Privacy Policy

1. Who we are

This policy describes how FullSound ("we", "us", "our") handles personal information when you visit fullsound.cc or use the upgrade service offered through it. We are not affiliated with, endorsed by, or sponsored by Spotify AB. "Spotify" is a trademark of its respective owner.

2. Information we collect

We collect only what we need to run the service:

• Page-view analytics. Page URL, referring URL, hashed (one-way SHA-256, rotated daily) IP address, browser, operating system, device class, country, city, and ISP. The hash means we cannot reverse-engineer your IP after the day rotates.
• Upgrade key data. The upgrade key you purchase, its status, and the date it was used. Keys are linked to a purchase but not to your real identity unless you provide that voluntarily.
• Spotify account credentials you supply for an upgrade. Your sp_dc session cookie. This is forwarded to our upgrade backend only to perform the requested action. We do not retain it after the upgrade completes.
• Support correspondence. If you email us, we keep the email and our reply.
• Server logs. Standard web-server access logs (timestamp, request line, status code, user-agent) retained up to 30 days for debugging and abuse prevention.

We do not knowingly collect data from anyone under 13 (or 16 in the EEA/UK). If you believe a child has provided us data, contact us and we will delete it.

3. How we use it

• Deliver the upgrade or renewal you paid for.
• Detect abuse, fraud, and bots (rate limiting, datacenter/VPN flagging in analytics).
• Operate, maintain, and improve the site.
• Respond to support requests.
• Comply with legal obligations (e.g. tax records for payment processors).

We do not sell your personal data, and we do not use it for advertising or profiling.

4. Cookies and similar technologies

Public pages do not set marketing or analytics cookies. We may set:

• A PHP session cookie if you log into the admin panel.
• A Cloudflare Turnstile challenge cookie when you submit a key (anti-bot CAPTCHA).
• A Cloudflare bot-management cookie (__cf_bm) set by our CDN to identify legitimate traffic.

Your browser may also use localStorage to remember UI preferences. You can clear it any time from your browser settings.

5. Third parties we share data with

We use the following processors, strictly as needed to deliver the service:

• Cloudflare, Inc. - CDN, DDoS protection, Turnstile bot challenge.
• ip-api.com - Reverse-IP geolocation for analytics (country, city, ISP).
• Stripe, PayPal, and/or cryptocurrency payment providers - whichever you choose at checkout. We never see your full card number; the processor handles it directly.
• Our upgrade backend - receives your Spotify credentials only for the duration of the upgrade operation.
• Amazon Web Services - hosting infrastructure (server, database).

Each of these acts as an independent or sub-processor under its own privacy policy. We do not authorize them to use your data for their own purposes.

6. How long we keep it

• Spotify credentials supplied for an upgrade: deleted immediately after the upgrade finishes.
• Upgrade keys and their status: retained for the lifetime of the subscription so you can check status and renew.
• Page-view analytics: retained for up to 12 months in aggregated form.
• Raw web-server logs: up to 30 days.
• Support emails: retained while the dispute or query is active, then archived for up to 24 months.
• Payment records: retained as long as required by applicable tax/accounting law (typically 5-7 years).

7. How we protect it

• TLS in transit (HTTPS) and Cloudflare in front of our origin.
• Admin passwords stored as bcrypt hashes; secrets kept outside the web root.
• IP addresses one-way hashed before storage (daily-rotating salt).
• Rate limiting, bot detection, and CAPTCHA on sensitive endpoints.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority where required by law.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") - subject to legal record-keeping obligations.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with your local data protection authority (e.g. ICO in the UK, your state attorney general in the US).

To exercise any of these, email [email protected] with your upgrade key (so we can locate your record) and the action you want taken. We respond within 30 days.

9. International transfers

Our servers are located in the United States. If you access the service from outside the US, your data will be transferred to and processed in the US, which may have different data protection laws than your jurisdiction. By using the service, you consent to this transfer.

10. Changes to this policy

We may update this policy from time to time. The "Effective" date at the top reflects the most recent change. Material changes will be highlighted on the site for at least 30 days. Continued use after changes take effect constitutes acceptance.

11. Contact

Questions, requests, or complaints about this policy: [email protected].