Privacy

Who runs it

Close Your Eyes is run by Beau Stephens, who decides what happens to the data described here (the “controller”). Questions, requests and reports: beaustephenswork@gmail.com.

What it collects

• From Google, when you sign in: your Google account’s unique identifier, your name, your email address and whether Google has verified it, and your profile picture address. Only these: the app asks Google for nothing else (no contacts, no files, no offline access).
• What you write: the records you add, your track reviews and ratings, album reviews, final scores, listening dates and notes, and how your shelf is arranged.
• What you choose: your handle, your privacy settings, your friends, requests and blocks.
• Records of use: when you sign in and out, your IP address and browser description at sign-in and for security-relevant actions (in an audit log), and the short request logs every web host keeps.

Who sees what

• Each volume is Private (only you) unless you mark it Friends. Your accepted friends can then read that volume’s reviews, ratings and final score. They never see your Private volumes, your Similar suggestions, your notes about your listening setup, or your email.
• Other members see only your handle, and only if they’re your friend or you have a request between you. Your Google name and email are never shown to other members. Nothing is visible to anyone who isn’t signed in.
• You can hide your activity from friends’ “Friends shelved recently” in Settings. Blocking someone hides you from each other completely.
• The operator, as administrator, can see the invite list and members’ emails in the app, and has technical access to everything stored. That access is used only to run, secure and repair the service, or when you ask.

Where it’s kept, and who helps

• Vercel runs the app and stores files (cover art, encrypted backups) in Vercel Blob, in the United States.
• Neon hosts the database, in the United States (AWS us-east-1).
• Google confirms who you are when you sign in.
• Album details and cover art come from Discogs, MusicBrainz and Last.fm. The app asks them from its own server, with its own credentials and only the album or artist name: nothing about you is sent.

No advertising, no analytics, no selling or sharing of your data with anyone else.

How long it’s kept

• Your journal stays until you delete it or your account.
• Backups: a copy of each person’s journal is encrypted every night and kept for 35 days; encrypted copies are also kept in a private repository. Short rolling copies (the last 60 per person) protect against mistakes. Backups can only be read with a key kept offline. If a backup is ever restored, deleted accounts are deleted again.
• The database’s own history (for recovering from an accident) covers the last 6 hours.
• Audit log: IP addresses and browser descriptions are erased after 90 days; the entries themselves after a year. When you delete your account, your entries are anonymised at once.
• Request logs at the host are kept for about an hour.
• Handles: after a change or a deleted account, the old handle is held for 30 days (only the normalised handle and the release date are kept), then released.

Your controls

• Export everything you’ve written, any time, from Settings: your journal as JSON, each listen as plain text, and your cover art.
• Delete your account from Settings. It happens immediately and removes your journal, friendships, requests, blocks, files and sign-in, and revokes this app’s access to your Google account.
• You can also remove this app’s access to your Google account yourself at myaccount.google.com/permissions.
• For anything else (a correction, a copy, a question), write to beaustephenswork@gmail.com.

Cookies

One essential cookie keeps you signed in (and a short-lived one carries the Google sign-in step itself). There are no tracking or advertising cookies, so there’s no cookie banner. Signing out clears everything the site stored on your device.

Google user data

Close Your Eyes’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google account data is used only to sign you in and to show you your own name.

Children

Close Your Eyes isn’t for anyone under 13, and doesn’t knowingly collect anything from them.

Changes

If this changes in a way that matters, members will be told in the app before it takes effect. The date at the top is the last change.