diff --git a/src/crystal-gauntlet.cr b/src/crystal-gauntlet.cr
index e1ed907..b3dfb9f 100644
--- a/src/crystal-gauntlet.cr
+++ b/src/crystal-gauntlet.cr
@@ -46,6 +46,9 @@ module CrystalGauntlet
 
   DATABASE = DB.open(ENV["DATABASE_URL"]? || "sqlite3://./crystal-gauntlet.db")
 
+  # todo: unhardcore
+  DATA_FOLDER = Path.new("data")
+
   @@endpoints = Hash(String, (HTTP::Server::Context -> String)).new
   @@template_endpoints = Hash(String, (HTTP::Server::Context -> Nil)).new
 
@@ -225,10 +228,14 @@ module CrystalGauntlet
         return
       end
 
+      ["songs", "levels"].each() { |v|
+        Dir.mkdir_p(DATA_FOLDER / v)
+      }
+
       server = HTTP::Server.new([
         HTTP::LogHandler.new,
         HTTP::StaticFileHandler.new("public/", fallthrough: true, directory_listing: false),
-        HTTP::StaticFileHandler.new("data/", fallthrough: true, directory_listing: false),
+        HTTP::StaticFileHandler.new((DATA_FOLDER / "songs").to_s, fallthrough: true, directory_listing: false),
         CrystalGauntlet::GDHandler.new,
         CrystalGauntlet::TemplateHandler.new
       ])
diff --git a/src/endpoints/levels/downloadLevel.cr b/src/endpoints/levels/downloadLevel.cr
index f792d99..e897a1c 100644
--- a/src/endpoints/levels/downloadLevel.cr
+++ b/src/endpoints/levels/downloadLevel.cr
@@ -82,7 +82,7 @@ CrystalGauntlet.endpoints["/downloadGJLevel22.php"] = ->(context : HTTP::Server:
         xor_pass = password
       end
 
-      level_data = Base64.urlsafe_encode(File.read("data/#{id}.lvl"))
+      level_data = Base64.urlsafe_encode(File.read(DATA_FOLDER / "levels" / "#{id}.lvl"))
 
       # todo: deduplicate this with getLevels?
       response << CrystalGauntlet::Format.fmt_hash({
diff --git a/src/endpoints/levels/uploadLevel.cr b/src/endpoints/levels/uploadLevel.cr
index ec70103..680ccd2 100644
--- a/src/endpoints/levels/uploadLevel.cr
+++ b/src/endpoints/levels/uploadLevel.cr
@@ -126,7 +126,7 @@ CrystalGauntlet.endpoints["/uploadGJLevel21.php"] = ->(context : HTTP::Server::C
 
     DATABASE.exec("update levels set description = ?, password = ?, requested_stars = ?, version = ?, extra_data = ?, level_info = ?, editor_time = ?, editor_time_copies = ?, song_id = ?, length = ?, objects = ?, coins = ?, has_ldm = ?, two_player = ? where id = ?", description, params["password"] == "0" ? nil : params["password"].to_i, params["requestedStars"].to_i, params["levelVersion"].to_i, Clean.clean_special(extraString), Clean.clean_b64(params["levelInfo"]), params["wt"].to_i, params["wt2"].to_i, song_id.to_i, params["levelLength"].to_i, objects, coins, params["ldm"].to_i, two_player, params["levelID"].to_i)
 
-    File.write("data/#{params["levelID"]}.lvl", Base64.decode(params["levelString"]))
+    File.write(DATA_FOLDER / "levels" / "#{params["levelID"]}.lvl", Base64.decode(params["levelString"]))
 
     return params["levelID"]
   else
@@ -135,7 +135,7 @@ CrystalGauntlet.endpoints["/uploadGJLevel21.php"] = ->(context : HTTP::Server::C
 
     DATABASE.exec("insert into levels (id, name, user_id, description, original, game_version, binary_version, password, requested_stars, unlisted, version, extra_data, level_info, editor_time, editor_time_copies, song_id, length, objects, coins, has_ldm, two_player) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", next_id, Clean.clean_special(params["levelName"]), user_id, description, params["original"].to_i32, params["gameVersion"].to_i32, params["binaryVersion"].to_i32, params["password"] == "0" ? nil : params["password"].to_i32, params["requestedStars"].to_i32, params["unlisted"].to_i32, params["levelVersion"].to_i32, Clean.clean_special(extraString), Clean.clean_b64(params["levelInfo"]), params["wt"].to_i32, params["wt2"].to_i32, song_id.to_i32, params["levelLength"].to_i32, objects, coins, params["ldm"].to_i32, two_player)
 
-    File.write("data/#{next_id.to_s}.lvl", Base64.decode(params["levelString"]))
+    File.write(DATA_FOLDER / "levels" / "#{next_id.to_s}.lvl", Base64.decode(params["levelString"]))
 
     return next_id.to_s
   end
diff --git a/src/lib/songs.cr b/src/lib/songs.cr
index 6da027d..1f3965b 100644
--- a/src/lib/songs.cr
+++ b/src/lib/songs.cr
@@ -63,7 +63,7 @@ module CrystalGauntlet::Songs
   end
 
   def get_file_path(song_id : Int32)
-    Path.new("data", "#{song_id}.mp3")
+    DATA_FOLDER / "songs" / "#{song_id}.mp3"
   end
 
   # will raise errors
diff --git a/src/template_endpoints/reupload.cr b/src/template_endpoints/reupload.cr
index 97f37e2..371746d 100644
--- a/src/template_endpoints/reupload.cr
+++ b/src/template_endpoints/reupload.cr
@@ -34,7 +34,7 @@ CrystalGauntlet.template_endpoints["/tools/reupload"] = ->(context : HTTP::Serve
       # todo: reupload as reupload acc
       DATABASE.exec("insert into levels (id, name, user_id, description, original, game_version, binary_version, password, requested_stars, unlisted, version, extra_data, level_info, editor_time, editor_time_copies, song_id, length, objects, coins, has_ldm, two_player) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", next_id, Clean.clean_special(level_data["k2"]), 1, Base64.decode_string(Base64.decode_string(level_data["k3"])), nil, level_data["k17"].to_i32, (level_data["k50"]? || "0").to_i32, level_data["k41"]? ? level_data["k41"].to_i32 : nil, level_data["k66"].to_i32, 0, level_data["k16"].to_i32, Clean.clean_special(level["extra_string"].as_s? || Level::DEFAULT_EXTRA_STRING), Level::DEFAULT_LEVEL_INFO, (level_data["k80"]? || "0").to_i32, (level_data["k81"]? || "0").to_i32, (level_data["k8"]? || "0") == "0" ? level_data["k45"] : level_data["k8"], level["length"].as_i, level_data["k48"], (level_data["k64"]? || "0").to_i, (level_data["k72"]? || "0").to_i, (level_data["k43"]? || "0").to_i)
 
-      File.write("data/#{next_id.to_s}.lvl", Base64.decode(level_data["k4"]))
+      File.write(DATA_FOLDER / "levels" / "#{next_id.to_s}.lvl", Base64.decode(level_data["k4"]))
 
       level_id = next_id
     rescue error