Privacy Policy
Effective date: 2026-04-18. Last updated: 2026-09-01.
This translation is provided for convenience. In case of any discrepancy, the Russian version prevails.
1. What this document covers
This Policy explains which personal data the website discomagic.ru and its subdomains (the "Site") process, why, for how long and with whom they are shared. It is drafted in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" ("152-FZ").
Consent to processing is a separate document: Personal Data Processing Consent. The rules for using the Site are set out in the Terms of Use.
2. Operator
- Operator: Sergey Aleksandrovich Vorobiev, a private individual and citizen of the Russian Federation.
- Site: https://discomagic.ru
- Personal data contact: admin@discomagic.ru
The Site is non-commercial: music is free, no advertising is shown, and user data is never sold or used for advertising.
3. Legal grounds
- Consent of the data subject (Art. 6(1)(1) of 152-FZ): registration, contact forms, emails, analytics cookies.
- Performance of the agreement with the user, i.e. the Terms of Use (Art. 6(1)(5)): maintaining the account, displaying user content, account notifications.
- Legitimate interests of the Operator (Art. 6(1)(7)): protecting the Site from attacks and abuse, technical logs, anonymised statistics, proof that consent was obtained.
4. What data is processed and why
| Situation | Data | Purpose |
|---|---|---|
| Any visit | IP address, User-Agent, referer, page URL, anonymous device identifier (cookie dm_cid), country derived from the IP by a local database on the server (the IP is not sent anywhere) | Running the Site, bot and attack protection, anonymised traffic statistics |
| Email registration | Name or nickname, email, password hash (bcrypt). Optional: avatar colour, short bio | Account, sign-in, access recovery |
| Sign-in with VK ID | VK user identifier, email, first and last name (used only for the display name). The VK avatar and other profile data are not stored | Passwordless registration and sign-in |
| Email verification, email or password change, "Remember me" | One-time codes and tokens, cookie dm_remember | Account security |
| Listening, downloading, archives, reading articles | User identifier or dm_cid, track or article identifier, IP address, User-Agent hash, time | Counters, protection from fraud and bulk downloading |
| Comments, Club chat, reactions, playlists, favourites, ideas | Text, author, date, IP address. Comments and chat are public; a playlist is visible to others only if you make it public | Displaying user content, moderation |
| Reporting a message | Who reported, what, reason, moderation result | Moderation; visible to administrators only |
| Online presence | User identifier or dm_cid, last activity time; your name appears in the chat list only when chat is enabled | Visitor and chat counters. Can be switched off in profile settings |
| Notifications and emails | Notification settings, digest frequency and time zone, delivery status and bounce information | On-site notifications, reply emails and the new-track digest (the last two only if you opt in) |
| "Contact" and "Suggest an idea" forms | Name, email, subject, text, IP address, time | Replying to your message |
| Donation | The name you entered in Donation Alerts, amount, message, date | Supporters list on the "Support" page, "Patron" badge for a matching nickname. Data comes from Donation Alerts; the Site never receives payment details |
| Consents | Date and time, identifier or email, context (registration, form, cookie banner, digest), action, document versions, IP address, User-Agent hash | Proof that consent was obtained (Art. 9(4) of 152-FZ) |
| Administrator actions | Administrator identifier, IP address, User-Agent, operation | Security audit |
| Yandex.Metrica (only after consent in the cookie banner) | IP address, visitor identifiers in cookies, navigation, clicks, browser parameters, session replay (Webvisor) | Traffic and usability analysis |
| Submitting forms | Yandex SmartCaptcha: IP address, technical headers and browser signals | Bot and spam protection |
Special categories of personal data (health, political views, etc.) and biometric data are not processed. Users do not upload files.
5. Cookies and browser storage
Essential cookies are required for the Site to work and are set regardless of your banner choice. Yandex.Metrica cookies appear only after you click "Accept" in the cookie banner; until then the counter is not loaded. You can change or withdraw your choice at any time via the "Cookie settings" link in the Site footer: the banner will appear again. Advertising cookies are not used.
| Cookie | Purpose | Lifetime |
|---|---|---|
| dm_sid | Sign-in session | until the browser is closed; 30 days of inactivity on the server |
| dm_remember | "Remember me" | 30 days |
| dm_cid | Anonymous device identifier: statistics, online counter, guest presence in chat | 1 year |
| dm_lh | Guest listening counter | 90 days |
| dm_locale, dm_catalog_view | Interface language, catalogue view | up to 1 year |
| _ym_uid, _ym_d, _ym_isad and other Yandex.Metrica cookies | Visitor identification for analytics | up to 1 year |
In the browser's localStorage and sessionStorage the Site keeps settings that never leave your device: player and radio state, chat drafts, guest favourites, your cookie-banner choice, interface preferences. You can also block Metrica with the official Metrica blocker extension.
6. Who receives the data
Personal data is not sold and not shared for advertising. The following parties, all located in the Russian Federation, are involved in running the Site:
- HostiMan LLC: hosting and SMTP server for emails. Processes all Site data on servers in Russia.
- YANDEX LLC: Yandex.Metrica and Webvisor, only after consent in the banner. Yandex policy.
- Yandex.Cloud LLC: Yandex SmartCaptcha when forms are submitted. Yandex Cloud policy.
- V Kontakte LLC: VK ID service, only if you sign in with VK. VK sends the Site the data listed in the "Sign-in with VK ID" row; the Site sends VK only the authorisation request. VK ID policy.
- Donation Alerts: donation payment service. Payment happens on its side under its rules; the Site receives the name, amount, message and date. Donation Alerts policy.
Database backups are stored on the hosting servers and on the Operator's own equipment in Russia. No cross-border transfer of personal data takes place. New-track announcements in Telegram and links to music platforms (VK Music, Yandex Music, Apple Music and others) contain no user data: when you follow a link, the rules of that platform apply.
7. Public third-party material
Track pages may show a copy of public comments left under the project's VK posts, with the platform named and a link to the original. Only the author's public identifier and name, the text and dates are stored. The author of such a comment does not become a Site user; hiding the copy on the Site does not change the original. Requests to hide: admin@discomagic.ru.
8. Retention periods
- Account, playlists, favourites, settings: while the account exists.
- One-time codes and tokens (email verification, password reset, email change): up to 24 hours.
- Server sessions: 30 days of inactivity.
- Online presence: no longer than 24 hours.
- Comments, chat messages, reactions, ideas: until deleted by the author or the Operator; service records of deleted chat messages up to 365 days.
- Form submissions: 3 years.
- Page-view log: 90 days; site events: 1 year; afterwards only anonymised daily aggregates.
- Listening, download and article-view records: while the counters are kept; the IP address and User-Agent hash are removed when the account is deleted or on request.
- Digest delivery history: up to 2 years.
- Supporters list: while published on the Site; hidden on request.
- Consent log: 5 years from the record date (records are never edited).
- Administrator action log: 365 days.
- Yandex.Metrica data: under the terms of that service.
9. Data protection
- HTTPS on every page; passwords are stored only as hashes.
- CSRF tokens, SmartCaptcha, rate limiting, temporary lockout after repeated failed sign-ins.
- Access to the administration panel is limited by role and IP allowlist; every action is written to an audit log.
- Regular rotated backups, restricted server access, up-to-date software.
- Moderation: the Operator may hide or delete material, restrict chat access or block an account for violating the Terms of Use or the law.
10. Your rights
Under Articles 14-21 of 152-FZ you may:
- find out which of your personal data is processed and obtain a copy;
- request that data be corrected, blocked or deleted;
- withdraw consent;
- delete your own content through the Site interface or on request;
- delete your account in profile settings. Your email, name and password are erased, comments are hidden, form submissions are anonymised and IP addresses are removed from statistics; only anonymised counters and the consent log remain;
- complain to Roskomnadzor (rkn.gov.ru) or to a court.
Send requests to admin@discomagic.ru with the subject "Data subject request", stating the email used on the Site. A reply is given within 10 business days; this period may be extended by no more than 5 business days with notice.
11. Age of users
The Site is intended for persons over 16 (rated 16+). If you are under 16, use the Site and register only with the consent of a parent or other legal guardian. On learning of a child's account created without such consent, the Operator deletes it.
12. Changes to this Policy
The current version is always available at discomagic.ru/privacy-policy. When the scope of data or the list of recipients is extended, the Operator asks for consent again; for clarifications and reductions only the document date is updated.
13. Contact
For any question about personal data write to admin@discomagic.ru.