Privacy

nullrights is a catalog of public-domain music. Using it doesn't require an account, and we collect as little as we can. This page explains what is processed, why, and for how long.

Who is responsible. Solanex BV operates this site and is the data controller. Questions about your data: infosolanex.be.

No cookie banner, because there is nothing to consent to. The site sets no cookies for visitors and loads no advertising, social-media or third-party tracking scripts. Fonts and scripts are served from this domain. The only cookie is a session cookie, set after you deliberately sign in.

Usage statistics

To see which pages, tracks and searches are used, we count events in two ways. Neither stores your IP address or anything on your device, and neither follows you across other sites.

• Our own counters. When you open a page, play a track for more than ten seconds, download a file or run a search, our server records the event together with the page or track, your country, the site that linked to you, your device type (mobile or desktop), the network your connection comes from (its operator, such as your internet provider or a hosting company, so automated traffic can be counted separately) and an anonymous visitor identifier. That identifier is a one-way hash of your IP address and browser, computed with a secret that changes every day: it can't be reversed, and the same person gets a different value tomorrow. Events are kept for three months in Cloudflare Workers Analytics Engine.
• Cloudflare Web Analytics. A small script from Cloudflare reports page loads and performance timings. Cloudflare uses no cookies or local storage for this, doesn't fingerprint visitors, and derives your country from your IP address without storing it. See Cloudflare's privacy policy.

Legal basis: our legitimate interest in knowing how the site is used and keeping it working (GDPR art. 6(1)(f)).

Accounts, favorites and playlists

Signing in is optional. If you do, we process:

• Your email address, to send you a one-time sign-in link and to identify your account. Sign-in links expire after 15 minutes and work once. Before sending, we look up the domain's mail-server records through Cloudflare's DNS resolver to catch typos.
• A session cookie (nr_session) that keeps you signed in for 90 days. It is HttpOnly, only sent to this site, and contains a random token, not your address.
• Your favorites: the tracks you've hearted.
• Your playlists: their names, descriptions and tracks. A playlist is private until you choose to share it; a shared playlist (by link, or listed publicly) shows its name and description to anyone who opens it, and can be hidden by us if it breaks the rules.
• A display name, only if you set one. It appears on playlists you share. Your email address is never shown to other visitors.
• A bot check on the sign-in form, provided by Cloudflare Turnstile. It analyses browser signals to tell people from automated scripts; Cloudflare's privacy policy covers it.

Sign-in emails are sent through Cloudflare Email Sending. Legal basis: performing the service you asked for (GDPR art. 6(1)(b)). Your account and everything attached to it can be deleted at any time from the account page; deletion is immediate.

Copyright notices

If you file a takedown notice, we keep the notice itself (your name, contact details, the statements you made and our decision) for as long as we may need to demonstrate how it was handled, at most three years after it is closed, and we email you about it. Unconfirmed notices are deleted after 72 hours. Legal basis: our legal obligations and legitimate interest in handling rights claims correctly (GDPR art. 6(1)(c) and (f)).

Hosting

The site runs on Cloudflare. Like any web server, Cloudflare processes your IP address and request headers to deliver pages and defend against abuse, and keeps short-lived technical logs. Cloudflare acts as our processor under its Data Processing Addendum, which includes the EU standard contractual clauses.

Your rights

Under the GDPR you can ask for access to, correction or deletion of your data, restriction of processing, or a copy in a portable format, and you can object to processing based on legitimate interest. Write to infosolanex.be. You can also complain to your data protection authority; in Belgium that is the Gegevensbeschermingsautoriteit.

Changes

This page was last updated on 10 September 2026. Material changes will be noted here.