how we handle your personal information, we will say so clearly on this page, and where we hold your email address and the change is significant, we will tell you directly. Continuing to use Identify Genre after an update means you accept the revised policy.

Identify Genre is built and operated by Luke Byatt, a sole trader based in Australia. For any privacy question, or to exercise any of the rights above, get in touch through lukebyatt.com. We aim to reply within a few days, and will always respond within 30 days.

If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner in Australia, the Information Commissioner’s Office in the UK, or your national data protection authority in the EU.