Privacy Policy

HackMusic is a small, experimental web service operated from New Jersey, United States. In this policy, “HackMusic,” “we,” “us,” and “our” refer to the operator of hackmusic.fun.

This policy applies to the HackMusic website, temporary event rooms, host controls, and related support communications. It does not replace the privacy policies of Spotify, OpenAI, or other services you choose to use with HackMusic.

Information you provide

• Event names and participant display names.
• Spotify track links and the resulting track title, artist, duration, and Spotify track identifier.
• Cheers, boos, queue choices, scores, and other event actions.
• Your email address and message if you contact us directly.

Information created while the service runs

• Random room, participant, submission, reaction, activity, and host-control identifiers.
• Event status, queue order, timestamps, reaction history, and final scores.
• Basic request and security information that our hosting and network providers may process, such as IP address, browser/device details, request logs, and error information.
• For the owner-only admin page, the ChatGPT account identifier and email forwarded by OpenAI Sites are used at request time to authenticate the owner and enforce the email allowlist. HackMusic does not add them to the event database.

We do not ask for a HackMusic account, legal name, postal address, phone number, or payment information during normal play.

We use information only to provide and protect the service: create and operate rooms, remember participants and the host device, validate Spotify tracks, control authorized playback, calculate scores, display event history, authenticate the owner-only administration page, prevent abuse, diagnose failures, answer support requests, and comply with law.

We do not sell personal data. We do not use event data for targeted advertising, cross-site behavioral profiling, credit decisions, employment decisions, or other legally significant automated decisions.

HackMusic uses only storage that is required to make the requested features work. We do not use advertising cookies, analytics cookies, tracking pixels, or cross-site marketing cookies.

• Spotify OAuth cookie: a short-lived, HTTP-only cookie keeps the Spotify sign-in request secure for about 10 minutes.
• Spotify session cookie: an HTTP-only, secure cookie keeps the host’s authorized Spotify connection available for up to 30 days, or until the host disconnects it. It contains Spotify access credentials and required connection details and is not available to page scripts.
• Local browser storage: participant IDs, host keys, hosted-room shortcuts, room names and statuses, recent access times, and the host’s public Spotify Client ID are stored on that device so the browser can recognize its room role and help the host reopen recent events. This hosted-room history stays in that browser and is not a separate server-side profile. Clearing site data removes it and may lock that browser out of host controls.
• Infrastructure storage: OpenAI Sites and its infrastructure providers may use strictly necessary security, routing, authentication, load-balancing, or fraud-prevention technologies.

You can clear cookies and local storage through your browser. Blocking necessary storage may prevent room recognition, host access, or Spotify playback.

A host may voluntarily connect a Spotify Premium account using Spotify’s authorization screen. HackMusic requests the permissions needed for streaming, account eligibility, playback state, and playback control. We use the resulting authorization to run the shared speaker and do not intentionally display or store the host’s Spotify email or private profile information in the HackMusic event database.

Spotify controls its own service and data practices. Review the Spotify Privacy Policy ↗. Disconnecting Spotify from the host page removes HackMusic’s Spotify cookies on that device; you can also revoke access from your Spotify account settings.

We disclose information only as reasonably necessary to:

• OpenAI Sites and ChatGPT sign-in, plus infrastructure/service providers that host, authenticate, secure, route, store, and operate HackMusic.
• Spotify, when a track is validated or the host authorizes and controls playback.
• Other people in the same event room. Display names, cheers, tracks, event history, and scores may be visible as described in the interface; boo identities are hidden from participant views.
• Professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business transfer.

Service providers may process information in the United States or other locations where they operate, subject to their own safeguards and legal obligations.

Event records currently may remain in our hosted database until they are manually deleted, deleted during operational cleanup, or removed after a valid request. We do not promise a fixed automatic deletion date. Spotify cookies expire as described above or can be removed by disconnecting or clearing site data.

We use reasonable measures such as HTTPS, randomized room/participant identifiers, device-held host keys, HTTP-only Spotify cookies, limited data collection, and restricted host controls. No online service is perfectly secure. Keep room links private, do not reuse sensitive information as a display name, and protect the host device.

Depending on where you live, you may have rights to know or access personal data, correct it, delete it, receive a portable copy, withdraw consent, or appeal a decision about a request. New Jersey residents may exercise applicable rights under New Jersey law. Because we do not sell personal data or use it for targeted advertising or legally significant profiling, there is no sale or targeted-advertising opt-out to process.

Email hackmusic.fun@gmail.com with the room code, approximate event date, display name, requested action, and enough information to verify the request without sending unnecessary sensitive data. Use “Privacy Appeal” in the subject line to appeal a response. We may retain limited information when legally required or necessary for security and dispute handling.

HackMusic is a general-audience service and is not directed to children under 13. Children under 13 may not submit information to HackMusic. If you are under the age of legal majority where you live, use HackMusic only with permission and supervision from a parent, guardian, or event organizer.

If you believe a child under 13 provided information, email hackmusic.fun@gmail.com so we can investigate and delete it where appropriate.

Third-party services—including Spotify, OpenAI Sites, infrastructure providers, browsers, networks, and connected speakers—are governed by their own terms and privacy practices. We do not control their independent collection, availability, security, policy changes, outages, or acts and omissions.

Links to third-party sites are provided for convenience and do not make HackMusic responsible for those sites. This policy covers only information controlled by HackMusic.

We may update this policy as the service or law changes. The updated date at the top shows the latest revision. Material changes may also be highlighted on the website where practical.

Questions, corrections, deletion requests, or complaints: hackmusic.fun@gmail.com.