Privacy

Rotation is a daily music chart you read. There are no accounts and no logins. We do not track you across the internet, we do not sell data about you, and we do not run advertising networks. You can read every word of Rotation without telling us anything. If you subscribe to the weekly pressing, we hold your email address. We also record sessions, to find where the site confuses people. Anything you type is hidden from the recording, and recordings are deleted after thirty days.

Rotation is operated by Apropos Studio, LLC, which is the data controller for anything described below.

Visiting the site. We use privacy-preserving, cookie-free analytics to count how many people read each edition and whether they come back. It records aggregate figures such as page views, referring site and country. That counter does not use cookies, does not fingerprint your device, and does not build a profile of you or follow you to other sites. Nothing on this site sets a cookie, so there is no cookie banner and nothing to consent to.

Pressing play. When a record starts or a session finishes, we count it: which page it played from, which record, and the day. That is the entire event. It carries no account, no cookie, no IP address and no device details, because the counter has no columns for them: we count plays, never people. These counts tell us whether the listening side of Rotation is working, and nothing else.

Who is listening, on the map. The map shows who is listening right now and from where. For that, a press of play in the device counter below also carries the country it came from and, when it came from a city of 300,000 people or more, that city; smaller places are shown as their country only. The city is deleted an hour later and the country a month later, and neither is ever anything about you: it is where the edge of the network saw the press come from, at city level at most, and it is never joined to anything else here. Your own mark on the map is drawn by your browser from the same reading and never comes back from our records.

Counting returning devices. Your browser holds a random id in its local storage, so we can count how many devices come back and which parts of Rotation get used: a page viewed, a record played, a save to the queue or to favorites, an analyzer run, a subscribe attempt, a release note shown and whether its button was taken, and that a page was touched at all: the first press, key, touch or turn of the wheel on it, never where or which. The id is random, not derived from anything about you or your device, and it is never anything about you: no name, no email, no IP address, no browser details, and it is never joined to your email address or to anything else here. Our server reads what your browser says it is only to note one word beside each count: a browser, an automated browser, a crawler, or nothing said. That lets us leave robots out of the counts; the description itself is not kept. When you arrive from a link we tagged ourselves for a post or a message, we keep which of a few named places it was (Instagram, Reddit, a text to friends) and nothing else from the link. Clear your site data and it is gone; we then count you as a new device, because you are one to us. The same counts are passed on by our server, not your browser, to the service that holds the session recordings described below, under the same random id and without your IP address, so the charts we read are the counts we keep. When a session is being recorded, each count is placed on that recording, so a press can be watched in the moments around it. The play counter described above is unchanged and still carries no id at all. You can see your own id, in full, at rotation.today/device: that is the whole of the id, and that page says what is recorded against it.

Recording a session. To find where Rotation confuses people, we record sessions and watch them back: which pages you moved through, where you scrolled, what you clicked. Everything you type is hidden before it leaves your browser, including the email box and the note on an analyzer flag, so a recording shows that you typed, not what. When a page breaks, we are sent the error it threw, the record that was playing, and your browser’s language and whether it translated the page, recording or not, so we can fix it. The recording carries the same random device id described above and nothing else about you: no name, no account, and it is never joined to your email address. Your IP address is not stored, but an approximate place is worked out from it and kept with the recording: the country, region, city and postal area the request came from, and an approximate latitude and longitude worked out from that address rather than read from your device. That is finer than the places drawn on the map above, which are blunted on purpose because they are published; a recording is only ever looked at by us. The recording itself is deleted after thirty days. The place worked out from your IP address is stored with the counts rather than with the recording, and outlives it; how long is below. Either way it covers this site only.

Flagging an analyzer reading. The key & BPM analyzer runs on your device and your audio never uploads. If you choose to flag a result as wrong, we receive the flag itself: the reading, the note you typed, and a short fingerprint derived from the file’s name, size and modified date so repeat flags for the same file group together. It carries no account, no cookie and no audio. To keep this endpoint from being flooded, our server reads your IP address to make that one decision and does not store it.

Subscribing to the weekly pressing. Give us your email address and we send you the weekly pressing, plus the occasional note about something we have built. Our email provider holds the address. If you asked for one country’s letter, the provider also holds which country: that is the list you are on, and it is the only thing it holds beside the address. Rotation’s database never sees either, not even while your confirmation is pending, because the pending state travels inside the link we email you rather than in a table here. We never join it to what you read, what you play or what you save, and there is nothing to join it to: the counter has no columns for people and your favorites never leave your browser. Every email has an unsubscribe link. Using it deletes the address.

Server logs. Our hosting provider keeps short-lived request logs, including IP addresses, for security and abuse prevention. We do not use them for analytics and we do not join them to anything else.

We do not collect data about you from the music platforms we measure. Rotation reads published chart rankings, which are aggregate lists of songs. It does not read, request, receive or store any individual user’s account data, listening history, viewing history, videos, followers or engagement from Spotify, Apple Music, Shazam, YouTube, TikTok, Deezer or any other platform. There is nothing in our ledger that identifies a person.

Song pages may embed official players from music platforms so you can hear what you are reading about. Those players are served by the platform, not by us. If you press play, that platform may set its own cookies and receive your IP address and player interactions under its own privacy policy, which we do not control. Favoriting a record fetches its 30-second preview from Deezer, so Deezer sees your IP address and the song you saved, likewise under its own policy. If you never press play and never favorite a record, you are subject to this policy alone.

Rotation uses YouTube API Services to find and check the official video for each charted record, and plays it through YouTube’s IFrame player. We ask YouTube two things: which videos might be a given recording, and then, for each candidate, its exact length, its channel, its title and whether it may be embedded. That second question is the whole job. We will only play a video whose length matches the record, so that you hear the record rather than a sped-up re-upload of it.

All of that is public information about videos. We use an API key, not a sign-in: Rotation never asks you to connect a YouTube or Google account, and it receives no account data, viewing history or subscriptions belonging to anyone. No player exists on the page until you press play, as described above.

In using Rotation you are also bound by the YouTube Terms of Service. What Google receives once a video is playing is covered by the Google Privacy Policy.

What we store, and for how long. For each record we keep the video’s id, its length, its channel name and whether it may be embedded. None of it belongs to a person. We refresh every one of those entries against YouTube at least every 30 days, and anything we cannot confirm on that pass is deleted rather than kept: a video that has been removed, made private or turned off for embedding loses its stored details the same night. Nightly job, every night.

Deleting it, and revoking our access. To have a record’s stored video details deleted, write to us and say which record; we remove them from the ledger and the record simply stops playing until it is resolved again. Because Rotation uses an API key and never asks you to sign in, it holds no authorisation belonging to you and there is nothing of yours for us to delete. If you have ever granted any application access to your Google account, you can see and revoke it at Google security settings.

We use a small number of third parties to run the product: a hosting provider to serve the site, a database provider to store the chart ledger, an email provider to send the weekly pressing, and two analytics providers as described above, one of which also stores the session recordings. They process data only to provide those services to us.

Chart data, which is about songs rather than people, is kept indefinitely: the archive is the point of the product. Play counts and analyzer flags describe records and readings, not people. Device counts carry only the random id described above, which stops meaning anything the moment you clear your site data. The page counter's data is aggregate and contains nothing personal to delete. Session recordings are deleted after thirty days. The counts they sit beside, and the place worked out from your IP address, are held by our provider under a one-year retention window that we cannot shorten. We keep your email address until you unsubscribe.

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, by writing to the address below. Since we are unlikely to hold any personal data about you beyond an email address, this is usually a short conversation.

Rotation is not directed at children under 13 and we do not knowingly collect information from them.

If this policy changes we will update the date at the top of this page. Material changes will be noted in the daily edition rather than made quietly.

Write to hello@rotation.today.