Who we are
Carbon is an independent project by pealz, and is responsible for the information described here (the “controller”, in GDPR terms). This policy covers the Carbon desktop app, Carbon accounts and the account service at api.getcarbon.cc, Carbon+, and the website at getcarbon.cc. Contact us at support@getcarbon.cc.
Carbon is not affiliated with Spotify. What Spotify collects when you use its service is covered by Spotify’s privacy policy.
What we collect
Account information
- Your email address, whether you have verified it, and when you created your account.
- Your password, stored only as a salted hash. We never store or see your password in readable form.
- Your plan (Free or Carbon+).
Security records
- Short-lived request counters keyed to your IP address or email, used to rate-limit requests.
- A security log of account events, such as sign-ups, sign-ins, failed sign-ins, lockouts, password changes and app authorizations, each with the time and the IP address it came from. We use it to lock accounts after repeated failed sign-ins and to detect fraud and abuse.
- One-time codes and backup codes, stored only as hashes, along with how many attempts have been made.
Sessions and devices
For each browser or Carbon app signed in to your account, we keep a session record: whether it is a web or app session, when it was created and last used, and the IP address and browser or app identifier (user agent) it signed in from. You can see and end these sessions on your account page.
Purchases
When Carbon+ launches, we will keep a record of your purchase (what you bought, when and the amount) and any refund. The payment provider processes your payment details; we do not receive your full card number.
Messages you send us
If you email us, we keep your message and our reply so we can help you.
What we do not collect
We do not collect your Spotify password, your listening history, your library or playlists, your Last.fm or Discord credentials, analytics, telemetry or advertising identifiers.
What stays on your PC
The Carbon app keeps the following on your computer and does not send it to us:
- your Spotify sign-in tokens and your Carbon app sign-in token, stored in Windows Credential Manager;
- your Spotify Client ID and app settings;
- your Last.fm connection, if you set one up.
You sign in to Spotify on Spotify’s own page, so Carbon never sees your Spotify password.
Services Carbon talks to
The app connects directly from your PC to these services, only for the reasons given:
| Service | What it receives | When |
|---|---|---|
| Spotify | Your sign-in and playback requests | Whenever you use the app |
| LRCLIB | The current track’s title, artist, album and duration | When Carbon looks up lyrics |
| Discord | What you are playing, passed to the Discord app on your PC, which shares it as your status | Only while the Discord desktop app is running |
| Last.fm | The tracks you play (scrobbles) | Only after you connect Last.fm in Settings |
| GitHub | A standard request for update information | When Carbon checks for and downloads updates |
| Carbon accounts | Your account requests, as described above | When you sign in or manage your account |
Each of these services handles the information it receives under its own privacy policy. Like any internet request, each one also sees your IP address.
How we use information
- To run your account: creating it, verifying your email, signing you in with two-step codes, keeping you signed in, and showing your sessions.
- To keep accounts secure: rate limiting, lockouts, detecting suspicious sign-ins and preventing abuse.
- To send account email: verification and sign-in codes, password reset codes, and important notices about your account or these policies. We do not send marketing email without your consent.
- To provide Carbon+: recording purchases, unlocking features and handling refunds.
- To help you: answering support requests.
- To meet legal obligations: such as tax records for purchases, or responding to valid legal requests.
We do not use your information for advertising, and we do not build profiles of your listening.
How long we keep it
| Information | Kept for |
|---|---|
| Account information | As long as your account exists. Deleting your account removes it, with your sessions, codes and security log, straight away. Our hosting provider’s database recovery history may hold a copy for up to 30 days. |
| One-time codes | Until used or expired after 10 minutes, then purged daily. |
| Backup codes | Until used, replaced or your account is deleted. |
| Sessions, with their IP address and user agent | Until you sign out, end the session or reset your password, or after 30 days without use; then purged daily. |
| Rate-limit counters | About an hour. |
| Security log | As long as your account exists. |
| Purchase records | As long as tax and accounting law requires, typically up to 7 years. |
| Support emails | Up to 2 years after the conversation ends. |
Email delivery logs held by Resend are kept for a limited period under Resend’s own policies.
How we protect it
- Passwords are hashed with PBKDF2-HMAC-SHA256 using 600,000 iterations, a unique random salt and a separate server secret.
- Every sign-in requires a one-time code sent to your email. Codes expire after 10 minutes, allow 5 attempts and are stored hashed.
- Repeated failed sign-ins lock the account for 30 minutes, and every endpoint is rate limited.
- All traffic uses HTTPS with HSTS. Session cookies are HttpOnly, Secure and scoped to the account service, and state-changing requests are protected against cross-site request forgery.
- Resetting or changing your password signs out your other sessions and app tokens.
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and any authority as the law requires.
Your rights and choices
Wherever you live, you can:
- Access your information: your account page shows your email, plan and sessions. Email us for a full copy.
- Correct it: email us to change your email address.
- Delete it: delete your account from your account page, or email us.
- Export it: email us and we will send your account data in a machine-readable format.
- Object or restrict certain uses, where the law gives you that right.
Send requests to support@getcarbon.cc from your account’s email address. We may need to confirm it is you before acting, and we will respond within 30 days, or sooner if the law requires. We will never treat you differently for exercising these rights.
California residents
Under the California Consumer Privacy Act, as amended by the CPRA, here is how this policy maps to California’s categories over the past 12 months:
- Identifiers: email address, IP address, user agent, account and session identifiers.
- Commercial information: Carbon+ purchase records, once available.
- Internet activity: security records of account requests.
- Sensitive personal information: account login credentials (email and password), used only to sign you in and protect your account.
We collect these from you and your devices, use them for the purposes in How we use information, and disclose them only to the service providers in Who we share it with. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.
You have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity. We respond to verified requests within 45 days.
EEA, UK and Swiss residents
We rely on these legal bases:
- Contract: to provide your account and Carbon+.
- Legitimate interests: to keep accounts and the Services secure and prevent abuse, balanced against your rights.
- Legal obligation: to keep purchase records and respond to lawful requests.
- Consent: where we ask for it, which you can withdraw at any time.
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent. You may also complain to your local data protection authority.
Children
Carbon is not intended for children under 13, and we do not knowingly collect personal information from them. Users under 18 need a parent or guardian’s consent. If you believe a child under 13 has created an account, contact us and we will delete it.
International transfers
Carbon is run from the United States, and our providers operate globally. Your information may be processed in the United States and other countries whose data protection laws differ from yours. Where required, we rely on safeguards such as the European Commission’s Standard Contractual Clauses offered by our providers.
Changes to this policy
We will post any update here and change the date at the top. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect.
Contact
Questions or requests about your privacy: support@getcarbon.cc.