Privacy Policy
Last updated: June 17, 2026
1. Who We Are
Mixtuby (mixtuby.com) is a free web application that lets you create and play YouTube music playlists. The service is operated from Romania.
2. Information We Collect
Account data (if you register): email address, name (optional), and profile picture (if using Google Sign-In).
Usage data: playlists you create, app settings, and preferences.
Lyric search queries: when you use "Find a Song by Lyrics", the text you enter is processed to find a matching song — including, if needed, by the third-party services listed in section 6 — and cached on our servers for up to 24 hours to speed up repeat searches. We do not link these queries to your account.
Cross-device playback state (if you are logged in): to let you resume listening on another device, we store the currently playing YouTube video, its playback position (in seconds), your playback queue (up to 50 track references), an optional playlist name/icon, and a device label we derive from your browser's user-agent (for example "iPhone", "Mac", or "Windows" — we do not store the raw user-agent). We keep only the single most recent playback state per account (it is overwritten each time you play).
Analytics data (with your consent): Google Analytics 4 collects anonymized usage statistics such as pages visited, session duration, browser type, approximate location (country/city level), and device type. This data is processed by Google under their Privacy Policy.
Push notification data (only if you turn on App Notifications): to send the device a daily reminder when the app is closed, we store a push subscription that consists of the push service endpoint URL provided by your browser, two encryption keys (so only your device can read the message), a device label we derive from your browser's user-agent (for example "iPhone · Safari"), and the date of the last reminder sent. This subscription is anonymous by default and is linked to your account only if you are logged in. We never put personal content in the notification — only a generic "your daily mix is ready" message. Turning the toggle off deletes the subscription immediately.
3. Legal Basis for Processing (GDPR)
We process your data under the following legal bases:
- Contract performance — to provide your account, sync playlists, and resume playback across your devices
- Consent — for analytics cookies (Google Analytics 4), which you accept or decline via the cookie banner, and for App Notifications, which are off by default and which you can withdraw anytime by turning the toggle off.
- Legitimate interest — for essential session cookies and security (rate limiting)
4. Cookies & Local Storage
Essential cookies (always active):
_mixmusic_session— Rails session cookie for authenticationremember_user_token— keeps you signed in across visits (sliding, up to ~1 year)
Analytics cookies (require consent):
_ga,_ga_*— Google Analytics 4 (loaded only after you click "Accept")
Third-party cookies:
- YouTube embedded player may set cookies when you play a video. These are governed by Google's Privacy Policy.
- YouTube may set advertising cookies (e.g., for ad personalization, frequency capping, view counting). Mixtuby does not control these — they are managed by Google.
Local storage (not cookies, no consent needed):
mixtuby-theme— your dark/light theme preferencemixtuby-settings— player settings (crossfade, speed, etc.)mixtuby-cookie-consent— your cookie consent choicepwa_installed— PWA installation statemixtuby-layout-*— your grid/carousel layout preference for playlists
5. How We Use Your Information
- Provide and maintain your account
- Sync your playlists across devices
- Send password reset emails when requested
- Understand how the service is used (analytics, only with consent)
- Protect the service from abuse (rate limiting)
6. Third-Party Services
- YouTube Embedded Player — streams content directly from YouTube. We do not download or store any audio/video.
- Google OAuth 2.0 — optional sign-in method. We receive your email and profile picture.
- Google Analytics 4 — anonymized usage analytics (only with your consent).
- Genius (lyric search) — when you use "Find a Song by Lyrics" and the song isn't already in our catalog, the text you type is sent to the Genius API to identify the song. Only your search text is sent; we receive back the song title, artist, and thumbnail. We do not request or store full lyrics. Governed by Genius's Privacy Policy.
- Mixtuby AI lyric assistant (powered by OpenAI) — if Genius and our catalog cannot identify your song, the words you type in "Find a Song by Lyrics" are sent to OpenAI (US-based) to suggest up to three songs you may mean. Only your typed text is sent — no account data, email, or identifiers. We do not use your input to train AI models, and we do not store it beyond the 24-hour query cache described above. Governed by OpenAI's Privacy Policy.
- Browser push services (Apple, Google, Mozilla) — when you enable App Notifications, your daily reminder is delivered through the push service built into your browser/operating system (Apple Push Notification service, Google FCM, or Mozilla autopush, depending on your device). This is an inherent part of the Web Push standard; the message contains only the generic reminder text and no personal data.
6.5. Workout Mode & Health Data (Premium)
If you subscribe to the optional Workout Mode, Mixtuby may collect and store the following health-related data that you choose to enter:
- Fitness profile — sex, age, height, weight, training goals, equipment access, weekly schedule
- Workout history — completed sets, reps, exercises, dates, AI coach interactions
- Weight log — optional dated body-weight entries you record after workouts
- Cycle tracking (optional, for users who enable it) — last period start date, cycle length, period length, daily logs (flow, mood, energy, symptoms, notes)
How we treat this data:
- Stored encrypted in our PostgreSQL database (Render.com, EU-based)
- Never sold, shared, or used for advertising — period
- Not shared with employers, insurers, partners, or third parties
- Used only to power your AI coach (Coach Vince) and your personal calendar
- You can delete all of it anytime via Profile Settings → Delete Account
Cycle data is NOT medical-grade. Mixtuby is not a contraception, fertility planning, or medical diagnostic tool. See Terms of Service §7.5 for full disclaimer.
7. Data Sharing
We do not sell, trade, or share your personal information with third parties. We may disclose information only if required by law.
8. Data Retention
- Account data — kept until you delete your account
- Session cookies — the session cookie expires when you close your browser; the persistent login token lasts up to ~1 year and renews while you stay active
- Cross-device playback state — only the latest state is kept (overwritten on each play); deleted with your account, or on request at privacy@mixtuby.com
- Push subscription — kept while App Notifications is on; deleted immediately when you turn the toggle off, and otherwise with your account or on request at privacy@mixtuby.com
- Workout & health data — fitness profile, workout history, weight and cycle logs are kept until you delete your account, or on request at privacy@mixtuby.com
- Analytics data — retained by Google for 14 months, then auto-deleted
- Shared mixes — kept until deleted by creator or 90 days if anonymous
- Lyric search queries — cached up to 24 hours, then auto-deleted
9. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access — request a copy of your personal data
- Rectification — update or correct your information
- Erasure — delete your account and all associated data (via Profile Settings)
- Withdraw consent — decline analytics cookies at any time (clear localStorage or use browser settings)
- Data portability — export your playlists
- Lodge a complaint — with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro
10. Children's Privacy
Mixtuby is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use after changes constitutes acceptance.
12. Contact
For privacy-related questions or to exercise your rights, contact us at privacy@mixtuby.com