Privacy Policy

When you sign in with Google, the Service requests the following information through Google OAuth 2.0:

• Basic profile: your Google account email address, display name, and profile picture URL. These identify you inside the Service UI only.
• YouTube Data: read-only access to your YouTube playlists (titles, thumbnails, item counts, video IDs). The Service never modifies your YouTube account; changes such as making a private playlist unlisted or public must be performed by you directly on YouTube.

No other Google services, Drive files, contacts, or personal content are accessed.

• To display your playlist library so you can pick a playlist to open in the 3D carousel.
• To load the songs of a selected playlist and render them as album-cover cards.
• To keep your session alive via a short-lived access token and, if available, refresh it transparently.

We do not use your data for advertising, profiling, training AI models, or any purpose other than operating the Service for you.

• No server database. The Service does not maintain a user database. Profile and playlist data are fetched on demand from Google and discarded when your browser tab closes or your session expires.
• Session cookie. An encrypted, HTTP-only session cookie (issued by NextAuth) stores your OAuth access and refresh tokens for the duration of your session. This cookie lives only in your browser and is cleared when you sign out.
• Hosting logs. Our hosting provider (Vercel) may record transient request metadata (IP, user agent, timestamp) for operational and security purposes. These logs are managed by Vercel and are not used by us for tracking.

We do not sell, rent, or disclose your data to third parties. The Service interacts with two third-party platforms strictly to deliver its features:

• Google / YouTube — for OAuth sign-in and the YouTube Data API. Governed by the Google Privacy Policy.
• Vercel— for web hosting. Governed by the Vercel Privacy Policy.

The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to render the in-app carousel and the associated listening rooms. It is read-only and never sold, transferred for advertising, or used to train generalized AI models.

• Sign out at any time from the playlist picker page. Signing out immediately invalidates the session cookie.
• Revoke access entirely at Google Account → Security → Third-party apps. This removes the Service's access to your Google account and invalidates any stored tokens.
• Data requests. Because we do not store personal data server-side, there is nothing for us to export or delete on our side; revoking access fully removes our ability to fetch your data.

The Service is not directed at children under 13 and we do not knowingly collect information from children.

We may update this Privacy Policy as the Service evolves. Meaningful changes will be reflected in the “Last updated” date above.

Questions about this Privacy Policy can be sent to undefined0307@gmail.com.