Last updated: September 30, 2026
This page explains what data is collected, stored, and shared when you read elezea.com, use one of the apps I build (currently Discrobble and the Last.fm MCP Server), or visit related side projects (Listen To More, Discogs MCP Server).
The short version: I collect as little as possible, store nothing I don’t need, and never sell or share your data with advertisers.
If you’d like to delete your data or have any questions, get in touch via the contact form.
Discrobble (iOS app)
Discrobble scrobbles your physical-music plays (vinyl, CDs, cassettes, etc.) to Last.fm using metadata from Discogs. To do that it needs to talk to both services on your behalf.
What lives on your iPhone (never sent anywhere)
- Your Discogs OAuth tokens, stored in the iOS Keychain. These let the app call Discogs to fetch your collection and release details. After version 1.0, these tokens never leave your device — every Discogs API call is made directly from your phone.
- Your album collection (release ID, title, artist, year, cover image URLs, formats, date added) — fetched from Discogs and cached locally so the app works fast and offline.
- Your recent scrobbles list — locally cached so you can see what you’ve played.
- App preferences (sort order, settings).
What’s stored on the Discrobble server
The Discrobble backend runs on Cloudflare Workers and stores the minimum needed to deliver scrobbles to Last.fm:
- A SHA-256 hash of your Last.fm session key (used as a lookup ID — the hash can’t be reversed).
- Your Last.fm session key itself, encrypted at rest with AES-256-GCM. The server uses it only to submit scrobbles to Last.fm when you tap the scrobble button.
- Your Last.fm username and Discogs username (so the app knows whose collection to sync).
- Your lifetime scrobble count, plus a flag for whether your account predates the paid version. These apply the free-trial limit — the first 20 scrobbles are free, after which a one-time $4.99 unlock enables unlimited scrobbling. The purchase itself is handled on-device by Apple’s StoreKit; the server never sees your payment or receipt.
- Your most recent scrobbles (up to 50 — album title, artist, cover image URL, and a timestamp), so your recent activity stays in sync across your devices.
- Timestamps for when your account was created and last active.
That’s it. The server does not store your full album collection, your Discogs tokens, your real name, your email, your payment details, your IP address (beyond what Cloudflare’s standard request logs retain for a short period), or any analytics events.
What’s shared with third parties
- Last.fm receives your scrobbles, which is the entire point of the app. Their privacy policy is at last.fm/legal/privacy.
- Discogs receives API requests from your phone for collection data and release details. Those requests originate from your device’s IP, not from Discrobble’s server. Their privacy policy is at discogs.com/privacy.
There is no analytics SDK, no advertising network, no third-party tracker, and no crash reporting service shipped in the app.
Account deletion
You can delete your Discrobble account and all associated server-side data at any time by reaching out via the contact form. Deletion removes your records from the database and is immediate and permanent.
You can also disconnect Last.fm or Discogs individually from the app’s Settings screen. Disconnecting removes the stored tokens but doesn’t automatically delete the server record — for that, use the contact form above.
Last.fm MCP Server
The Last.fm MCP Server lets AI assistants such as Claude read your Last.fm listening data. It runs on Cloudflare Workers. Tools that look up public artist, album, and track information work without signing in. Tools that read your own listening history ask you to sign in with Last.fm first, on last.fm itself, so the server never sees your password.
The server only reads from Last.fm. It has no tools that scrobble, love tracks, or change anything on your account.
What’s stored on the server
When you sign in, Last.fm gives the server a session key for your account. The server stores:
- Your Last.fm username and session key in a session record, which expires after 30 days. This record relies on Cloudflare’s standard encryption of stored data; it has no extra encryption layer of its own.
- A second copy of your username and session key inside the OAuth grant your AI client uses to connect. This copy is encrypted with your client’s access token, so it can only be read when your client makes a request.
- Cached Last.fm responses (recent tracks, top artists, loved tracks, and so on), so repeat questions don’t hit Last.fm’s API every time. Anything tied to your account expires within 24 hours.
- A request counter for rate limiting, which resets every minute.
- Application logs that include your Last.fm username, kept for a few days to debug problems.
The server doesn’t store your email, your real name, or your conversations. It sees the tool calls your assistant makes (for example, “top artists for the last month”), not the chat around them.
What’s shared with third parties
- Last.fm receives the API requests the server makes on your behalf. Their privacy policy is at last.fm/legal/privacy.
- Your AI assistant’s provider (Anthropic, OpenAI, and so on) receives the results of each tool call, under that provider’s own privacy policy.
Disconnecting and deletion
To cut off access immediately, revoke the app in your Last.fm application settings. That invalidates the session key, so the server can’t read anything more from your account, even before the stored records expire. You can also remove the connector from your AI client.
To have your stored records deleted right away instead of waiting for them to expire, get in touch via the contact form.
elezea.com (this website)
This is a static blog hosted on Cloudflare Workers. It uses no cookies, no third-party analytics, and no advertising.
If you subscribe to the email newsletter, your email address is stored with the newsletter provider (Buttondown) only for the purpose of sending posts. You can unsubscribe at any time using the link in any email, which permanently removes your address.
Cloudflare retains standard request logs (IP, user agent, response time) for a short period for operational purposes — typical CDN behavior, the same as visiting any Cloudflare-fronted website.
Other side projects
The MCP server marketing pages and Listen To More are static informational sites. They don’t collect personal data, set cookies, or run analytics.
Listen To More allows you to connect a Last.fm account for music recommendations. If you do, your Last.fm session is handled identically to Discrobble (encrypted at rest, deletable on request).
Your rights
Wherever you live, you can:
- Ask what data of yours I have on file.
- Ask me to delete it.
- Ask me to correct it.
There’s no formal request process — just send a note via the contact form and I’ll respond within a few days. As a solo developer in the United States, I’m subject to relevant laws including the GDPR (for visitors from the EU/EEA/UK) and CCPA (for California residents); the practical effect is the same — I’ll honor any reasonable request to access, correct, or delete your data.
Children
None of these apps or sites are designed for or directed at children under 13. If you believe a child has provided personal information, let me know via the contact form and I’ll delete it.
Changes to this policy
I’ll update this page when something material changes — for example, if I add a new app, integrate a new third-party service, or change how data is stored. The “Last updated” date at the top reflects the most recent change. Significant changes that affect existing users will also be announced in a blog post.
Contact
Questions, requests, or concerns: the contact form.