Privacy

This is a plain-English explanation of what Setfolio stores, what it never touches, and how to delete your data. Last updated June 2026.

What we store about DJs (tenants)

When you create an account you give us your email address and connect your SoundCloud account — a read-only connection through SoundCloud's official sign-in (OAuth). We never see your password, and the connection can't post, edit, or delete anything on your account. From your public uploads we pull:

• Mix title, publish date, and duration
• Artwork URL (we link to it; we do not store the image file)
• The SoundCloud permalink for the embed player
• The mix description — used to extract the intro text and, if it lists tracks, to offer you a draft tracklist
• A stable ID to deduplicate each mix on refresh

Tracklists are yours: you enter or confirm them in the dashboard editor, and we store what you keep. We may pre-fill a draft from a mix's description on import, but nothing from a description goes on your public pages until you review and publish it.

What we never touch

• Audio. No files are downloaded, stored, or proxied. Playback happens in the official SoundCloud embed player, on SoundCloud's servers, under their terms.
• Private library data. No Rekordbox, Serato, or Traktor XML — ever. We have no mechanism to receive or parse it.
• Other DJs' content. We read only your own connected account's public uploads, at your request (through SoundCloud's API, with the RSS feed as a fallback). No scraping of third-party pages.
• Listener accounts. Public pages have no login. We keep an aggregate page-view counter (a single integer per mix) — no cookies, no fingerprinting, no per-visitor tracking.

How public pages work

When you publish your archive, your mix titles, tracklists, and artwork links become publicly accessible at setfolio.app/{your-slug}. You control this with the publish toggle in your dashboard. Unpublishing hides the pages immediately; your data stays in the database until you delete your account.

Account deletion

Dashboard → Settings → Delete account. This permanently removes all your rows from the database (tenant, sources, mixes, tracklist entries, artist index) and all associated blob artefacts (raw RSS snapshots, OG images). Nothing is retained. We cannot recover deleted accounts.

Magic-link authentication

There are no passwords. We email you a single-use link (via Resend). The link token is stored as a hash and expires after 15 minutes. Your session is a cookie that lasts 30 days; you can sign out to invalidate it immediately.

Sub-processors

• Resend — transactional email (magic links)
• Microsoft Azure — hosting (App Service) and blob storage (artefacts)
• SoundCloud — embed player (loaded by the visitor's browser; subject to SoundCloud's own privacy policy)

Cookies

One session cookie after you log in. No analytics cookies, no ad cookies, no tracking pixels.