Privacy policy

Last updated · 25 August 2026

BassOrder is an open-source desktop app — from trash playlists to genre mastery — that helps sort music by musical genres (Spotify and local files). This page explains what data is processed, where it stays, and what your rights are.

1. Controller

Processing related to the site bassorder.smegg.cloud and the optional API api.bassorder.smegg.cloud is carried out by Eliot GIRAUD (personal / open-source project). Privacy contact: eliotgiraud@gmail.com (subject “Privacy”), or a GitHub issue with the same subject. Security reports: SECURITY.md.

2. Principles

• Local first: library, tags, history, and local profiles stay on your machine (SQLite).
• No advertising / no sale of data.
• No marketing telemetry in the app (no analytics tool such as Google Analytics on the landing page to date).
• The cloud (email account + “knowledge” sync) is optional.

3. Data processed

3.1 On your device

• Local profile handle / color
• Music metadata (artists, titles, suggested / confirmed genres), folder paths you choose
• Spotify tokens (OAuth) stored locally to call the Spotify API on your behalf
• PIN / local preferences if you enable them

Audio files are not uploaded to our servers: copy / move happens on your disk.

3.2 Cloud account (optional)

• Email address
• Password (stored as Argon2id hash, never in plain text)
• JWT / refresh tokens for the session
• Synced “knowledge”: artist ↔ genre associations (private mirror and, if you participate, contributions to an aggregated pool)

Legal basis: performance of the service you request (account + sync) and, for the aggregated pool, your consent / voluntary use of the feature.

3.3 Website

• Technical logs from the web server / reverse proxy (IP, user-agent, URL) for security and diagnostics — limited retention
• Installer downloads (no account required)

4. Spotify

If you connect Spotify, Spotify data processing is also governed by Spotify's privacy policy and Spotify developer terms. BassOrder is not affiliated with Spotify AB. You can revoke access in your Spotify account settings.

5. Recipients & hosting

• Local data: only you (and programs you authorize on your machine)
• API / site: VPS hosted by LWS (Ligne Web Services) SAS, 10 rue de Penthièvre, 75008 Paris, France (lws.fr) — access limited to project administration
• Public source code: GitHub (not your personal usage data)

No resale to brokers. No marketing subprocessors. Infrastructure providers (host, TLS certificates) may see technical metadata inherent to the Internet.

6. Retention periods

• Local: as long as you keep the app / SQLite database
• Cloud account: until you delete it in the app (self-service) or request erasure; deletion removes the account, sessions, and private knowledge mirror from the server
• Server logs: short duration, security / ops needs

7. Security

HTTPS, hashed passwords, auth rate-limiting, least-privilege on the server. No system is perfect: report a vulnerability via SECURITY.md.

8. Your rights (GDPR)

Under applicable law (EU / France), you may request:

• access, rectification, erasure
• restriction or objection
• portability of data you provided (e.g. email / knowledge)
• withdrawal of consent for optional uses

Self-service erasure: in the BassOrder desktop app, open Mon espace → Identity & cloud, then Delete my cloud account (password confirmation). This permanently deletes your cloud account and knowledge mirror on api.bassorder.smegg.cloud. Local library data on your device is not deleted.

You can also email eliotgiraud@gmail.com (subject “Privacy”) or open a Privacy issue on the repository. You may lodge a complaint with the CNIL.

9. Minors

The service is not intended for children under 15 (or the equivalent local age). Do not create a cloud account if you are under the required age.

10. Changes

This policy may evolve with the project. The date at the top of the page is authoritative. For material changes, a note may be added on the site or repository.

This policy applies only to the BassOrder service operated by the publisher at the address indicated above. Any redistribution of the software, any self-hosted instance, or any third-party service based on BassOrder is solely the responsibility of the person who operates it, including under applicable personal data regulations.