Privacy Policy
Last updated: July 29, 2026
1. Who We Are
Mixtuby (mixtuby.com) is a free web application that lets you create and play YouTube music playlists. The service is operated from Romania.
2. Information We Collect
Account data (if you register): email address, name (optional), and profile picture (if using Google Sign-In).
Usage data: playlists you create, app settings, and preferences.
Lyric search queries: when you use "Find a Song by Lyrics", the text you enter is processed to find a matching song — including, if needed, by the third-party services listed in section 6 — and cached on our servers for up to 24 hours to speed up repeat searches. We do not link these queries to your account.
Cross-device playback state (if you are logged in): to let you resume listening on another device, we store the currently playing YouTube video, its playback position (in seconds), your playback queue (up to 50 track references), an optional playlist name/icon, and a device label we derive from your browser's user-agent (for example "iPhone", "Mac", or "Windows" — we do not store the raw user-agent). We also store a random device identifier that your browser generates and keeps in its local storage — it contains no personal data and is not derived from your hardware; it exists only so each of your devices keeps its own place in the song instead of overwriting the others. We keep the most recent playback state per device (overwritten each time you play on that device), so that opening Mixtuby on your laptop can offer you the spot you left on your phone.
Screen-lock PIN (only if you set one): the optional 4-digit Screen Lock (Child Lock) is available to signed-in users. We store your PIN on our servers only as a one-way bcrypt hash (we cannot read the digits); it follows your account so you can unlock on any device. You can always change your PIN from Player Settings; tapping "Forgot?" on the lock screen signs you out so you can set a new PIN after signing back in.
Analytics data (with your consent): Google Analytics 4 collects anonymized usage statistics such as pages visited, session duration, browser type, approximate location (country/city level), and device type. This data is processed by Google under their Privacy Policy.
Push notification data (only if you turn on a reminder): to send your device reminders when the app is closed, we store a push subscription that consists of the push service endpoint URL provided by your browser, two encryption keys (so only your device can read the message), a device label we derive from your browser's user-agent (for example "iPhone · Safari"), and your device's time zone (for example "Europe/Bucharest"). We obtain the time zone from your browser's locale settings only — we do not use GPS, location permissions, or your IP for this. For each reminder you switch on, we also store which reminder it is (for example "Daily Mix"), the time you chose, how often it should repeat (daily, every 3 days, weekly, or specific days you pick), and the date it was last sent — so it arrives at the right moment in your local time. For the Meditation reminder we also store which meditation session you chose it to open (for example "Body Scan" or "Sleep Wind-Down"), so the notification takes you straight there; it is a content preference, not a health assessment, and it is deleted when you turn that reminder off. This subscription is anonymous by default and is linked to your account only if you are logged in. Most reminders carry only a short generic message such as "your daily mix is ready"; the one exception is a to-do reminder you set yourself (below), whose notification shows the task's own text. Turning a reminder off unsubscribes that device immediately. The Pomodoro timer's optional end-of-phase alert is a different thing: your own browser shows it locally while Mixtuby is open, so it needs your notification permission but creates no push subscription and sends nothing to our servers.
Notes you write (ideas & to-dos): the sticky-note ideas and to-do items you create in the Notes panel. They stay in your browser's local storage unless you are logged in, in which case they sync across your devices, stored encrypted at rest. We never read or share them (limits: 100 ideas, 200 tasks).
To-do reminders (only if you set one): when you tap ⏰ on a task and pick a time, we store the task's text (up to 200 characters, encrypted at rest) and the reminder time, linked to your device's push subscription. This works without an account and is not tied to your account. The record is deleted as soon as the reminder is sent, or when you check off, delete, or clear the task; unsent reminders older than 24 hours are auto-deleted.
Focus timer stats (Pomodoro): the Pomodoro focus timer keeps a tally of your focus rounds — your current day streak, the date you last focused, rounds today, and your all-time rounds and minutes — plus a rolling count of rounds per day for the last 30 days, which draws the seven-day chart. Signed out, this stays in your browser's local storage. Signed in, it is saved with your account settings so your streak and your week survive a new device. It records only counts and dates — never what you were working on.
3. Legal Basis for Processing (GDPR)
We process your data under the following legal bases:
- Contract performance — to provide your account, sync playlists, resume playback across your devices, and carry your focus-timer streak between them
- Consent — for analytics cookies (Google Analytics 4), which you accept or decline via the cookie banner, and for notification reminders, which are off by default and which you can withdraw anytime by turning each reminder off.
- Legitimate interest — for essential session cookies and security (rate limiting)
4. Cookies & Local Storage
Essential cookies (always active):
_mixmusic_session— Rails session cookie for authenticationremember_user_token— keeps you signed in across visits (sliding, up to ~1 year)
Analytics cookies (require consent):
_ga,_ga_*— Google Analytics 4 (loaded only after you click "Accept")
Third-party cookies:
- YouTube embedded player may set cookies when you play a video. These are governed by Google's Privacy Policy.
- YouTube may set advertising cookies (e.g., for ad personalization, frequency capping, view counting). Mixtuby does not control these — they are managed by Google.
Local storage (not cookies, no consent needed):
mixtuby-theme— your dark/light theme preferencemixtuby-settings— player settings (crossfade, speed, etc.), your Pomodoro preferences (rhythm, custom durations, sound, auto-start, alerts), your Pomodoro focus tally (streak, totals, and rounds per day for the last 30 days), and your Meditation preferences and tally (guidance mode, background visuals, last session and length, day streak and minutes meditated) — the Meditation tally never leaves this devicemixtuby-cookie-consent— your cookie consent choicepwa_installed— PWA installation statemixtuby-layout-*— your grid/carousel layout preference for playlistsmixtuby-locked— whether the screen lock is currently engagedmixtuby-constellation-*— your Constellation game progress (mode, XP/rank, and which constellations you've discovered), stored only on this devicemixtuby-notes— your ideas & to-do items, cached on this device (synced to your account if signed in)mixtuby-notes-prefs— your Notes text settings (size, ink color, bold), stored only on this devicemixtuby-device-id— a random identifier for this browser, so cross-device resume can tell your devices apart (no personal data, not shared with anyone)mixtuby-session— the playlist, track and position you last played on this device, so the Continue card can offer it back
Plus small preference keys for individual tools (games, sleep tools, prompts you have dismissed) — all stored only on this device and never sent anywhere.
5. How We Use Your Information
- Provide and maintain your account
- Sync your playlists across devices
- Send password reset emails when requested
- Understand how the service is used (analytics, only with consent)
- Protect the service from abuse (rate limiting)
6. Third-Party Services
- YouTube Embedded Player — streams content directly from YouTube. We do not download or store any audio/video.
- Google OAuth 2.0 — optional sign-in method. We receive your email and profile picture.
- Google Analytics 4 — anonymized usage analytics (only with your consent).
- Genius (lyric search) — when you use "Find a Song by Lyrics" and the song isn't already in our catalog, the text you type is sent to the Genius API to identify the song. Only your search text is sent; we receive back the song title, artist, and thumbnail. We do not request or store full lyrics. Governed by Genius's Privacy Policy.
- Mixtuby AI lyric assistant (powered by OpenAI) — if Genius and our catalog cannot identify your song, the words you type in "Find a Song by Lyrics" are sent to OpenAI (US-based) to suggest up to three songs you may mean. Only your typed text is sent — no account data, email, or identifiers. We do not use your input to train AI models, and we do not store it beyond the 24-hour query cache described above. Governed by OpenAI's Privacy Policy.
- Browser push services (Apple, Google, Mozilla) — when you enable a reminder, it is delivered through the push service built into your browser/operating system (Apple Push Notification service, Google FCM, or Mozilla autopush, depending on your device). This is an inherent part of the Web Push standard; the message contains only the reminder text — which for a to-do reminder is the task text you wrote, and for all other reminders is a short generic message.
6.5. Workout Mode & Health Data (Premium)
If you subscribe to the optional Workout Mode, Mixtuby may collect and store the following health-related data that you choose to enter:
- Fitness profile — sex, age, height, weight, training goals, equipment access, weekly schedule
- Workout history — completed sets, reps, exercises, dates, AI coach interactions
- Weight log — optional dated body-weight entries you record after workouts
- Cycle tracking (optional, for users who enable it) — last period start date, cycle length, period length, daily logs (flow, mood, energy, symptoms, notes)
How we treat this data:
- Stored encrypted in our PostgreSQL database (Render.com, EU-based)
- Never sold, shared, or used for advertising — period
- Not shared with employers, insurers, partners, or third parties
- Used only to power your AI coach (Coach Vince) and your personal calendar
- You can delete all of it anytime via Profile Settings → Delete Account
Cycle data is NOT medical-grade. Mixtuby is not a contraception, fertility planning, or medical diagnostic tool. See Terms of Service §7.5 for full disclaimer.
7. Data Sharing
We do not sell, trade, or share your personal information with third parties. We may disclose information only if required by law.
8. Data Retention
- Account data — kept until you delete your account
- Session cookies — the session cookie expires when you close your browser; the persistent login token lasts up to ~1 year and renews while you stay active
- Cross-device playback state — the latest state is kept per device (overwritten on each play on that device); deleted with your account, or on request at privacy@mixtuby.com
- Push subscription & reminder schedule — kept while a reminder is on; deleted when you turn off the reminder (the schedule goes with it), and otherwise with your account or on request at privacy@mixtuby.com
- Notes (ideas & to-dos) — kept until you delete them or delete your account
- Focus timer stats (Pomodoro) — kept in your account settings until you delete your account, or on request at privacy@mixtuby.com; the per-day counts roll off automatically after 30 days. The copy on your device is cleared when you clear your browser storage
- To-do reminders — deleted when sent or when you cancel the task; unsent reminders are auto-deleted after 24 hours
- Screen-lock PIN — the bcrypt PIN hash is kept until you change or remove it (Player Settings) or delete your account
- Workout & health data — fitness profile, workout history, weight and cycle logs are kept until you delete your account, or on request at privacy@mixtuby.com
- Analytics data — retained by Google for 14 months, then auto-deleted
- Shared mixes — kept until deleted by creator or 90 days if anonymous
- Lyric search queries — cached up to 24 hours, then auto-deleted
9. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access — request a copy of your personal data
- Rectification — update or correct your information
- Erasure — delete your account and all associated data (via Profile Settings)
- Withdraw consent — decline analytics cookies at any time (clear localStorage or use browser settings)
- Data portability — export your playlists
- Lodge a complaint — with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro
10. Children's Privacy
Mixtuby is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use after changes constitutes acceptance.
12. Contact
For privacy-related questions or to exercise your rights, contact us at privacy@mixtuby.com