What Melt Speakers keeps

Melt Speakers is built and published by Spergs, LLC, a Florida limited liability company. Reach us at privacy@spergs.com for anything privacy-related, or to point out something on this page that isn’t accurate.

We don’t sell, rent or trade data, and we don’t run ads.

An account on Melt Speakers is an email address and a password, plus a display name if one is set. The password is stored only as a PBKDF2-SHA256 hash (600,000 rounds), never as itself, so we can’t read it or send it back to you.

• Sign-in sessions are random bearer tokens. The server stores only a SHA-256 hash of each one, and a session expires after 30 days, or when you sign out.
• Invite codes are single-use, and stored only as hashes.
• Failed sign-ins are counted per email address to slow down password guessing. The count is kept in the server’s memory, not written to disk.

A Spotify streaming history export records, for every play, an IP address, a country, a device platform and more alongside the track. Before an export reaches a Melt Speakers server it is scrubbed: everything is dropped except seven fields.

• when the play ended (timestamp);
• how long it played, in milliseconds;
• the track name;
• the album artist’s name;
• the album name;
• the Spotify track URI;
• whether it was skipped.

The IP addresses, countries, platforms and other fields never reach the server, and the server would ignore them if they did.

You can’t upload an export, and Melt Speakers never connects to a Spotify account. The export is loaded on the server by the person who runs it, and every account on that server reads the same history. That is what an invite to it is for.

To find cover art, the server asks Apple’s iTunes Search API for an artist or an album by name. That request carries the artist and album names and nothing about you. The answers are cached in the server’s database, so each name is looked up once.

The artwork images themselves are hosted by Apple. When the app shows one, your browser loads it from Apple’s servers, which see your IP address and browser as they would for any image on the web.

The app at app.meltspeakers.com keeps your sign-in token in your browser’s localStorage, so you stay signed in between visits. Signing out removes it. The app sets no cookies of its own, and we haven’t put any analytics, advertising or third-party tracking code in it.

meltspeakers.com is static HTML. It sets no cookies, runs no analytics and has no forms, so there is nothing for it to collect from you. The fonts are served from this domain rather than from a font service.

It makes one request to another site: the small animated notdsk cube in the footer is loaded from x.allcdn.net, which will see your IP address and browser when it serves it. The notdsk link itself goes to notdsk.com, which has its own policies.

What we do have, for this website and for the app, is the web server’s request log. Every time your browser loads a page, script or image from meltspeakers.com or app.meltspeakers.com, or the app calls its server, our web server records your IP address (and any forwarding header your network adds), the time, the address requested (including anything after a ?), the response status and size, the page that linked you here, and your browser’s user-agent string. From the IP address we also look up the country and the network operator (ASN) it belongs to, using a database kept on our own servers.

Our log system keeps these records for up to one year. A daily archive of them is also kept, with no fixed time limit, on storage we own and in Google Cloud (Cloud Storage and BigQuery), which processes it on our behalf. We use them for running and securing the site (debugging, spotting abuse), rough traffic counts, and building and training our own operations tools on log data. We don’t sell these logs, share them with advertisers or data brokers, or use them to build profiles of visitors.

The Melt Speakers server also keeps a log of its own: the method, path and status of each request, and how long it took, plus the internal number of a new account when one is created. It does not record your IP address, your email address, the part of the address after a ?, or your sign-in token. It is kept on the server for 14 days.

The server’s database (accounts, hashed sessions and invite codes, and the artwork cache) is backed up nightly. Backups are kept on the server for 14 days, and a copy is also stored off-site. The listening export itself is excluded from backups.

If this policy changes, we’ll update the date at the top. Material changes will be called out on this page.

Spergs, LLC
privacy@spergs.com