Draft. This privacy policy is a draft. A lawyer must check it before Mixpoint is offered to the public. Items marked [TODO] are facts that are still missing.
Privacy
Privacy policy
Last updated: [TODO: date of publication]
The short version
- Your music stays on your computer. Mixpoint plays and analyzes your audio files in your browser. Audio files never go to our server.
- Your account syncs your work: your library's information, playlists, sets, cues, and analysis. We store it in the EU.
- We collect little: your email address, your sign-in sessions, and the technical data that we need to keep the service safe.
- No tracking. No advertising, no analytics, and no tracking cookies.
- You are in control. Delete your account in the app at any time. This deletes your synced data too.
Who is responsible
The controller of your personal data is the person or company in the imprint: [TODO: name and address].
Contact for privacy questions: [TODO: privacy@mixpoint.app or another address].
What stays on your computer
Mixpoint runs in your browser. The items below stay on your computer and never reach our server:
- Your audio files. Track uploads are switched off, so no audio leaves your computer.
- The folders and drives where your music is, and the file name and location of each track.
- The working copy of your library, which the app keeps in your browser's private storage.
What we collect, and why
| Data | Why we need it | Legal basis (GDPR) |
|---|---|---|
| Your email address | To make your account and to send you sign-in links. | Contract, art. 6(1)(b) |
| Sign-in links | A link works once and expires after 15 minutes. | Contract, art. 6(1)(b) |
| Sign-in sessions: a session token, the time of sign-in, your IP address, and your browser's name and version (user agent) | To keep you signed in on each device, and to let you see and sign out your devices. A session ends 90 days after you last used it. | Contract, art. 6(1)(b) |
| Passkeys, if you add one: the public key, a name, and the type of device | To sign you in without an email link. The private key and your fingerprint or face never leave your device. | Contract, art. 6(1)(b) |
| Your devices: a random device ID and the time of its last sync | To show your devices and their sync status. | Contract, art. 6(1)(b) |
| Your synced library: track information (such as title, artist, album, genre, BPM, key, and tags), analysis (beat grids, energy, key, vocals), waveforms, cues, playlists, sets, transitions, templates, and the history of your exports to your DJ software | To keep the same workspace on each device that you sign in on. | Contract, art. 6(1)(b) |
| Your IP address, in counts of sign-in attempts | To stop abuse: at most 5 sign-in links per 10 minutes from one IP address. | Legitimate interest in a secure service, art. 6(1)(f) |
| Server logs: requests and errors of the app and the server | To find and fix errors. Logs can contain your IP address, the address that your browser asked for, and your user agent. | Legitimate interest in a working service, art. 6(1)(f) |
We do not sell your data. We do not use it for advertising. We do not make automated decisions about you.
Where your data is stored
Your account and your synced data are stored with Cloudflare in the EU jurisdiction: the account database (Cloudflare D1), your own database for sync (a Cloudflare Durable Object), and file storage (Cloudflare R2). The EU jurisdiction keeps this data in data centers in the EU.
Who processes your data for us
We use these service providers (processors). Each one processes your data only on our instructions.
| Provider | What it does | Location |
|---|---|---|
| Cloudflare, Inc. | Hosts this website, the app, and the server. Stores your account and your synced data. Keeps the server logs (Cloudflare Workers Logs). Checks that a person, not a script, asks for a sign-in link (Cloudflare Turnstile): the sign-in form then sends signals from your browser to Cloudflare. | Data stored in the EU jurisdiction. Cloudflare is a US company. [TODO: confirm the data processing agreement and the transfer basis, such as the EU-US Data Privacy Framework or standard contractual clauses] |
| Resend (Plus Five Five, Inc.) | Sends the sign-in emails. It receives your email address and the sign-in link. | USA. [TODO: check the company name, the sending region, the data processing agreement, and the transfer basis] |
| Only if you choose Google sign-in: Google confirms who you are and gives us your email address and name. Google sign-in is not available yet. | [TODO: add when Google sign-in is available] |
Errors in the app and on the server go only to Cloudflare Workers Logs. We use no other error reporting service.
Cookies and tracking
- This website (mixpoint.app) sets no cookies and has no analytics.
- The app (studio.mixpoint.app) uses no cookies for tracking and no analytics. To keep you signed in, it stores a session token in your browser's private storage. This storage is necessary for the service, so it needs no consent.
- Fonts. This website and the app serve their own fonts. Your browser does not contact a font service.
How long we keep your data
- Your account and your synced data: until you delete your account.
- Sign-in links: they expire after 15 minutes, and work only once.
- Sessions: 90 days after you last used them, or until you sign out.
- Counts of sign-in attempts: for the length of the limit (10 minutes). [TODO: confirm when old rows are removed]
- Server logs: as long as Cloudflare Workers Logs keeps them. [TODO: confirm the retention for our plan; Cloudflare states 3 days on the Free plan and 7 days on the Paid plan]
Your rights
Under the GDPR, you have these rights:
- Access: ask which personal data we have about you, and get a copy.
- Correction: ask us to correct data that is wrong.
- Deletion: in the app, open the account dialog and click Delete my account. This deletes your account and all of its synced data from our server. The copy on your computer stays until you remove it from the app.
- Export (data portability): get your data in a common, machine-readable format. [TODO: describe how: a button in the app, or a request by email]
- Restriction and objection: ask us to limit how we use your data, or object to a use that is based on our legitimate interest.
To use a right, email us at [TODO: privacy contact address]. We answer within one month.
You can also complain to a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. You can also go to the authority of the EU country where you live.
Age
Mixpoint is for people aged 16 and over. [TODO: confirm the minimum age]
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use your data, we email you before it takes effect.