Privacy Policy

Overview

Burn CD lets you create a virtual CD, add music tracks, write an optional note, and share the resulting link. This Privacy Policy explains what information is processed when you use Burn CD, why it is processed, and the choices you have.

Burn CD is currently a free service. For any privacy question or request, contact us at contact@burncd.online.

Information You Provide

When you create and share a CD, we store the following in our database:

• The Apple track id for each track you select. Everything else — track and artist names, track length, artwork URL, preview URL, and store link — is re-queried from Apple's Lookup API by our server on every share-page load and is never stored by Burn CD.
• Your optional handwritten note, which is limited to 80 characters.
• The cover-track selection for the shared CD.
• A creation timestamp (when the CD was burned).

To deliver the share page, your browser also fetches the artwork and the 30-second preview audio directly from Apple's CDN. Those requests are made from your browser and Apple will see your IP address for that.

We do not require you to create a Burn CD account to use the core sharing feature, and we do not ask for your name, email address, or payment-card information for that feature.

Please do not write sensitive personal information into your note — such as government ID numbers, financial-account details, health information, biometric data, or information about others without their consent. The note is short and public to anyone with the link, so it is not a safe place for anything confidential.

Shared CDs Are Public to Anyone With the Link

Each shared CD receives a unique, unlisted link (/cd/<id>). Anyone who has that link can view the CD's tracks, cover selection, and note. The link is not a password and should not be used to share sensitive, personal, confidential, or unlawful information.

Shared CD pages are marked noindex so they do not appear in search engines, but the link itself is the only protection. Share it only with people you trust.

Shared CD links do not automatically expire. We may, at our discretion, remove CDs that are inactive, abusive, or reported to us.

Age

The Service is not directed to children under 14, and we do not knowingly process personal information from children under that age. If you believe a child under 14 has created a CD, contact us and we will remove it.

Information Collected Automatically

Like most online services, our servers and service providers may process limited technical information needed to deliver and secure the Service, such as IP address, browser and device information, request time, referrer, and error or security logs. Our hosting and edge infrastructure is provided by Cloudflare, which means requests may be processed at Cloudflare edge nodes in multiple countries.

We use the URL path to remember your selected language; no cookie is set for this. If you sign in via Google One Tap, Google sets its own cookies and tokens (g_state, g_csrf_token) to manage the sign-in flow.

The following third-party services are loaded when you use the Service. Each runs under its own privacy policy:

• Google Analytics 4 (googletagmanager.com) — page-view and usage analytics. Sets cookies (_ga, _gid) for visitor identification. See Google's privacy policy.
• Plausible Analytics (plausible.io) — privacy-focused, cookie-less usage analytics. See Plausible's data policy.
• Microsoft Clarity (clarity.ms) — session replay and heatmaps. Clarity records your interactions on the site (including text you enter into inputs, mouse movements, and clicks), so anything you type anywhere on the site may be captured. See Microsoft's privacy statement.
• Cloudflare — provides hosting and the edge network that delivers every page. Cloudflare processes requests and may set cookies for security (such as bot protection). See Cloudflare's privacy policy.
• Google One Tap — sign-in helper. Loads only when you attempt to sign in. See Google's privacy policy.

We do not use the core Burn CD feature to sell personal information, and we do not engage in cross-context behavioural advertising.

Music Search and Preview Content

Burn CD uses music catalog information and preview content supplied by Apple/iTunes. When you search for a track, your search term will be sent from our server to Apple's iTunes Search API to return matching tracks. The search term you typed reaches Apple, but the request comes from our server, not your browser. Apple handles information it receives under its own privacy policy. Music previews and artwork remain subject to the applicable rights and terms of their owners and providers.

How We Use Information

We use the information described above to:

• Create, host, and display shared CDs.
• Provide music search results, previews, and links to music services.
• Remember language preferences and, if you sign in, your sign-in session.
• Keep the Service reliable, secure, and usable; diagnose errors; and prevent abuse.
• Comply with legal obligations and protect the rights, safety, and property of users and the Service.

How Information Is Shared

We share information only as needed to operate the Service:

• A shared CD's contents are available to anyone with its link.
• Music search and preview requests involve Apple/iTunes as described above.
• Apple hosts the artwork and preview audio that the shared CD page loads.
• Cloudflare hosts the application and processes requests at the edge.
• Analytics providers listed above process technical information (such as IP address, page URL, browser type, and referrer) when their tool is enabled.
• We may disclose information when required by law or when reasonably necessary to protect the Service, its users, or others.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

International Data Transfers

The underlying infrastructure (Cloudflare, Apple, Google, Plausible, and Microsoft Clarity) may process your information in countries other than your own, including the United States, Ireland, and other locations where these providers operate. By using the Service, you understand that your information may be transferred to and processed in those countries.

Retention and Security

We retain shared-CD records while they are available through the Service or as reasonably necessary for security, legal, and operational purposes. We do not currently have an automatic deletion schedule, but we may delete inactive or abusive records at our discretion. If you want a record deleted, see the section below.

We use reasonable technical and organizational measures to protect information, but no internet service can guarantee absolute security.

Your Choices and Requests

Because no account is required, anyone with a shared CD link should treat it as publicly accessible. If you want to:

• Remove a CD you created, or
• Report a CD, or
• Ask a privacy question (access, correction, deletion, or anything else),

email us at contact@burncd.online. Please include the share link of the CD and enough information for us to verify the request. We will acknowledge your request within 7 days and respond substantively within 30 days (or 45 days where required by California law).

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, subject to applicable law (for example, GDPR in the EEA/UK, CCPA/CPRA in California, PIPL in mainland China).

Changes to This Policy

We may update this Privacy Policy when the Service or applicable requirements change. The "Last updated" date above shows when it was most recently revised. Material changes will be reflected by updating that date.

Contact

For privacy questions or requests: contact@burncd.online.