SetTracker · 2026-10-22
Privacy policy
Support feedback
We store your issue description, email, attachments and extension version (when provided by the extension) to investigate and reply. Images are re-encoded without embedded metadata; videos retain their original content and metadata. All attachments are stored privately in OSS. Access is limited to administrators and anyone holding your private receipt link; keep that link private. Network addresses are hashed for anti-abuse counters lasting up to 48 hours. Replies are sent through Resend to the email you supply; email replies go to our support mailbox. Records are retained for follow-up until you request deletion through the support address. Rotating backups may retain deleted records for up to 14 days. Never submit passwords, keys or session tokens.
Who operates this service
SetTracker operates the SET TRACKER browser extension and settrac.top. Contact: leshanlijiayu@126.com. This policy covers the Google Chrome and Microsoft Edge extensions and its connected website. Last updated: 22 October 2026.
What stays in your browser
The extension stores your preferences, panel position, selected tracklists, imported text and editing drafts in local extension storage. Playback time is read to highlight and seek songs; we do not upload the audio or video stream. Page scanning reads the description and comments already loaded on a supported video page when you request it. We do not read your browser history, unrelated tabs, payment details, or passwords entered on other websites.
When information leaves your browser
Store builds starts with online features disabled. You can enable them on the welcome page or in settings, and withdraw this permission in settings; disabling stops new extension network requests and aborts pending requests. Local imports and playback controls remain available. When online features are enabled and you open the panel, SET TRACKER queries settrac.top using the current supported video URL or identifier to find tracklists. When no tracklist is available, automatic external discovery can send the video URL or title to 1001Tracklists. Manual searches send the query you enter to the selected provider. Source-page reading can use your existing 1001Tracklists session; we do not extract its passwords or cookie values. The source service receives ordinary requests and may require you to log in or complete verification.
Accounts and private favorites
If you register, we receive your email, display name and password over HTTPS. We store a salted password hash, not the plaintext password. Optional nationality and avatar, account timestamps, session records, and private favorite tracklist/song snapshots are stored with your account. Website and extension login sessions are separate. Favorite records include their source video, tracklist, artwork, timestamps and offset so they can be restored. Your email and favorites are not published.
Public contributions and usage
Publishing a set or tracklist, commenting, confirming a source tracklist as Accurate, or submitting corrections sends the relevant content and context to our server. The Accurate action can add the complete source tracklist and its video binding to the public catalog; it is not just private feedback. Public contributions can show your chosen name, nationality, contribution score and associated profile imagery. Source attribution and original contributor information may also be displayed. We store feedback and moderation records. An installation identifier, or a server-derived identity associated with your account, supports deduplication, contribution attribution and daily tracklist-use counts. These records may include video/source URLs, tracklist identifiers, dates and channel. They are not used for advertising.
Avatars and artwork
Avatar uploads are decoded, resized to 256 × 256 WebP and stripped of embedded metadata before storage in Alibaba Cloud OSS (Hong Kong). Managed covers are also copied to OSS. Image URLs are publicly accessible to anyone who has the URL: do not upload a confidential image. Removing or replacing an avatar removes its account association; it does not immediately delete the stored object or cached copies. Contact us for an object-removal request. Third-party artwork may still load from its original host while a managed copy is unavailable.
Providers and external sites
Our hosting and storage providers process data needed to run the service. Alibaba Cloud OSS hosts images; Resend processes the recipient address and content of transactional account emails, including welcome and password-reset messages. Supported video sites (YouTube and Bilibili) and 1001Tracklists handle requests to their services under their own policies. Music-service links, metadata lookups and images may connect to Spotify, SoundCloud, NetEase Music or the named source host. The extension does not send account passwords or favorite collections to these music sites. There is no advertising SDK or third-party analytics SDK in the extension. We do not sell user data or use it for targeted advertising.
Cookies, security and international processing
The website uses an HTTP-only session cookie for login (up to 30 days) and a language preference cookie (up to one year). The extension keeps its login token in trusted session storage, which is cleared on browser shutdown; server sessions have an expiry. Password-reset links expire after 30 minutes. HTTPS protects data in transit. IP addresses and request metadata may be processed for delivery, abuse prevention and operational diagnostics; application rate limits use hashed IP identifiers where implemented. Hosting, OSS in Hong Kong and email delivery may process data outside your country.
Retention and removal
Local extension data remains until you clear it or uninstall the extension. Cloud account information and favorites remain while the account is maintained; public contributions and feedback remain until removed, moderated, or handled through a verified request. There is currently no automatic inactivity deletion. Server database backups rotate after 14 days; separately retained recovery copies are managed manually. A deletion request must therefore cover both active records and any separately retained copies where applicable; deletion is not immediate in all backups or caches. Security records can be retained where necessary to prevent abuse or meet obligations.
Your choices and requests
You can change your name/nationality, remove your avatar association, delete favorites, delete your own comments and use the available removal controls for your published tracklists. You can use local import without an account, close the panel, disable the extension or uninstall it. Uninstalling does not delete your cloud account or public contributions. Email leshanlijiayu@126.com to request access, a copy, correction, account deletion or removal of an uploaded image. Send the request from the account email where possible; do not send passwords, access keys or session tokens. We verify ownership before acting and explain any limits, such as shared/public records or retention obligations.
Changes and contact
Material changes to these practices will be reflected in this policy and, where appropriate, in the product. Contact SetTracker at leshanlijiayu@126.com for privacy, security or copyright questions. SET TRACKER is an independent product and is not affiliated with Google, Microsoft, YouTube, Bilibili or 1001Tracklists.
Optional first-party usage statistics
Usage statistics are enabled by default. Turn them off at any time using the website footer/privacy-page switch for this browser, or the extension settings switch for the extension. Store builds also require online features to be enabled. We send a random browser-installation identifier, feature events, coarse page category, YouTube/Bilibili platform, software version, search outcome, result count and duration to our own server. Analytics does not contain video titles, video/source URLs, search terms, track metadata or full browsing history. This is separate from discovery and AI keyword suggestions, which process the video/title needed for the requested feature. Logged-in events may be associated with your account; guest history is not retroactively assigned on sign-in. Identifiers are pseudonymous, not anonymous, and are not unique-person or store-install counts. Disabling stops queued/new reporting and aborts in-flight requests where possible; already received records remain until retention expiry or a supported data-removal request. Events are retained for 90 days; first/last-seen device records are removed after 400 consecutive inactive days. Cleanup runs when analytics traffic is received. Website and extension choices are separate.