Privacy policy

Last updated 2026-11-02.

hyp.fm gives independent artists a free page with links to their music. This policy explains what personal data the service handles, for artists who have an account and for people who visit artist pages. hyp.fm is run by Hackyard People AB (org. no. 559061-2866, Kungsgatan 64, 111 22 Stockholm, Sweden), the controller. Questions and requests: privacy@hyp.fm.

Each artist page also has its own privacy notice (linked as “Privacy” at the bottom of the page) listing any advertising tools that artist has turned on.

Visitors who come from our ads

hyp.fm advertises itself on Facebook and Instagram. Only if you arrive from one of those ads, we tell Meta about your visit to our pages and, if you create an account, that you signed up, so we can see which ads work and Meta can show them to people likely to be interested. We send this from our server (Meta’s Conversions API): the page address and time, your IP address and browser details, Meta’s cookies (_fbp, and _fbc if the ad link had Meta’s click id), and for a sign-up your email address in hashed form. No Meta script runs in your browser. In the EU/EEA, the UK and Switzerland (or if your location is unknown) we ask first, and nothing is sent or stored unless you accept; elsewhere it starts when you arrive from the ad. Your choice is stored in a cookie for 180 days. Visitors who don’t come from our ads are never measured this way. Hackyard People AB and Meta Platforms Ireland Ltd decide together how this data is used. Legal basis: your consent where we ask for it, otherwise our legitimate interest in measuring our advertising.

Visitors of artist pages

• Visit statistics without cookies. We count page views, link clicks and presses of play in a release page's player without cookies, local storage or any identifier. For each view we record only the country, the device type (mobile, tablet or desktop), the website that linked to the page and campaign tags in the address, and the artist only ever sees totals. We never store your IP address. Raw events are kept for three months, daily totals for as long as the page exists. Legal basis: our legitimate interest in showing artists how their page is used.
• Delivery and security. Pages are delivered by Cloudflare, which processes your IP address and browser details to deliver the page and protect it against attacks. We don’t keep these logs.
• Artists’ own tracking. An artist may turn on the Meta Pixel, the Meta Conversions API or the Google Ads tag. They are off by default and never load or send anything before you agree in the consent banner. Visitors in the EU/EEA, the UK and Switzerland (or whose location is unknown) always see the banner. Your choice is stored in a cookie on this site for 180 days, and you can change it on the artist’s privacy notice. For these tools the artist and the provider (Meta or Google) decide how the data is used; legal basis: your consent.
• Releases promoted with hyp.fm’s ads. An artist may have hyp.fm run ads for a release on Facebook and Instagram, from hyp.fm’s own Meta account. Only if you agree in the consent banner, when you click a link to a streaming service on that release’s page we tell Meta about the click from our server (the page address, the time, your IP address and browser details, and Meta’s cookies if your browser has them), so Meta can measure and improve the ads. Hackyard People AB and Meta Platforms Ireland Ltd decide together how this data is used. Without your consent nothing is sent. Legal basis: your consent.
• Reports. If you report a page, we store your report and, only if you give it, your email address, to handle the report. We don’t tell the artist who reported them. Reports are deleted 180 days after they are closed. Legal basis: our legitimate interest in keeping the service safe, and legal obligations for illegal content.
• Private listening links. If an artist shares a private link with you (also one for comparing masters) and you comment or say which version you prefer, we store that and the name you enter (if any), visible to the artist and anyone with the link. We don’t store your IP address or identify you. The comment is deleted with the link or when the artist deletes it.

Trying mastering or lyric videos without an account

• A mix you upload on the free mastering page, and its master, are stored privately (in the EU) for 24 hours and processed on Cloudflare’s network. Uploading sets a cookie, kept for the same 24 hours, so that only your browser can hear the result; it holds a random key and nothing about you. Your IP address is not stored with it. If you create an account or log in, the mix moves into your account; otherwise it is deleted.
• For a lyric video, the song, picture and lyrics you upload and the video made from them are stored privately (in the EU) for 24 hours. To time the lyrics, the song is run through speech recognition on Cloudflare’s network (Workers AI). A cookie works as for mastering. If you create an account or log in, the video and the song move into your account; otherwise they are deleted.
• With a trial we also keep which of our pages you arrived on and its campaign tags (or the name of the website that linked to it), to count how many trials each campaign brings. It is deleted with the trial.

Artists with an account

• Account: your email address, band name and password (stored only as a secure hash). For signed-in sessions we store the browser’s user agent and timestamps, not your IP address. Legal basis: performing our contract with you (the terms).
• Page content: everything you add to your page, such as your bio, links, releases and images. Uploaded images are re-encoded, which removes embedded metadata such as location; a private, re-encoded copy is kept so you can adjust the crop, and is deleted with the image. Old page addresses keep redirecting for 90 days.
• Where you came from: the page of hyp.fm you arrived on and its campaign tags (or the name of the website that linked to it), kept with your account so we can count which campaigns bring artists who go on to use hyp.fm. Only counts leave this: it is never shared, and is deleted with your account. Legal basis: our legitimate interest in knowing which of our own marketing works.
• Tracking settings: if you set up Meta or Google tools, we store their IDs. A Meta access token is stored encrypted and never shown again.
• Email: we send service emails, such as address confirmation, password resets and account changes. News about hyp.fm, such as new features, comes by email only if you say yes in your dashboard. Every news email has an unsubscribe link, and you can turn it off any time under Account. We keep your choice, and which news we emailed you, until you change it or delete your account.
• Bot protection: registration, password reset and the report form use Cloudflare Turnstile, which checks your browser for signs of automation.
• Link checks: the addresses of website links you add are checked against Google Web Risk to protect visitors from phishing and malware. Only the link address is sent.
• Private listening links: tracks you upload for private links are stored privately (in the EU) and only play through your links. We count views and plays as totals. You can delete tracks and links at any time.
• Mastering: mixes you upload for mastering are stored privately (in the EU) and processed on Cloudflare’s network. Only you can play or download them and their masters, except through feedback links you create. They are deleted after 30 days, or sooner if you delete them, and their feedback links with them.
• Video creator: songs you upload or add from Mastering for videos, and the lyrics you enter, are stored privately (in the EU). To time the lyrics, the part of the song you choose is run through speech recognition on Cloudflare’s network (Workers AI). The videos are stored privately too; only you can play or download them.
• Promote (Ultra plan): the song, lyrics and cover you add for a release’s ads are stored privately (in the EU). To time the lyrics, the song is run through speech recognition on Cloudflare’s network (Workers AI). The ad videos made from them are stored privately too. When a campaign is launched, its videos and texts are sent to Meta and shown as ads from hyp.fm’s Page, and we store the campaign’s results to show you and to learn which kinds of ads work best.
• Your own videos for Promote: videos you upload are converted (which removes embedded metadata such as location) and stored privately (in the EU), with the date you confirmed you have the rights to them. Our team watches each one before it can be used in ads, and you see the decision and its reason. A rejected video is deleted; you can delete the others yourself.
• Streams: if you upload a report from your distributor, we keep your artist’s streams and earnings from it, added up per month, service, country and song (rows for other artists in the same file are left out). Only you see the earnings. Deleting a report deletes its numbers.
• Social posts (Ultra plan): if you connect Instagram, a Facebook Page, YouTube or TikTok, we keep that account’s name and id and the access it gives (stored encrypted), and post only the videos you choose, with your text, at the time you choose. What happens to a post after that is up to you and the platform. Disconnecting deletes the access we keep. Once a day we also read the account’s follower count, to show its growth in your analytics. If you ask for caption suggestions, the song’s title, your artist name and the lyrics of the video’s part are sent to Anthropic (Claude) to write them.
• Canvas generator: to suggest a picture for your song, the song’s title, your artist name, the lyrics and your description are sent to Anthropic (Claude), which writes a description of the picture. That description (never the song itself) is sent to fal.ai, which makes the pictures. To make a video, the picture you chose and a description of its motion are sent to fal.ai. If you search for stock video, only your search words are sent to Pixabay, from our server. Pictures and videos are stored with your account until you delete the canvas or your account.

How long we keep data

• Your account and page: until you delete them.
• Accounts whose email address is never confirmed: deleted after 7 days.
• When you delete your account, your account, page, releases, images, statistics and settings are deleted at once. Database backups used for disaster recovery may keep them for up to 30 more days.
• Mixes uploaded for mastering, and their masters: 30 days.
• Mixes tried on the free mastering page without an account: 24 hours.
• Songs, pictures and videos tried on the free lyric video page without an account: 24 hours.
• Songs and videos for the video creator: until you delete them or your account.
• Connected accounts for social posts: until you disconnect them or delete your account; your posts’ history in hyp.fm: until you delete the video or your account.
• Songs, lyrics and ad videos for Promote: until you delete them or the release. Ads already shown stay in Meta’s ad library as Meta requires.
• Records of moderation actions are kept to show how reports were handled.

Where data is stored

Account data, page content and images are stored in Cloudflare’s EU jurisdiction. Cloudflare is a US company and delivers pages from data centers worldwide; transfers outside the EU are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. See the list of sub-processors.

Your rights

You can see, correct and delete your data in the dashboard. Under Account you can download everything we store about you as a file (access and portability) and delete your account (erasure). You may also object to processing based on our legitimate interests, or ask us anything about your data at privacy@hyp.fm. You have the right to lodge a complaint with your data protection authority.