Privacy Policy
Last updated 22 September 2026
Who we are and how to reach us
Track Toolkit is run by Cole Hackman, an individual, in the United States.
If you have a question about this policy or about your data, email tracktoolkit@gmail.com. We answer privacy requests within 30 days.
What we collect and why
| Data | Where it comes from | Why | Kept for |
|---|---|---|---|
| Account: your SoundCloud numeric id, username, display name and avatar URL | SoundCloud, when you sign in | To show who is signed in and to act on your account | While your account exists |
| Sign-in tokens, encrypted | SoundCloud OAuth | To call the SoundCloud API on your behalf | While you are connected; deleted when you disconnect or delete your account |
| Session cookie | Set by us at sign-in | To keep you signed in for 7 days | 7 days |
| Operation log: which tool you ran, when, how long it took, whether it succeeded, the SoundCloud ids of the tracks, playlists and users it touched, and your device type, browser and OS family (worked out from the browser's user-agent string; the raw string is not stored) | Generated by us when you use a tool | Reliability, abuse prevention, and understanding which tools people use | 12 months |
| Library cache: copies of your likes, playlists, followings, followers and reposts exactly as SoundCloud returns them | SoundCloud, when you open a tool | So large libraries load in seconds instead of minutes | 7 days |
| Growth tools history: the SoundCloud accounts you chose to follow or like, their public name, avatar and follower counts, whether they followed back, the label you gave the session, and the accounts you picked as inspiration for it (their names and ids) | SoundCloud, when you run the Growth tools | To show you your history and let you undo it | 12 months |
| Public track and playlist catalog: title, artist name and id, genre, duration, availability and public link for a track; title, owner id and track count for a playlist — for anything that passes through the tools | SoundCloud public data | To show availability, and to study — in aggregate, and only by the operator — which genres and artists the tools handle | While the service runs. It is not tied to your account, and it is not removed when you delete your account |
| Library index and assistant drafts from an unreleased feature: copies of your likes and playlist tracks, and any messages you exchanged with the assistant | You, when that feature was tested | Left over from testing; no live tool reads or writes it | While your account exists; deleted with it |
| Feedback you send in the app: your message, which tool you were on, an email address if you choose to give one, and your device type, browser and OS family (worked out from the browser's user-agent string; the raw string is not stored) | You | To fix bugs, plan features, and reply if you asked us to | 24 months |
| Support email: whatever you write to us | You | To help you | In the mailbox until your question is resolved |
What we do not collect
- Your SoundCloud password. Sign-in happens on SoundCloud's own servers, so we never see it.
- Your IP address in our database. Our host's request logs do keep it for 30 days — see “Who else handles your data” below.
- Audio files.
- Your private messages.
- Your comments.
- Payment details.
We run no analytics or advertising scripts and set no third-party cookies.
Cookies and browser storage
We set four cookies, all of them our own:
session— signed, HttpOnly, 7 days. It is what keeps you signed in.pkce_verifier,app_urlandpost_login_path— 10 minutes, set only while you are signing in and cleared as soon as sign-in finishes.
Browser storage holds interface preferences — whether the sidebar is collapsed, light or dark theme, which tools you used recently, which announcements you have dismissed, which warnings you have acknowledged (the Growth risk notice), and whether the Chrome extension is installed — and, on the Downloads page, the download queue you build. All of that stays in your browser and is never sent to us.
None of these track you across sites, which is why there is no cookie banner.
Who else handles your data
| Service | What they process | Where |
|---|---|---|
| SoundCloud | Your account and every action you take through the tools. SoundCloud's own privacy policy applies to it. | SoundCloud's servers |
| Microsoft Azure | Hosts the app, the database, our secrets and our logs. Its request logs include your IP address for 30 days. | US West |
| Neon | Holds a copy of the database from before 20 September 2026, kept so we can roll back. It is deleted by the end of October 2026. | US |
| Only the support mailbox, and only if you email us. | Google's servers | |
| Buy Me a Coffee | Only if you click the link. Nothing from Buy Me a Coffee is loaded on this site. | Their own site |
We do not sell or share personal data, and we have no advertising partners.
Where your data is stored
In the United States. If you use Track Toolkit from another country, your data is transferred to and processed there.
How long we keep it
The “Kept for” column above is the full picture. Two things shorten it:
- Accounts with no sign-in for 24 months are deleted, including everything keyed to them.
- When you disconnect the app from your SoundCloud account, we delete your tokens immediately. We keep the rest for 6 days so you can sign back in and keep your account. After that it is deleted.
Your choices and rights
- Download your data. Account page → “Download my data”. You get everything keyed to your account as a JSON file.
- Disconnect. From the Account page, or from SoundCloud → Settings → Connected apps.
- Delete your account. From the Account page. It happens immediately, it cannot be undone, and it removes everything keyed to your account. Catalog rows are not yours and stay.
- Ask us. Email us to correct something, to object to the operation log, or about anything else: tracktoolkit@gmail.com.
- Complain. You can complain to a data-protection authority where you live.
These apply to everyone who uses Track Toolkit, wherever you are.
Security
- Your SoundCloud tokens are encrypted at rest with AES-256-GCM.
- Our secrets live in a managed vault, not in the code.
- The site and the API are HTTPS only.
- Session cookies are signed and HttpOnly.
- Writes that arrive from another website are rejected.
Children
Track Toolkit is not for anyone under 13. If you believe a child has given us data, email tracktoolkit@gmail.com and we will remove it.
Changes
When this policy changes, we post the new version here with the date it changed.
- 2026-09-22 — Rewritten to describe the library cache, the public catalog, feedback, retention periods, in-app export and disconnect; analytics scripts removed.
SoundCloud
Track Toolkit is not affiliated with, endorsed by, or connected to SoundCloud. SoundCloud's own privacy policy governs your SoundCloud account.