Privacy Policy

Spiral is built to keep your music and your data on your own device. The Spiral desktop app has no analytics, no telemetry and no Spiral accounts. We do not sell your data. The only personal data involved is your IP address, which every internet connection reveals, and whatever music details you choose to look up.

This policy covers three separate pieces of Spiral:

• The desktop app: the music player and library installed on your computer.
• The registry: the online catalog of downloadable themes, skins, visualizers and sounds (“items”) that the app browses and installs from, served at spk.spiralpowered.com.
• The website: spiralpowered.com, the marketing and downloads site. It also serves the app’s update check and release notes.

“We” and “us” mean Spiral Powered LLC, the operator of all three.

Your library, settings, caches and crash reports stay on your device. The app contains no analytics SDKs and assigns no Spiral user ID. A diagnostics file is written only if you export one, and nothing uploads it. Crash reports and diagnostics exports can contain library details such as artist, album or disc IDs, so review them before you share them with anyone.

The app does contact the services below. Every one of them can also see your IP address.

Those third parties handle the data under their own policies, not this one.

The registry has no accounts, no cookies and no per-user records. Publishing is admin-only, and the only admin is the Spiral operator.

• Stored: item metadata from publishers, an aggregate download count per version, a takedown log, and an admin audit log that includes the administrator’s IP address. We do not currently apply a retention limit to the audit log.
• Received from the app: browse and search text, and for update checks the app version plus the publisher, type, ID and version of each installed item. We do not store this.
• Logs: your IP address is written to application logs only when a rate limit trips. IP addresses used for rate limiting are held in memory.

• Analytics: we use Vercel Web Analytics and Speed Insights on every page. They record the page visited, your country, referrer, device, browser and operating system. IP addresses are anonymized and not stored. Vercel keeps request logs for one hour.
• Update and download endpoints: these receive your operating system, architecture and app version, and query GitHub server-side. Download links redirect you to GitHub.
• Shop finder (optional): if you use it, the place you type or your browser’s location (only if you allow it) is sent through our server to Google Places. Map tiles load directly from OpenStreetMap, which can see your IP address. We do not store your searches.
• Browser storage: the site saves your appearance settings in your browser’slocalStorage.

These companies host or store Spiral’s data and keep their own logs under their own privacy policies.

• Vercel — Website hosting and analytics
• Fly.io — Registry hosting
• Neon (a Databricks company) — Registry database (catalog, audit log)
• Tigris — Registry item file storage
• GitHub — Release downloads and update metadata

• Turn off the app update check, the item update check and lyrics auto-fetch in the app’s settings.
• Leave CD lookup on “ask” to decide each time.
• Skip the shop finder, or deny the browser location prompt.
• Uninstalling the app removes the library, settings and caches from your device.

Because we do not keep per-user records, we generally cannot look up, export or delete data about you. If you believe we hold something about you, such as an administrator audit log entry, contact us.

Spiral is not directed at children under 13, and we do not knowingly collect personal information from them.

We may update this policy as Spiral changes. The date at the top shows the latest revision.

Questions about privacy? Email hello@spiralpowered.com.