Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data Rasanak ("we") processes when you use the Rasanak website and app, why, and your rights. The controller is Clusterlean AB, a company registered in Sweden (org. nr 559361-2913, Nordanväg 3 A, 222 28 Lund, Sweden). Contact: support@rasanak.com.

What we collect

• Account data: your email address, a salted scrypt hash of your password (never the password itself), your sign-in method, and the time your email was verified.
• Security data: your authenticator-app secret (encrypted with AES-256-GCM), hashes of your recovery codes and one-time codes, session records (creation time, last activity, browser user agent), and counters used to slow down password guessing.
• Storage connections: for each storage provider you connect. For Backblaze B2: your key ID and application key (encrypted with AES-256-GCM, never shown again), bucket name, endpoint and optional folder. For Microsoft OneDrive: a Microsoft refresh token with read-only access to your files (encrypted with AES-256-GCM, never shown to your browser), your drive's ID and type, the drive owner's email address or display name, the chosen music folder and when you connected it.
• Library metadata: for each audio file in your connected storage: which provider it is in, file name/path, size, modification time, and the title, artist, album, track number and duration read from its tags. We do not store your audio.
• Billing data: your Stripe customer and subscription identifiers and subscription status. Card details are handled entirely by Stripe.
• Operational logs: request paths, status codes and timings, kept for up to 30 days, without passwords, codes, keys or tokens.

Why we use it (legal bases)

• To provide the service you signed up for: account, sign-in, sync and playback (contract).
• To keep accounts secure and prevent abuse (legitimate interest).
• To bill Pro subscriptions and meet accounting obligations (contract, legal obligation).
• To send service emails such as sign-in codes, password resets and billing notices (contract). We do not send marketing email.

Cookies

We use only strictly necessary cookies: a session cookie that keeps you signed in, and a security token that protects forms against cross-site request forgery. We use no analytics, advertising or tracking cookies. The player remembers your queue and volume in your browser's local storage; this is cleared when you log out.

Who processes your data

• Microsoft Azure (hosting, database and email delivery).
• Stripe (payments) for Pro subscribers.
• Backblaze: if you connect B2, your music is streamed from your own B2 account, under your agreement with Backblaze.
• Microsoft: if you connect OneDrive, you sign in with Microsoft and grant read-only access to your files; your music is streamed from your own OneDrive, under your agreement with Microsoft. You can revoke this access at any time from Settings or your Microsoft account.
• Have I Been Pwned: when you choose a password, the first 5 characters of its SHA-1 hash (never the password) are checked against known breaches.

Retention

We keep your data while your account exists. One-time codes expire after 10 minutes, reset links after 1 hour, and sessions after at most 30 days. When you delete your account, we delete your account data, library metadata, sessions and stored keys and tokens immediately; backups roll off within 7 days. Stripe retains billing records as required by law.

Your rights

You can export your profile and library metadata as JSON and delete your account at any time from Settings. Depending on where you live, you may also have rights to access, rectify, restrict or object to processing, and to complain to a supervisory authority. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). Contact us at support@rasanak.com.

Changes

We'll update this page and the date above if this policy changes, and email you about significant changes.