Privacy Policy

HackMusic is a small, experimental web service operated from New Jersey, United States. In this policy, “HackMusic,” “we,” “us,” and “our” refer to the operator of hackmusic.fun.

This policy applies to the HackMusic website, temporary event rooms, host controls, and related support communications. It does not replace the privacy policies of Spotify, YouTube (Google), OpenAI, or other services you choose to use with HackMusic.

Information you provide

• Event names and participant display names.
• Spotify track links or YouTube video links and the resulting title, artist or channel name, duration, and Spotify track or YouTube video identifier.
• Party play data: cheers, boos, quick emoji reactions sent to the host screen, guesses about who picked a song, one-time power-up use (song shield, double cheer), and the resulting scores.
• Optional host settings such as a round theme and whether song pickers are revealed after each song.
• Cheers, boos, queue choices, scores, and other event actions.
• Your email address and message if you contact us directly.

Information created while the service runs

• Random room, participant, submission, reaction, activity, and host-control identifiers.
• Room passcodes are stored by HackMusic only as salted, one-way hashes. The readable passcode remains on the host’s browser so it can be shared with invited guests.
• Event status, queue order, timestamps, reaction history, and final scores.
• Cookie-free, first-party website analytics: visit time, a normalized page category, external referrer hostname, broad device category, and a country code when our hosting provider makes one available. Private room codes, query strings, full referrer URLs, raw IP addresses, and full browser user-agent strings are not added to the analytics database.
• A random identifier kept only in the browser tab session is converted on the server into a one-way identifier that changes each UTC day. We use it to estimate visits without creating a persistent visitor profile.
• Basic request and security information that our hosting and network providers may process, such as IP address, browser/device details, request logs, and error information.
• For the owner-only admin page, the ChatGPT account identifier and email forwarded by OpenAI Sites are used at request time to authenticate the owner and enforce the email allowlist. HackMusic does not add them to the event database.

We do not ask for a HackMusic account, legal name, postal address, phone number, or payment information during normal play.

We use information only to provide, understand, and protect the service: create and operate rooms, remember participants and the host device, validate Spotify tracks and YouTube videos, control authorized playback, calculate scores, display event history, measure aggregate website usage, authenticate the owner-only administration page, prevent abuse, diagnose failures, answer support requests, and comply with law.

We do not sell personal data. We do not use event data for targeted advertising, cross-site behavioral profiling, credit decisions, employment decisions, or other legally significant automated decisions.

HackMusic does not use advertising cookies, analytics cookies, tracking pixels, or cross-site marketing cookies. Our first-party analytics does not send information to an advertising or third-party analytics platform.

• Spotify OAuth cookie: a short-lived, HTTP-only cookie keeps the Spotify sign-in request secure for about 10 minutes.
• Spotify session cookie: an encrypted, HTTP-only, secure cookie keeps the host’s authorized Spotify connection available for up to 30 days, or until the host disconnects it. It contains Spotify access credentials and required connection details and is not available to page scripts.
• YouTube embedded player: in YouTube rooms the host page embeds YouTube’s player, which may set Google’s own cookies and storage on the host device under Google’s policies. Guest phones never load the player.
• Local browser storage: participant IDs, host keys, the host’s readable room passcode, hosted-room shortcuts, room names and statuses, recent access times, and the host’s public Spotify Client ID are stored on that device so the browser can recognize its room role, share invitations, and help the host reopen recent events. This hosted-room history stays in that browser and is not a separate server-side profile. Clearing site data removes it and may lock that browser out of host controls.
• Analytics session storage: a random visit identifier is stored only for the life of the current browser tab session. It is not a cookie, is not shared across sites, and is not used to recognize you over time. Analytics collection is skipped when the browser sends an enabled Do Not Track or Global Privacy Control signal.
• Infrastructure storage: OpenAI Sites and its infrastructure providers may use strictly necessary security, routing, authentication, load-balancing, or fraud-prevention technologies.

You can clear cookies and local storage through your browser. Blocking necessary storage may prevent room recognition, host access, or Spotify playback.

A host may voluntarily connect a Spotify Premium account using Spotify’s authorization screen. HackMusic requests the permissions needed for streaming, account eligibility, playback state, and playback control. We use the resulting authorization to run the shared speaker and do not intentionally display or store the host’s Spotify email or private profile information in the HackMusic event database.

Spotify controls its own service and data practices. Review the Spotify Privacy Policy ↗. Disconnecting Spotify from the host page removes HackMusic’s Spotify cookies on that device; you can also revoke access from your Spotify account settings.

In YouTube rooms no account or sign-in is involved. When a guest submits a video link, our server asks YouTube’s public metadata endpoints for the title, channel, and duration. Playback happens inside YouTube’s embedded player on the host device only, where Google may collect viewing and device data under the Google Privacy Policy ↗. We do not receive YouTube account information.

We disclose information only as reasonably necessary to:

• OpenAI Sites and ChatGPT sign-in, plus infrastructure/service providers that host, authenticate, secure, route, store, and operate HackMusic.
• Spotify, when a track is validated or the host authorizes and controls playback.
• YouTube (Google), when a video link is validated and when the host page embeds YouTube’s player to play a submitted video. Google’s own cookies and data practices apply inside that embedded player.
• Other people in the same event room. Display names, cheers, tracks, event history, and scores may be visible as described in the interface; boo identities are hidden from participant views.
• Professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business transfer.

Service providers may process information in the United States or other locations where they operate, subject to their own safeguards and legal obligations.

Website analytics records older than 90 days are automatically deleted when analytics collection or owner reporting runs. The browser-tab analytics identifier ends with the tab session, and its server-side one-way form changes daily. Event records currently may remain in our hosted database until they are manually deleted, deleted during operational cleanup, or removed after a valid request. We do not promise a fixed automatic deletion date for event records. Spotify cookies expire as described above or can be removed by disconnecting or clearing site data. Host-handoff and move-to-another-device links are stored only as one-way hashes, work once, and expire after ten minutes.

We use reasonable measures such as HTTPS, randomized room and participant identifiers, salted passcode hashes, one-way hashes for short-lived host-handoff links, request throttling based on one-way network-derived keys, device-held host keys, encrypted HTTP-only Spotify cookies, limited data collection, and restricted host controls. No online service is perfectly secure. Keep room links, passcodes, and host-handoff links private, do not reuse sensitive information as a display name, and protect the host device.

Depending on where you live, you may have rights to know or access personal data, correct it, delete it, receive a portable copy, withdraw consent, or appeal a decision about a request. New Jersey residents may exercise applicable rights under New Jersey law. Because we do not sell personal data or use it for targeted advertising or legally significant profiling, there is no sale or targeted-advertising opt-out to process. You can prevent our first-party analytics collection by enabling Do Not Track or Global Privacy Control in a supporting browser.

Email hackmusic.fun@gmail.com with the room code, approximate event date, display name, requested action, and enough information to verify the request without sending unnecessary sensitive data. Use “Privacy Appeal” in the subject line to appeal a response. We may retain limited information when legally required or necessary for security and dispute handling.

HackMusic is a general-audience service and is not directed to children under 13. Children under 13 may not submit information to HackMusic. If you are under the age of legal majority where you live, use HackMusic only with permission and supervision from a parent, guardian, or event organizer.

If you believe a child under 13 provided information, email hackmusic.fun@gmail.com so we can investigate and delete it where appropriate.

Third-party services—including Spotify, YouTube (Google), OpenAI Sites, infrastructure providers, browsers, networks, and connected speakers—are governed by their own terms and privacy practices. We do not control their independent collection, availability, security, policy changes, outages, or acts and omissions.

Links to third-party sites are provided for convenience and do not make HackMusic responsible for those sites. This policy covers only information controlled by HackMusic.

We may update this policy as the service or law changes. The updated date at the top shows the latest revision. Material changes may also be highlighted on the website where practical.

Questions, corrections, deletion requests, or complaints: hackmusic.fun@gmail.com.