Privacy Policy

Last updated October 16, 2026

Draft. This policy hasn’t been reviewed by a lawyer yet and isn’t final.

1. Who we are and what this covers

QuartzDrop is run by Made by Windmill, LLC (“we”, “us”). This policy covers QuartzDrop: publishing from the Quartz app, the website at quartzdrop.net, and the QuartzDrop servers behind them. The rest of the Quartz app is covered by the Quartz privacy policy.

2. If you publish (QuartzDrop account holders)

Account details

• Email address. We get it from you when you sign in with a one-time code, or from Apple or Google when you sign in with them. If you use Apple’s “Hide My Email”, we get Apple’s relay address instead. We use it to sign you in and to send you sign-in codes. We don’t send marketing email.
• Apple or Google sign-in details. Your account’s ID number with Apple or Google. We check the sign-in token they give us once, when you sign in, and don’t keep it. The Quartz app doesn’t ask Apple for your name, and if Apple or Google offers your name or profile photo, we don’t store it.
• Username, which you choose. It’s public (see section 4).
• Settings, such as whether your profile page is shown and which albums appear on it.

Sign-in sessions

When you sign in, we create a session so you stay signed in. The Quartz app keeps your session key in the iOS Keychain. With each session, we store only the general network you signed in from: the first part of your IP address, which many nearby devices share. We don’t store your full IP address or your device and software description (the “user agent”). We use the network only to avoid counting your own plays as listens when you play your albums from the same network. A session lasts until you sign out, or for up to a year after you last used it. Expired sessions are deleted within an hour.

What you publish

• Your audio files, the waveforms we make from them, and your artwork.
• Album and track details: title, artist, date, place, notes, track titles, lengths, file sizes, the number of audio channels, and when each track was recorded.
• Your settings, such as whether downloads are allowed.

We store and serve your files as you upload them. If a file contains embedded information, such as a location or a device name, that stays in the file and anyone who gets the file can see it.

Storage use

We keep totals of how much you’ve uploaded and stored, so the app can show your usage and we can run the service.

3. If you listen

You don’t need an account to listen, and quartzdrop.net doesn’t set cookies.

• A random listener ID. The first time you play something, your browser makes a random ID and saves it in its local storage. It’s random and isn’t connected to your name or email. Your browser sends it when you play or like a track, so we count each listener once.
• Listens. When you play a track, your browser tells us how far you got (a skip, part of it, or the whole thing). We save a scrambled (“hashed”) version of your listener ID, made with a secret only our server knows and the day’s date. That means we can’t connect your listens from one day to the next, and nobody who sees only our database can work out your listener ID from it. We delete these daily records after about two days, and keep only each track’s total counts for each day. If your browser blocks storage, we scramble your IP address and user agent the same way instead, and never store them as they are.
• Likes. When you like a track, we store a scrambled code made from your listener ID, that track, and a secret only our server knows. It means you can’t like a track twice and can take your like back later. Your codes for different tracks don’t match each other, so your likes can’t be linked together. Some older likes, made before we started using these codes, are still stored under an older code made from your listener ID alone, which is the same on every track. We swap it for the new kind the next time you like or unlike that track in the same browser. We keep the code until you take the like back or the track or album is deleted. Your browser also remembers which tracks you liked, in its local storage.
• Your publisher’s view. Publishers see total listen and like counts, which are also public. They never see who listened or who liked.

To clear your listener ID and likes from your browser, clear this site’s data in your browser settings.

4. What’s public

Anyone with an album’s link can see and play it, without signing in. That includes the audio, artwork, album and track details listed above (including when each track was recorded), the publisher’s username, and the listen and like counts. When downloads are off, the album page doesn’t offer a Download button. Even so, anyone who can play a recording may be able to save it. Unless you hide it, your profile page (quartzdrop.net/u/username) lists your published albums. Album details can also appear in link previews in messages and on social media.

5. If you report a recording

When you use “Report this recording”, we collect the reason, which track (if you chose one), your description, and your email address. Email is optional, except for copyright reports, where it’s required. We store the report and email it to the people who review reports, so they can reply to you. We clear your email address from the report 90 days after it’s resolved or dismissed, and keep the rest of the report as a record. We don’t store your IP address with a report. To limit how many reports one network can send, though, we briefly keep a rate-limit record with your IP address (section 6), and its timing could be matched to your report. That record is deleted within about a day. If you send a copyright notice, we may pass it on to the publisher, including your name and contact details, as our Copyright Policy explains.

6. Information everyone sends us

• IP addresses. We use your IP address to limit how often requests can be made (for example, sign-in codes, reports, listens, likes and profile pages). That protects the service from abuse. These rate-limit records include the IP address (for newer IPv6 addresses, only the first half, which points to your network rather than your device), or, for sign-in codes, the email address. Our own records are kept for about a day, and the ones our sign-in system keeps are deleted about an hour after your last request.
• Server logs. Our hosting provider, Cloudflare, keeps request logs for a few days. They include information like the address requested, the time, your IP address and user agent. We use them to fix problems and spot abuse.

7. How we use information

Only to run QuartzDrop: to sign you in, host and play recordings, count listens and likes, show public pages and link previews, handle reports and copyright notices, prevent abuse, fix problems, and meet legal duties.

We don’t sell personal information. We don’t share it for targeted advertising, and we don’t track you across other companies’ apps or websites. quartzdrop.net has no ads and no third-party analytics.

8. Who we share it with

• Cloudflare hosts QuartzDrop. It runs our servers (Workers), our database (D1), our file storage (R2), the email that sends sign-in codes and report notices, and our logs. Cloudflare processes this information for us.
• Apple and Google, if you sign in with them. They confirm who you are. When you delete your account, we ask Apple to revoke QuartzDrop’s access to your Apple ID.
• The public, for what you publish (section 4).
• The other side of a copyright claim, as the DMCA requires (section 5).
• Authorities, when the law requires it, or when we need to protect people’s safety or our rights.
• A buyer or successor, if QuartzDrop or Made by Windmill, LLC is sold or merged. This policy would continue to apply to your information.

Our servers and Cloudflare’s may be in the United States and other countries.

9. Cookies and local storage

QuartzDrop doesn’t use cookies. On quartzdrop.net, your browser’s local storage holds two things: your random listener ID, and the tracks you’ve liked. Both stay on your device until you clear them.

10. How long we keep things, and deleting

• Deleting your account. You can delete your QuartzDrop account in the Quartz app. Right away, we delete your account, email address, username, Apple and Google sign-in details, sessions, storage totals, and the listens and likes on your albums. Your album links stop working. Your audio and artwork files are deleted from storage within minutes, or at most a few hours. Each album’s title, details (artist, place, date and notes) and track titles are erased. We keep only a basic record of each album, its ID and dates, so its old link can say it’s no longer available.
• Deleting an album. When you delete one album, its files, listens and likes are deleted, and its title, details and track titles are erased, right away. Its files stop being served right away too, though a browser that already loaded the artwork or a waveform may keep its own copy for up to an hour. We keep only a basic record, its ID and dates, so its link can say it was deleted. The same happens to an album you stop uploading, and to the old copy when you republish an album.
• Removed content. If we remove an album because of a report or a copyright notice, we delete its files, listens and likes. We keep a record of the album and a log of the removal, including the album’s title, artist and your username, so we can handle disputes and repeat infringement. The log stays even if you later delete the album or your account.
• Reports and copyright notices are kept as records. The reporter’s email address is cleared 90 days after the report is resolved or dismissed.
• Listen records are kept for about two days; after that, only daily totals per track. Rate-limit records are kept for about a day. Server logs are kept for a few days.
• Unfinished uploads. If an upload stops and nothing more is uploaded for 7 days, we cancel it and delete the parts already received.

If you’d like something deleted that you can’t delete yourself, email us.

11. Your choices and rights

In the Quartz app, you can change your email address, hide your profile, choose which albums appear on it, delete albums, and delete your account. You can also email us to ask for a copy of your information, to correct it, or to delete it. We’ll respond within the time the law requires. Depending on where you live (for example, California or the European Union), you may have more rights, including the right to complain to your local data protection authority. We won’t treat you differently for using them.

12. Security

All connections to QuartzDrop are encrypted. Sign-in codes are stored only in scrambled form, and expire after 10 minutes. No system is perfectly secure, but we work to protect your information. If we learn of a breach that affects you, we’ll tell you as the law requires.

13. Children

QuartzDrop isn’t meant for children under 13, and they may not create an account. We don’t knowingly collect personal information from children under 13. If you think a child has given us information, email us and we’ll delete it.

14. Changes to this policy

We may update this policy. We’ll change the date at the top when we do. If a change is significant, we’ll let publishers know in the Quartz app or by email.

15. Contact

Made by Windmill, LLC
quartz@madebywindmill.com