Privacy Policy

Last updated: June 3, 2026

MusicLink API ("the Service", "we", "us") is operated by Emircan Gezer (Jadquir), an individual based in Turkey. This Privacy Policy explains what information we collect when you use the Service, how we use it, and your rights under applicable law, including the Turkish Personal Data Protection Law (KVKK — Kişisel Verileri Koruma Kanunu No. 6698).

The Service is accessible at ml.jadquir.com and the API is available at api.ml.jadquir.com.

If you have any questions, contact us at musiclink@jadquir.com.

---

#1. What We Collect

#1.1 Account Information

When you sign up, authentication is handled by Clerk (clerk.com). Clerk collects and stores your email address and any information you provide during sign-up (e.g. name, OAuth profile data). We receive a Clerk user ID to associate your account with your API key and usage. Clerk's own privacy policy governs how they handle your authentication data.

#1.2 API Key & Usage Data

When you generate an API key, we store the following in our database (hosted on Supabase):

• Your Clerk user ID — to associate the key with your account
• Your API key — the full key value, used to authenticate your requests
• Your current plan (free, hobby, pro)
• Monthly request count and quota — how many requests you have made in the current billing period and your plan's limit
• Billing period start date — when your current monthly window began
• Your Polar.sh subscription ID (if you are on a paid plan) — to sync your plan status with billing events

This data is used solely to authenticate requests, enforce rate limits, and keep your plan in sync with your subscription.

#1.3 Track Resolution Cache

To improve response times, resolved track data is stored in our database (Supabase). This includes:

• Track metadata: title, artist, ISRC, duration
• Platform-specific track IDs (Spotify, YouTube, Deezer, Apple Music, Tidal, SoundCloud, etc.)
• Streaming links for supported platforms
• Cover art image URL
• A short public ID used for shareable MusicLink pages

This data contains no personal information. It is derived entirely from publicly available music platform data and is shared across all users of the Service.

#1.4 Payment Information

Billing and subscription management is handled by Polar.sh (polar.sh). We do not store your payment card details — all payment data is processed and stored by Polar.sh under their own privacy policy. We store only your Polar.sh subscription ID in our database to keep your plan in sync.

#1.5 Infrastructure Logs

The web application (ml.jadquir.com) is hosted on Vercel and the API (api.ml.jadquir.com) is hosted on Fly.io. Both platforms may capture standard server logs such as IP addresses, request paths, and timestamps as part of normal infrastructure operation. We do not actively collect or store these logs at the application level. Vercel's and Fly.io's own privacy policies apply to data processed by their infrastructure.

---

#2. How We Use Your Data

We use the information we collect to:

• Provide and operate the Service
• Authenticate API requests using your API key
• Enforce rate limits and usage quotas per your plan
• Sync your plan tier when a subscription is activated, updated, or cancelled via Polar.sh webhooks
• Detect and prevent abuse or unauthorized use
• Improve and debug the Service

We do not sell your personal data to third parties. We do not use your data for advertising.

---

#3. Third-Party Services

The Service relies on the following third-party processors:

Each of these services operates under their own privacy policies. We encourage you to review them.

To resolve track links, we query publicly available music platform APIs and web resources. No personal data is sent to streaming platforms as part of API lookups — only the track identifier you supply.

---

#4. Data Retention

• API key & usage records are retained for as long as your account is active. Upon account deletion (via Clerk), your API key and associated usage data are removed within 30 days.
• Polar.sh subscription ID is downgraded or cleared automatically when a subscription is cancelled, as received via Polar.sh webhook.
• Track resolution cache (non-personal) is retained indefinitely. This data contains no personal information and is shared across all users to improve response times.
• Account identity (email, user ID) is managed by Clerk and is subject to their data retention policy.

---

#5. Your Rights (KVKK)

Under Turkish Law No. 6698 (KVKK), you have the right to:

• Learn whether your personal data is being processed
• Request information about how your data is processed
• Learn the purpose of processing and whether it is used in accordance with that purpose
• Know the third parties to whom your data is transferred
• Request correction of incomplete or incorrect data
• Request deletion or destruction of your data
• Object to processing that results in adverse consequences to you

To exercise these rights, contact us at musiclink@jadquir.com. We will respond within 30 days.

---

#6. Cookies

The web interface may use strictly necessary cookies for session management (set by Clerk). We do not use tracking or advertising cookies.

---

#7. Data Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS) and storing data in a secure, access-controlled Supabase database. However, no system is 100% secure, and we cannot guarantee absolute security. Your API key grants full access to your quota — treat it like a password and do not share it publicly.

---

#8. Children

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal data from children.

---

#9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of the Service after changes constitutes acceptance of the updated policy.

---

#10. Contact

For any privacy-related questions or KVKK requests:

Emircan Gezer (Jadquir) musiclink@jadquir.com