Privacy
Your data, in plain words.
Deriva is an independent music discovery project. This page explains what it handles, why, and what you can do about it.
Last updated 28 September 2026.
- You can listen without an account, and nothing personal is saved.
- No ads, no data sold, no third-party analytics, no tracking cookies.
- With an account, Deriva keeps your email and your library only to sync it. You can delete it at any time.
- Visits are counted anonymously, without cookies or anything stored on your device.
Who is responsible
Deriva is run by Rodolfo Gallucci (erregi), in Italy, who decides how this data is used. For any question or request, write to hello [at] rodolfogallucci [dot] it.
What Deriva handles
Without an account. Deriva remembers which artists you heard only while the page is open, so stations do not repeat. Your preferences, such as theme, Drift level and filters, stay in your browser so they are the same next time.
With an account. Your email, an optional display name, your password stored only as a one-way hash, and your library: saved tracks, artists you heard or dismissed, favourite artists, the last 200 tracks you played, the links you shared, and your preferences. This is used only to run Deriva for you.
Anonymous usage events. When you visit, start a station, play, like, save or share, Deriva records the action with the type of device, the country your connection comes from, and a visitor code made from a salted hash of your IP address and browser. The code changes every day and cannot be turned back into your address; the address itself is not stored. A random session code lives only in the open page. If you are signed in, events are linked to a pseudonymous code of your account. Nothing is written to your device for this.
A quick question. After a few tracks, Deriva may ask whether it found you something new. Your answer, and the note if you write one, are stored with the anonymous usage events, never with your account. Please leave personal details out of the note. Your browser remembers only that you answered, so the question is not asked again.
Emails. Only account emails: welcome, password reset and password changed. No newsletters.
Shares. A shared card or playlist, with its message and the optional name you add, can be opened by anyone who has the link. Deriva counts its views and likes anonymously.
Cookies and local storage
Deriva uses only what it needs to work, so it does not ask for cookie consent.
| Name | What it does | How long |
|---|---|---|
deriva_session | Cookie that keeps you signed in. Strictly necessary, not readable by scripts. | 30 days |
deriva_admin | Cookie for the owner's dashboard only. Strictly necessary. | 7 days |
deriva:* | Local storage for your preferences and, while you are signed in, a copy of your library for speed. Removed when you sign out. | Until you clear it |
YouTube. Full songs play in YouTube's privacy-enhanced player (youtube-nocookie.com), loaded only after you start using the page. When a video plays, Google may process data under its own privacy policy. If you prefer to avoid it, turn on “Play with screen locked” in Settings to use 30-second previews from Deezer instead.
Services Deriva relies on
- Vercel hosts the site and runs its functions in Frankfurt, in the EU.
- Neon hosts the database in Frankfurt, in the EU.
- Resend sends the account emails.
- YouTube, a Google service, plays full songs in your browser.
- Deezer provides the catalog; artwork and 30-second previews load in your browser from Deezer's servers.
- Last.fm provides similarity and tags, requested by Deriva's server without any personal data.
- ReccoBeats provides the sound features of tracks, such as energy and tempo, requested by Deriva's server with track codes only, without any personal data.
- Audius provides the independent artists of Underground stations. Deriva's server asks Audius for the lists without any personal data; artwork and full songs then load in your browser from Audius nodes, which see your IP address like any website. See the Audius privacy policy and API terms.
Fonts are hosted by Deriva itself.
Why
Account data is used to provide the service you asked for. Anonymous statistics and the limits on repeated sign-in attempts rely on a legitimate interest: keeping Deriva working, improving it and keeping accounts safe.
How long
- Account data: until you delete your account.
- Password reset links: at most 7 days.
- Records of failed sign-in attempts: 1 day.
- Anonymous usage events: 13 months.
- Shared links: until you ask for them to be removed.
Your rights
You can ask to access, correct, export or delete your data, and object to its use. Deleting your account in Settings removes it and your library immediately; shared links you created stay online unless you ask for them to be removed. You can also lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.
Changes
If this page changes, the date at the top changes with it.