Privacy

The short version

• Your songs, lyrics, comments and messages are yours. I don't sell them, and I don't use them to train AI.
• None of it is visible to the public internet. You have to be signed in, and a group's work only opens for members of that group.
• Traffic runs over HTTPS.
• Chat messages are stored encrypted. Songs, lyrics and comments are not.
• I can read anything in the database, chat included. I don't go looking.
• You can download everything or delete your account from settings.

What I store

• Your account: email address, display name, @handle, a hashed password, when you joined, and whether you've verified your email. Your bio and music links if you fill them in. Your passkeys if you add them, including which kind of device made each one.
• What you post: song titles, lyrics, the "about this song" text, your audio (both the file you gave me and a converted copy for playback), comments, and chat messages.
• Some activity: which songs you've played, where you'd read up to in a chat, your notifications, and your signed-in sessions.
• If you manage a group: the prompts you write, and the email addresses you invite.
• Server logs: one line per request with a request id, your user id, the method and path, the response code, and how long it took. No IP addresses and no browser fingerprints. When something breaks in your browser, the site sends me the error message, the script and line, and the page path with the query string stripped off.

Why I store it

To run the thing you signed up for: hold your account, show your work to your group, and send the handful of emails the site needs to send. Beyond that, to keep it working and safe, which means fixing bugs from logs and rate-limiting sign-in attempts so nobody can hammer the login page.

There's no advertising here, no profiling, and nothing automated making decisions about you.

What's encrypted (and what isn't)

• In transit: everything, over HTTPS.
• Your password: stored as an argon2id hash. I never see the password itself, and I can't recover it for you.
• Chat messages: encrypted (AES-256-GCM) before they're written to the database. The key lives in the server's configuration, not in the database, so a stolen copy of the database alone doesn't read them.
• Songs, lyrics, descriptions and comments: not separately scrambled. They sit in the database as text, and your audio sits as ordinary files, because the site has to hand them to your group on request.
• Sign-in, verification and password-reset links: only a hash of each is stored, so the database never holds a working link. Group invite links are the exception: those are stored as they are, so treat an invite link like a password.

Who can see it

• Your group: members of a group can see that group's songs, lyrics, comments and chat. Someone who isn't a member gets a "not found" page, so they can't even confirm a song exists.
• Other members you share a group with: your profile, bio and links, and the songs of yours in groups you share. Each song shows how many comments it has and how many times it's been played in total. Nobody is shown who played a song, though in a group of four a total is a decent hint.
• Your group's managers: the member list, and the email addresses that group has invited. Managers can remove a message or a comment.
• Me: everything, including chat, which the site decrypts for me the same way it does for you. That's how I fix problems and step in if someone's being awful. I don't read your group's chat for entertainment.
• Nobody else: there's no analytics, no advertising network, and no third-party script on any page. The site's content-security policy blocks outside scripts outright, so a tracker can't sneak in.

Group chat

• It's members only, and messages are encrypted at rest.
• Managers and I can moderate it.
• Editing a message overwrites it; there's no history.
• Deleting a message replaces it with "[message removed]" for everyone. The row stays in the database until you delete your account.
• The page shows the most recent 200 messages. Older ones stay in the database.

It is not end-to-end encrypted. The server holds the key and can read your messages, which is what makes moderation and a working web page possible. Real end-to-end encryption in a browser, where I ship you the code on every visit, would be a weaker promise than it sounds. So: private to your group, unreadable from a stolen database, readable by me.

Chat here is for talking about the songs. If you want a conversation nobody can read but the people in it, have it on Signal instead. That's not me dodging the job, it's just what the right tool looks like.

How long things stay

• Sessions: 30 days. Expired ones are deleted every hour.
• Email links: verification links last 24 hours, password resets 1 hour.
• Deleting a comment or a chat message hides it behind a "removed" marker but keeps the row. It's hidden, not erased.
• Deleting a song removes the song, both audio files, its comments and its play records for good.
• Deleting your account removes your account, your songs and audio, your chat messages, your play history, your sessions and your passkeys. Your comments on other people's songs are emptied and left as anonymous "[deleted]" markers so the replies underneath still make sense. A few things outlive you with your name taken off them: prompts you wrote as a manager, groups you created, and invite records, which include the email addresses you invited.
• Everything else (songs, comments, notifications, play records) has no expiry date. It stays until you delete it.
• Backups: the database is copied to storage I run myself so the site can be restored if the server dies. A deletion reaches those copies as they roll over rather than instantly.

Where it goes

• The site and your audio live on hardware I own and administer. Your audio is on my own object storage, not a cloud provider's.
• Email is the one thing that leaves: verification, password-reset and invite emails go out through Proton Mail, which sees the address and the message. The emails are plain text with a link in them, no tracking pixels.
• That's the whole list. Nothing is sold, shared, or handed to anyone else, and I'd only ever hand something over if the law actually made me.

Cookies

• One cookie keeps you signed in for 30 days.
• One more lasts 5 minutes while you sign in with a passkey.
• No tracking cookies, and none belonging to anyone else.
• Your browser also keeps a small cache of pages you've already viewed so going back is instant, and remembers your place in a track while the tab is open. Both are on your device, not mine.

That's why there's no cookie banner here. The rules require asking permission for cookies that aren't strictly necessary, which in practice means advertising and analytics. Both of mine exist to keep you signed in, so there's nothing to ask you about.

Your choices

• Download everything: a zip with your profile, your songs (lyrics, and the original audio you uploaded), your comments, your play history and your group memberships.
• Edit or delete any song from its page, and any comment you've left.
• Change your name, handle, bio, links or password in settings. Changing your email address isn't self-service yet, so email me and I'll do it.
• Delete your account whenever you like. The page tells you exactly what goes.
• You also have the right to ask for a copy of your data, to have it corrected or deleted, and to object to how I'm using it. Email me at jack@moo.media and I'll sort it. If I don't, you can complain to the Data Protection Commission, the Irish regulator, at dataprotection.ie.