The rules of the room.

Document version

Version of this document: 2026-09-18. That identifier is stored with every Terms of Use acceptance, so it stays possible to tell which version an account holder accepted and to ask for a new acceptance after a material change. How personal data is handled is described in the Privacy Policy, and what is stored in your browser in the Cookie information.

2. What Rolls & Rocks does

Rolls & Rocks turns a recording into a playlist. You hand it an audio recording — a file from your device or a direct HTTP(S) link to one — the service analyzes it asynchronously, tries to identify the music it contains and builds a playlist from what it recognized. A playlist can be listed in the public catalog, imported into a personal library, renamed, merged with another playlist, exported to Spotify by the owner, and opened as an Embed page that plays it or its individual tracks in Spotify's own embedded players.

Part of the service works without an account: a visitor can upload a recording and watch the analysis, and the public catalog is open to everyone. An account is needed to keep a personal library, to attach a name to what you publish and to export to Spotify.

The service is a recognition and cataloguing tool, not a music service: it does not host, stream or distribute music for listening on demand. Playlists contain metadata and, where an external catalogue offers them, links to cover art and thirty-second previews hosted by other providers.

3. What you need to use it

• a current web browser, with cookies and site data allowed for this domain: without the session cookie an upload cannot be followed from one page to the next, and without the CSRF cookie no form can be submitted (details on the Cookie information page);
• a recording in a container the service can decode. A filename extension outside the supported audio formats, a damaged file or a file with no audio stream is rejected before anything is analyzed;
• a recording within the size and length limits of the chosen analysis profile — the limits in force are shown next to the form, and a recording that exceeds them is refused before anything is analyzed;
• an Internet connection: the recording is analyzed on the server and the result depends on services operated by other providers.

4. Accounts

• An account is created from a login and a password. An e-mail address is optional and can be added, changed or removed later on the account page.
• Terms of Use have to be accepted when the account is created. The checkbox on the registration form is off by default and the server refuses a registration without it; the accepted version and its timestamp are recorded. Declining a future version remains possible by not using the service any more.
• You keep your password to yourself: anyone who knows it can use the account. The password is stored as a password hash.
• One person should use one account; an account cannot be transferred or sold.
• You have to be able to enter into a contract under the law that applies to you in order to create an account.
• How to delete an account is described in point 13.

5. Recordings and links you send

• You choose exactly one source per submission: a file from your device or a direct HTTP(S) URL pointing at an audio file.
• A submission is identified by the SHA-256 hash of its content. Submitting the same content again returns the existing result instead of analyzing it twice. The same applies to a URL that was already downloaded.
• Downloading from a URL is an optional feature of the deployment: an operator can switch it off.
• Uploads made without signing in stay attached to your browser session and are transferred to your account when you sign in in that browser.
• Never send material you are not allowed to send, and do not use the service as storage or as a backup: the source recording is deleted after the analysis (point 9).

6. Your statement about the material

By sending a recording or a link you state that you have the rights needed for what the service does with it: storing it for the time of the analysis, decoding it, sending short audio segments to the recognition provider chosen by the operator, and publishing the resulting playlist in this application in the form you choose (including the public catalog, if you publish it). If you do not have those rights — for example for a commercial recording you are not allowed to upload, or for a recording of another person who did not agree — do not send it.

The playlist that comes out of an analysis contains metadata about the recognized music and, where available, links to cover art and previews hosted by other providers. The operator claims no rights in your recordings and does not use them for anything beyond the analysis described here. Rights to the recognized music stay with their owners; a recognition result is not a licence to use that music.

7. What is not allowed

• sending material that is unlawful, that you have no right to send, that is malicious, or that contains other people's personal data without a legal basis;
• using the service to harass, to infringe rights, or to distribute content prohibited by law;
• attacking or overloading the service, scanning it, probing it for vulnerabilities without a written agreement, or trying to get around the limits described in point 3 — including attempts to make the server fetch internal or third-party addresses through the URL feature;
• automated mass submissions, scraping the public catalog, or reselling the service without an agreement;
• uploading malware or any file that is not an audio recording;
• impersonating another person or creating an account for someone else without their agreement.

Playlist names and displayed filenames are checked for prohibited words and masked or rejected, but that check is a rough filter, not an assessment of meaning; it does not make whoever publishes something less responsible for it.

8. How the analysis and the playlists work

• The recording is decoded on the server and split into short fragments; a fragment at a time is sent to the recognition provider configured by the operator. A submission may wait in a queue while other analyses run, so the result is not immediate.
• What the provider returns (title, artist, album, identifier, cover art) becomes the playlist. Cover art may be replaced with the artwork of a matching release from Spotify, and thirty-second previews are looked up in the public iTunes Search API of Apple.
• Recognition is a best-effort process. Part of a recording may not be recognized, may be recognized incorrectly, or may be matched to a different edition of a song. Unrecognized fragments simply do not appear in the playlist. A playlist is not a verified tracklist and should not be treated as one.
• A merged playlist is a new playlist built from two playlists; the playlists that went into it stay unchanged and are not removed.

9. The source recording is deleted after the analysis

When the analysis of a submission reaches a final state — succeeded or failed, including a failure caused by an unexpected error — the content of the source recording is removed from the storage used by the application. What remains is the record of the submission: hash, size, original filename, chosen profile, timestamps, status, progress, an error description if there was one, the playlist it produced and the recognition results. The recording itself can no longer be downloaded from the service, so keep your own copy of anything you care about.

Submission records are kept so that the same content is not analyzed twice and so that the playlists stay consistent. Orders to download from a URL lose their URL and their metadata seven days after they reach a final state; the URL deduplication record — the hash of the address, without the address itself — is kept, which is what makes a repeated submission return the existing result. This policy covers the storage the application uses; it says nothing about backups or about versioning configured by the operator of that storage.

10. Services run by other providers

Features of Rolls & Rocks depend on services operated by other companies, each with its own terms and privacy policy:

• Recognition provider — the service configured by the operator. Short audio segments of your recording are sent there and the returned metadata is what the playlist is built from.
• Apple — the public iTunes Search API is queried with the title and artist of a recognized track to find a thirty-second preview.
• Spotify — a playlist can be exported to a Spotify account you connect, and the playlists are created there; disconnecting removes the connection. Album artwork may be fetched from Spotify's image delivery network, and the Embed page of a playlist loads Spotify's own players into your browser, so Spotify receives that request directly.
• PayPal — only if the operator configured a donation link. The button on the Donate page leads to PayPal.
• Facebook, X and WhatsApp — only when you press a Share icon on a playlist page. The button hands the address of the current page to the service you picked, which then applies its own terms and privacy policy.

Rolls & Rocks is an independent project. It is not affiliated with, sponsored by or endorsed by Spotify, Apple, ACRCloud, PayPal, Facebook, X or WhatsApp, and their names and marks belong to their respective owners.

11. Availability of the service

The service is provided on a best-effort basis, without a guarantee of continuous or uninterrupted availability, and without a guarantee that a particular recording will be recognized. Functions that depend on external providers can be limited, delayed or switched off — temporarily or permanently — when such a provider is unavailable, changes its API, rate-limits requests or discontinues the service. Analysis queues can also delay a result. Maintenance and deployments may interrupt access without prior notice.

12. Problems, complaints and unlawful content

If something does not work, write to the operator and describe what you wanted to do, what happened and — for a playlist — its address in the application. Describe an unrecognized or wrongly recognized track as well: the recognition providers are imperfect and a report helps.

If you believe that material published here infringes your rights or is unlawful, write to the same address, identify the material precisely (playlist address, recording, the fragment concerned), explain the basis of your claim and give a way to answer you. We will review the report and, where justified, remove the content or the account.

13. Stopping, and deleting an account

You can stop using the service at any time. To delete the account, ask the operator, ideally from the e-mail address stored in the account. Deletion is currently done by the operator.

Tell us at the same time whether the playlists and the records of the submissions created through the account should be removed too. Deleting an account removes the Spotify connection and the stored acceptance of these terms with it; playlists and submission records are detached from the account rather than automatically deleted, because they may be listed in the public catalog or imported by other people.

The operator may suspend or close an account that breaks these terms — in particular after unlawful uploads, after an attack on the service or after attempts to get around its limits — and may remove published playlists that break them.

14. Changes to these terms

These terms change when the service changes: a new feature, a new external provider, a different retention rule. A material change gets a new version identifier — the date shown at the top of this page, together with the version stored when the account was created. The version published here applies from the moment it is published. Continuing to use the service after a change means accepting the version that is current.

15. Responsibility

The service is provided as it is. The operator is responsible for running it with due care, but not for the accuracy of an analysis result, for the availability of services run by other providers, or for what a visitor does with a playlist found in the public catalog. You are responsible for the material you send and for using the recognition results lawfully — recognizing a track does not give you any right to it.

Nothing in these terms is meant to exclude or limit liability or rights that cannot be excluded or limited by law, in particular the rights of a consumer. If a provision turns out to be invalid, the rest of the document stays in force. Which law applies, and which authority and courts are competent, depend on the operator and on the mandatory rules that protect you; those details have to be completed before a public launch.