arno.New albums, delivered
Privacy policy

How Arno handles your data

Last updated 28 October 2026

Who is responsible

Thomas Kieffer, tomasulo@tuta.io. Arno is a free, non-commercial hobby project. Write to this address for any question or request about your data.

What Arno stores

  • From Spotify, when you log in: your account id, your display name and the artists you follow.
  • A Spotify refresh token, stored encrypted, so Arno can re-read your follow list. Arno only asks for permission to read who you follow.
  • The email address you enter, and when you confirmed it.
  • Your settings: weekly, biweekly or monthly digest, timezone, and whether notifications are paused.
  • Which digests were sent to you and which albums they contained, so no album is sent twice.

Arno sets two cookies: a session cookie that keeps you logged in and a short-lived one used during the Spotify login. Both are needed for the site to work. There is no analytics, tracking or advertising.

Why

Only to send you the album digest you signed up for and to show your settings (Art. 6(1)(b) GDPR). Your data is not sold, shared for marketing or used for anything else.

Who else processes it

  • Fly.io hosts Arno and its database in Frankfurt. Its servers see your IP address when you visit the site.
  • Resend delivers the emails, so it receives your email address and the message.
  • Spotify handles the login. The Spotify logo on the site and in emails is loaded from Spotify's servers, as are album links you open.
  • Cover Art Archive (Internet Archive) serves the album covers in emails, so your mail client contacts it when it shows images.

Fly.io and Resend are US companies certified under the EU-US Data Privacy Framework, which covers the transfer of data to the United States (Art. 45 GDPR). Arno looks up artists and albums on MusicBrainz, but sends no personal data there.

How long

Until you delete your account in Settings, which removes everything listed above immediately. Backup copies of the database are overwritten within 5 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and take it with you. You can stop the emails at any time with the unsubscribe link or the Pause button, and delete your account yourself in Settings. You can also complain to a data protection supervisory authority.