Privacy Policy

1. Who We Are

Mixtuby (mixtuby.com) is a free web application that lets you create and play YouTube music playlists. The service is operated from Romania.

2. Information We Collect

Account data (if you register): email address, name (optional), and profile picture (if using Google Sign-In).

Usage data: playlists you create, app settings, and preferences.

Shared mixes (only when you tap Share): tapping Share on one of your saved playlists creates a page for it at a web address of its own, so that the people you send the link to can play it. We store the playlist's name and its list of YouTube video ids, and we count how many times the page has been played. The address contains a random suffix, so it cannot be guessed — but it is not password-protected either: anyone you give the link to, and anyone they pass it on to, can open it. We ask search engines not to index these pages, and we do not list them in our sitemap. A mix is deleted together with your account, or on request at [email protected]. If you never tap Share, no such page is created and your playlist stays in your account.

Party surprise links (only when you tap Send as a surprise): we store the message you type (up to 120 characters of free text, so whatever you write, a name included), the YouTube video id of the song, the show's settings, and how many times the link was opened. It is not tied to an account. Anyone with the link can open it; search engines are asked not to index it. It is kept until you ask us to delete it at [email protected].

Custom shelves (if you make one): you can arrange up to 5 shelves of your own on the home page. For each, we store on our servers a generated id, the name you type (up to 30 characters — free text, so it is whatever you choose to write), the icon you pick from a fixed set, and the list of catalogue playlists you ticked (up to 24). This is saved with your account settings so the shelves follow you to your other devices; it requires an account. We do not share them with anyone.

Vision Board (if you make one): we store your board with your account so it follows you to your other devices: the background, how photos are held, each item's position, size and angle, the words you type (up to 120 characters each — free text) and their colour, and which photo goes where (a library photo, a photo kept on your device, or a file in your Google Drive), the caption you give a photo (up to 40 characters), and — if you paste one — the web address of a picture. We never receive the photos themselves: photos from your phone stay in this browser's storage, and photos you put in Google Drive go from your browser straight to your own Drive (section 6).

Goals Journal (if you write one): the pages you write — title, why, steps, the "as if it already happened" text, deadline, priority, category, mood, pledge, the signature you draw, your dated journal entries, and which photo goes with the page (we never receive photos kept on your device). It is free text, so it holds whatever you choose to write, which may include your health or relationships. The pages sync to your account across your devices and are stored encrypted; we do not read, analyse or share them.

Lyric search queries: when you use "Find a Song by Lyrics", the text you enter is sent to the services listed in section 6 (OpenAI and Genius) to identify the song, and cached on our servers for up to 24 hours to speed up repeat searches. We do not link these queries to your account.

Playprint answers: the answers and optional note you give Playprint are used to build your album and sent to the service listed in section 6. The finished album is cached on our servers for up to 12 hours under a one-way fingerprint of the answers, so identical answers are served again without a new request. To keep the tool fair, we count how many albums each account (or, if you are not signed in, each IP address) builds per day; that count is deleted after about 25 hours. Your last 3 albums and the tracks you have already been served are kept only in this browser. Saving an album requires an account and stores it as a private playlist.

Cross-device playback state (if you are logged in): to let you resume listening on another device, we store the currently playing YouTube video, its playback position (in seconds), your playback queue (up to 50 track references), an optional playlist name/icon, and a device label we derive from your browser's user-agent (for example "iPhone", "Mac", or "Windows" — we do not store the raw user-agent). We also store a random device identifier that your browser generates and keeps in its local storage — it contains no personal data and is not derived from your hardware; it exists only so each of your devices keeps its own place in the song instead of overwriting the others. We keep the most recent playback state per device (overwritten each time you play on that device), so that opening Mixtuby on your laptop can offer you the spot you left on your phone.

Listening history (if you are logged in): we keep a list of your 200 most recent plays (the YouTube video, its title, when you played it and how far you got). We use it to show your history and to suggest music in "Picked for you". Older entries are deleted automatically as new ones arrive.

Approximate location inferred from your IP address (not stored): every request to Mixtuby passes through Cloudflare, our CDN, which adds an estimate of where your internet connection is: a two-letter country code and an approximate city, its coordinates and time zone. We use the country to open the "Top Music" chart card on your own country's chart, to point Amazon product links at your local Amazon store and to show temperatures in °F in the US, and the approximate place to show the weather in Nightstand (section 6). Your browser is not asked for your location. The estimate is used only while the request is served — it is not written to our database and not linked to your account. If you choose a different country yourself in the Top Music card, that choice is stored only in this browser and overrides the inferred one.

Server logs and performance reports: our host keeps standard server logs (IP address, requested page, browser) for up to 7 days, for security and debugging. When a page loads slowly, freezes or hits an error, your browser also sends a short technical report into the same logs: load times, the page address, which files loaded slowest, short error messages, the buttons that reacted slowly, your device's operating system and whether Mixtuby runs as an installed app. These logs are not linked to your account, set no cookie, and are used only to find and fix errors and slow loading.

Screen-lock PIN (only if you set one): the optional 4-digit Screen Lock (Child Lock) is available to signed-in users. We store your PIN on our servers only as a one-way bcrypt hash (we cannot read the digits); it follows your account so you can unlock on any device. You can always change your PIN from Player Settings; tapping "Forgot?" on the lock screen signs you out so you can set a new PIN after signing back in.

Analytics data (with your consent): Google Analytics 4 collects anonymized usage statistics such as pages visited, session duration, browser type, approximate location (country/city level), and device type. This data is processed by Google under their Privacy Policy.

Push notification data (only if you turn on a reminder): to send your device reminders when the app is closed, we store a push subscription that consists of the push service endpoint URL provided by your browser, two encryption keys (so only your device can read the message), a device label we derive from your browser's user-agent (for example "iPhone · Safari"), and your device's time zone (for example "Europe/Bucharest"). We obtain the time zone from your browser's locale settings only — we do not use GPS, location permissions, or your IP for this. For each reminder you switch on, we also store which reminder it is (for example "Daily Mix"), the time you chose, how often it should repeat (daily, every 3 days, weekly, or specific days you pick), and the date it was last sent — so it arrives at the right moment in your local time. For the Meditation reminder we also store which meditation session you chose it to open (for example "Body Scan" or "Sleep Wind-Down"), so the notification takes you straight there; it is a content preference, not a health assessment, and it is deleted when you turn that reminder off. This subscription is anonymous by default and is linked to your account only if you are logged in. Most reminders carry only a short generic message such as "your daily mix is ready"; the one exception is a to-do reminder you set yourself (below), whose notification shows the task's own text. Turning a reminder off unsubscribes that device immediately. The Pomodoro timer's optional end-of-phase alert is a different thing: your own browser shows it locally while Mixtuby is open, so it needs your notification permission but creates no push subscription and sends nothing to our servers.

Notes you write (ideas & to-dos): the sticky-note ideas and to-do items you create in the Notes panel. They stay in your browser's local storage unless you are logged in, in which case they sync across your devices, stored encrypted at rest. We never read or share them (limits: 100 ideas, 200 tasks).

Reminders (only if you set one): when you tap ⏰ on a task, or turn on a trip reminder in Flight Buddy, we store the reminder time and its short text (the task, or the city you fly to; encrypted at rest), linked to your device's push subscription. This works without an account and is not tied to your account. The record is deleted as soon as the reminder is sent, or when you check off, delete, or clear the task; unsent reminders older than 24 hours are auto-deleted.

Focus timer stats (Pomodoro): the Pomodoro focus timer keeps a tally of your focus rounds — your current day streak, the date you last focused, rounds today, and your all-time rounds and minutes — plus a rolling count of rounds per day for the last 30 days, which draws the seven-day chart. Signed out, this stays in your browser's local storage. Signed in, it is saved with your account settings so your streak and your week survive a new device. It records only counts and dates — never what you were working on. The Rubber Duck keeps a similar tally — how many bugs you marked "Found it!", in total and today — on this device when signed out, and with your account settings when signed in.

Location in Drive and Run (only while the tool is open): Drive uses your device's GPS position, with your browser's permission, to show the map, your speed and the local speed limit, and (in Run) your distance, pace and path. Mixtuby's servers never receive or store your location, your destination, your stops or your route; stops you add on the way and the run's path are kept only in the page's memory and are discarded when you leave. The last 20 destinations you pick under Where to? (the place's name and its coordinates), the places you save as Home and Work (name and coordinates), and, after a drive of at least about 300 m, the position where you stopped (its coordinates and the time, so Drive can show where you parked) are kept in this browser's storage on your device; they are never sent to Mixtuby. You can remove each one with its ✕ or by clearing your browser data; the parking position is replaced by your next drive and ignored after 30 days. If you tap the share button next to the arrival time, your phone's own share sheet (or clipboard) receives a short message with the destination's name and your arrival time; Mixtuby sends nothing itself, and where it goes is up to you. If you tap Save run while signed in, we store only that run's start time, duration and distance on your account ("Your runs") — never its path or any position. You can delete any saved run under Your runs, and they are deleted with your account. A run saved while signed out waits on your device (browser storage) and is sent to your account after you sign in, or discarded if you choose "Not now". To work, your device sends your position directly to the map services in section 6, only while Drive is open and only for what you use: map tiles for the area you are in (and elevation tiles with the 3D view on); the road you are on, to show its speed limit; nearby fixed speed cameras, only if you turn on Speed camera alerts; and, when you search, the text you type, the destination and any stops you choose, and — if you look for places nearby (such as fuel, parking or food) — your position or the route ahead.

Microphone and flashlight in Party (only if you turn them on): if you set Party's Beat to Mic, your browser asks for the microphone, and the page listens to the sound in the room on your device to find the beat. The sound is analysed on your device only while the show runs; it is never recorded, stored or sent to Mixtuby or anyone else. On Android, if you tick "Flash the phone's light on the beat", your browser asks for the camera; the page uses it only to switch the light on and off and never reads an image. You can refuse either permission, or withdraw it at any time in your browser's settings.

3. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Contract performance — to provide your account, sync playlists, resume playback across your devices, and carry your focus-timer streak between them, keep your Vision Board and Goals Journal, keep the run history you choose to save (start time, duration, distance), keep your listening history and suggest music from it ("Picked for you"), and, when you start Drive, to send your position to the map services that draw the map, look up the speed limit and plan the route you ask for
• Consent — for analytics cookies (Google Analytics 4), which you accept or decline via the cookie banner, and for notification reminders, which are off by default and which you can withdraw anytime by turning each reminder off, and for Party's microphone and flashlight, which your browser asks you to allow.
• Legitimate interest — for essential session cookies, security (rate limiting), server logs and performance reports (to find and fix errors and slow loading), and showing regionally relevant content, such as your country's chart and the local weather (the approximate location Cloudflare derives from your IP address, used only while serving the request and not stored)
• Legitimate interest and legal obligation — for the donation records we receive from PayPal (section 6)
• Direct marketing (Art. 12(2) Law 506/2004) — for the single reminder email described in section 5; you can refuse it at sign-up, right after signing up with Google, or with the unsubscribe link in the email itself

4. Cookies & Local Storage

Essential cookies (always active):

• _mixmusic_session — Rails session cookie for authentication
• remember_user_token — keeps you signed in across visits (sliding, up to ~1 year)
• mixtuby_cookie_consent — remembers whether you accepted or declined cookies, so we don't ask again (kept for 1 year)

Analytics cookies (require consent):

• _ga, _ga_* — Google Analytics 4 (loaded only after you click "Accept")

Third-party cookies:

• The YouTube player is a third-party embed, so YouTube sets its own cookies as soon as it loads. We do not load it until either you accept cookies or you start a video yourself — until then the page only shows a still thumbnail image. These cookies are governed by Google's Privacy Policy.
• YouTube may set advertising cookies (e.g., for ad personalization, frequency capping, view counting). Mixtuby does not control these — they are managed by Google.
• Flight Buddy’s “Tickets in” a city is a Tiqets embed. Nothing from Tiqets loads until you open it; once open, Tiqets may set its own cookies, which Mixtuby does not control.
• Track thumbnails are still images served by Google (img.youtube.com and i.ytimg.com). Loading an image tells Google your IP address, but sets no cookie and stores nothing on your device.

Local storage (not cookies, no consent needed):

• mixtuby-theme — your dark/light theme preference
• mixtuby-settings — player settings (crossfade, speed, etc.), your Pomodoro preferences (rhythm, custom durations, sound, auto-start, alerts), your Pomodoro focus tally (streak, totals, and rounds per day for the last 30 days), and your Meditation preferences and tally (guidance mode, background visuals, last session and length, day streak and minutes meditated) — the Meditation tally is kept with your account if you are signed in — your Rubber Duck preferences and tally (which duck, colour, size, sound; bugs found in total and today) — and your Drive preferences (speed units, map marker, day/night map colours, route colour, mini-player visibility, 3D view on or off, speed camera alerts on or off) — and your Vision Board preferences (photo drift, word glow, game sounds) — and your Party preferences (level, screen text, text size and colour, light style, text motion, beat mode, flashlight on or off) — and your Breathe preferences (which drawing and how long a session lasts), stored only on this device
• mixtuby-cookie-consent — your cookie consent choice
• pwa_installed — PWA installation state
• mixtuby-layout-* — your grid/carousel layout preference for playlists
• mixtuby-curated-collapsed — whether you left the home-page shelves open or folded away
• mixtuby-shelves-hidden — which shelves you chose to hide from the home page
• mixtuby-shelves-shown — which shelves that start hidden (such as Cinema) you chose to show on the home page
• mixtuby-trending-region — the country you picked for the Top Music chart, so the card opens on it next time
• mixtuby-locked — whether the screen lock is currently engaged
• mixtuby-constellation-* — your Constellation game progress (mode, XP/rank, and which constellations you've discovered), stored only on this device
• mixtuby-notes — your ideas & to-do items, cached on this device (synced to your account if signed in)
• mixtuby-notes-prefs — your Notes text settings (size, ink color, bold), stored only on this device
• mixtuby-device-id — a random identifier for this browser, so cross-device resume can tell your devices apart (no personal data, not shared with anyone)
• mixtuby-session — the playlist, track and position you last played on this device, so the Continue card can offer it back
• mixtuby-cinema-* — your Cinema preferences (film size, hall lights, subtitle size, language and on/off) and whether you left the app mid-film, so the hall can reopen there; stored only on this device
• mixtuby-playprint-history / mixtuby-playprint-seen — your last 3 Playprint albums and up to 200 tracks already served, so new albums don't repeat them (the track list is sent with your next Playprint request; stored only on this device)
• mixtuby-pending-run — only if you tap Save run while signed out: that run's start time, duration and distance (never its path), kept on this device until you sign in — then sent to your account and removed — or until you discard it
• mixtuby-drive-recent — the last 20 destinations you picked in Drive (name and coordinates), shown as Recent places; stays on this device, never sent to Mixtuby
• mixtuby-drive-places — the places you saved as Home and Work in Drive (name and coordinates); stays on this device, never sent to Mixtuby
• mixtuby-drive-parked — where you stopped after your last drive (coordinates and time), shown as Your car; replaced by the next drive, ignored after 30 days, never sent to Mixtuby
• mixtuby-seen-new — which "NEW" badges this device has already opened
• mixtuby-recent-searches — your recent Quick Search queries, each with the thumbnail address of the video you played from it, so you can repeat a search; stored only on this device and never sent to our server
• mixtuby-autocomplete-height-v2 — the height you chose for the search results list
• mixtuby-tv-blocked — on Smart TVs only: up to 300 YouTube video ids that YouTube refused to play on this TV, so the player skips them next time; stored only on this device and never sent to our server
• mixtuby-reel-pos — in Reel only: where you stopped in up to 100 videos, so a clip resumes where you left it; stored only on this device and never sent to our server
• mixtuby-reel-learned — in Reel only: remembers that you have already swiped once, so the swipe hint shows less often; stored only on this device and never sent to our server
• mixtuby-reel-seen — in Reel only: the ids of up to 2,000 Funny Shorts already shown on this device, so unseen ones come first next time; stored only on this device and never sent to our server
• mixtuby-flight-buddy — your current trip in Flight Buddy (airports, date, take-off time, the flight you picked, bag, airline) and your packing list, including lines you type; stays on this device, except the destination city inside a reminder you turn on. The airports nearest you are worked out on this device, from the Home you saved in Drive or, when you tap 📍 Nearest airport, from your position, asked of your browser once; only the three airport codes and their distances are kept, never the position, and nothing is sent to Mixtuby
• mixtuby-flight-buddy-lang — the language you picked in Flight Buddy; stays on this device
• mixtuby-pocket-tools — your choices in Pocket Tools (the row you used last, the two currencies, metric or imperial), so they are there next time; the amounts you type are not kept; stays on this device and is never sent to Mixtuby
• mixtuby-pocket-tools-lang — the language you picked in Pocket Tools; stays on this device
• mixtuby-fx — the day’s reference exchange rates (European Central Bank and National Bank of Romania), kept so Pocket Tools works offline; contains nothing about you
• mixtuby-vision — your Vision Board: a copy of the board (synced to your account) and the photos you add from this device, which stay here and are never sent to Mixtuby
• mixtuby-vision-drive — only if you connect Google Drive: the id of your “Mixtuby Vision Board” folder; stays on this device
• mixtuby-goals — your Goals Journal pages, cached on this device (synced to your account); removed from this device when you sign out
• mixtuby-goals-prefs — how your Goals Journal looks: the font, cover, paper, ink, the name on the cover and the width; stored only on this device and never sent to our server
• mixtuby-boot-trail — session storage only: why the app just reloaded itself (for example after an update); read once by the next page for its performance report, then deleted

Plus small preference keys for individual tools (games, sleep tools, prompts you have dismissed) — all stored only on this device and never sent anywhere.

Changed your mind? Cookie settings — this forgets your current answer and brings the banner back so you can accept or decline again.

5. How We Use Your Information

• Provide and maintain your account
• Sync your playlists across devices
• Send account emails (sign-up confirmation, password reset) and, unless you opt out, one reminder email a few days after sign-up if you haven't come back, showing the last song you played, if any. At most one, ever; unsubscribe with the link in the email
• Send the newsletter, only if you subscribed to it and confirmed your address; every issue has an unsubscribe link
• Understand how the service is used (analytics, only with consent)
• Protect the service from abuse (rate limiting)

6. Third-Party Services

• YouTube API Services — Mixtuby uses YouTube API Services: the embedded player streams content directly from YouTube, and the YouTube Data API provides search results, playlist imports, trending charts and the Reel lists — World News, Funny and New Music (public video details such as titles, channels, thumbnails and durations). We do not download or store any audio/video; all views count on the creator's own channel. Your use of these features is also subject to the YouTube Terms of Service and the Google Privacy Policy.
• Google OAuth 2.0 — optional sign-in method. We receive your email and profile picture.
• Google Analytics 4 — anonymized usage analytics (only with your consent).
• Google Drive (Vision Board, optional) — if you connect it, your browser saves the photos you choose in a “Mixtuby Vision Board” folder in your own Google Drive and reads them back from there. Mixtuby can see only the files it created; the access token stays in your browser tab and never reaches our servers. Disconnecting revokes access. Mixtuby's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Pictures added by link (Vision Board) — a picture you add by its web address is loaded straight from the site that hosts it each time the board is shown, so that site sees your IP address and browser, as with any image on the web. Mixtuby keeps only the address.
• Resend (email delivery) — sends our emails (confirmation, password reset, the one reminder email, the newsletter confirmation); receives your email address and the message content. Governed by Resend's Privacy Policy.
• Honeybadger (error monitoring) — when something breaks on our server, a technical error report is sent to Honeybadger so we can fix it: the error, the page address and request details, which may include your IP address and browser. Governed by Honeybadger's Privacy Policy.
• Genius (lyric search) — the text you type in "Find a Song by Lyrics" may be sent to the Genius API to identify the song. Only your search text is sent; we receive back the song title, artist, and thumbnail. We do not request or store full lyrics. Governed by Genius's Privacy Policy.
• Mixtuby AI lyric assistant (powered by OpenAI) — the words you type in "Find a Song by Lyrics" are sent to OpenAI (US-based) to identify the song or suggest songs you may mean. Only your typed text is sent — no account data, email, or identifiers. We do not use your input to train AI models, and we do not store it beyond the 24-hour query cache described above. Governed by OpenAI's Privacy Policy.
• Playprint (powered by OpenAI) — when you build an album with Playprint, your answers (the age or decade you pick, genre and intensity, occasion or mood, company, time of day, album length) and the optional note you type in "Anything else?" (up to 300 characters) are sent to OpenAI (US-based) to choose playlists from our catalogue and name the album. No account data, email or identifiers are sent. Please do not include personal details in the note. We do not use your input to train AI models. Governed by OpenAI's Privacy Policy.
• "Picked for you" and "Similar" suggestions (powered by OpenAI) — to suggest searches in Quick Search, we send OpenAI (US-based) the day and time, a two-letter country code taken from your browser's language setting (for example "US" for en-US), and, if you are logged in, the titles of up to 10 recent plays and your 5 most-played artists. For "Similar" results we send only the text you searched. No email, account ID or other identifiers are sent. Suggestions are cached on our servers for about 35 minutes ("Similar": 24 hours, shared by everyone who searches the same text). We do not use your data to train AI models. Governed by OpenAI's Privacy Policy.
• Rubber Duck (powered by OpenAI) — so the duck can say a line that fits the moment, we send OpenAI (US-based) only rough categories: part of the day, how long the duck has been open, which of its five questions you reached, whether you tap calmly or fast, roughly how many bugs you found today, and whether you just found one. Nothing you type or say is sent (the duck has no text box and no microphone), and no account data, email or identifiers. Replies are cached on our servers for 24 hours, shared by everyone and not linked to you. We do not use this data to train AI models. Governed by OpenAI's Privacy Policy.
• Goals Journal "Fill the page with AI" (powered by OpenAI) — only when you tap it, we send OpenAI (US-based) the title of that page and the journal's language (English or Romanian), and nothing else from it — no account data, email or identifiers. The reply is a draft that fills only the empty fields of your page. We do not use this data to train AI models. Governed by OpenAI's Privacy Policy.
• Coach Vince (Workout Mode, powered by OpenAI) — to write your coach's messages we send OpenAI (US-based) your nickname, program, goal, progress in the program (day, streak, last workout, the set you just did) and, if you use them, your cycle phase and weight trend. No email, account ID or other identifiers are sent. We do not use this data to train AI models. Governed by OpenAI's Privacy Policy.
• Amazon Associates (affiliate links) — some pages show products on Amazon. As an Amazon Associate, Mixtuby earns from qualifying purchases. A product link passes through mixtuby.com/go/ and redirects to Amazon; Mixtuby does not link that click to your account; if you accepted analytics cookies, Google Analytics records that a product link was opened (the link address only). Once you are on Amazon, Amazon sets its own cookies to credit the referral, under Amazon's Privacy Notice.
• Travelpayouts partners (affiliate links) — in Flight Buddy, booking links (flights on Aviasales; airport transfers, car hire, luggage storage, city passes, data eSIMs, flight-delay claims and places to stay with other partners) pass through mixtuby.com/go/ and redirect to the partner through Travelpayouts. The flight link carries your trip's departure and arrival airport codes and travel date, so the search opens ready; the luggage-storage and city-pass links open the partner's page for the city you land in; the other links send nothing from your trip. With a date set, our server also asks Travelpayouts for recent flight prices on that route and day; only the two airport codes and the date are sent, with nothing that identifies you. Mixtuby does not link that click to your account. Once you are on the partner's site, the partner and Travelpayouts set their own cookies to credit the referral, under that partner's privacy policy (e.g. Aviasales' Privacy Policy).
• Tiqets (tickets for sights, Flight Buddy) — when you open “Tickets in” a city under When you land, Tiqets’ own ticket list loads inside the page from tiqets.com. Tiqets receives your IP address and browser, the city you land in and, if you search, the words you type; nothing is linked to your account. Buying happens on tiqets.com, and Mixtuby may earn a commission through Travelpayouts. Governed by Tiqets’ Privacy Policy.
• PayPal (donations) — donations are voluntary and handled entirely on PayPal's site; PayPal processes your payment details as an independent controller under PayPal's Privacy Statement. As the account holder, we receive from PayPal your name, email address, the amount and any note you choose to add, and use them only to keep a record of donations and to thank you. Recurring donations are managed and cancelled in your PayPal account.
• Browser push services (Apple, Google, Mozilla) — when you enable a reminder, it is delivered through the push service built into your browser/operating system (Apple Push Notification service, Google FCM, or Mozilla autopush, depending on your device). This is an inherent part of the Web Push standard; the message contains only the reminder text — which for a to-do reminder is the task text you wrote, and for all other reminders is a short generic message.
• Map services (Drive, Flight Buddy) — OpenFreeMap (map tiles), Overpass API at overpass-api.de and its public mirror overpass.private.coffee (speed limits, speed cameras and nearby places), Photon by komoot (place search), FOSSGIS e.V. routing at routing.openstreetmap.de (routes) and, with the 3D view on, the public AWS Terrain Tiles dataset on Amazon S3 (elevation tiles). They receive your IP address and the places described in section 2 — your position while Drive is open, your saved Home and the airport when Flight Buddy times your drive, and the place you type into Flight Buddy's search when no airport matches it — and handle it under their own policies. Map data © OpenStreetMap contributors.
• jsDelivr (CDN) — the map library (MapLibre GL) is loaded from cdn.jsdelivr.net the first time you start Drive and, when voice directions are on for a route, one file of direction phrases in your device's language; this gives that CDN your IP address and browser details. No location is sent.
• MET Norway (weather: Flight Buddy, Nightstand) — our server asks the Norwegian Meteorological Institute (api.met.no, Norway, within the EEA) for the forecast of a place: your trip's airports in Flight Buddy, and the approximate area you are in for Nightstand. MET Norway receives only that place's approximate coordinates, from our server — never your IP address, your account or any identifier. The forecast is kept in our server's cache for up to an hour, linked only to the place. Weather data by MET Norway, licensed under CC BY 4.0.

6.5. Workout Mode & Health Data (Premium)

If you subscribe to the optional Workout Mode, Mixtuby may collect and store the following health-related data that you choose to enter:

• Fitness profile — sex, age, height, weight, training goals, equipment access, weekly schedule
• Workout history — completed sets, reps, exercises, dates, AI coach interactions
• Weight log — optional dated body-weight entries you record after workouts
• Cycle tracking (optional, for users who enable it) — last period start date, cycle length, period length, daily logs (flow, mood, energy, symptoms, notes)
• Guided routines — what you mark as hurting and how a session felt are kept only on your device, in your browser's storage, and are not sent to us

How we treat this data:

• Stored encrypted in our PostgreSQL database (Render.com, EU-based)
• Never sold, shared, or used for advertising — period
• Not shared with employers, insurers or advertisers; the only service provider that receives part of it is OpenAI, to write your coach's messages (section 6)
• Used only to power your AI coach (Coach Vince) and your personal calendar
• You can delete all of it anytime via Profile Settings → Delete Account

Cycle data is NOT medical-grade. Mixtuby is not a contraception, fertility planning, or medical diagnostic tool. See Terms of Service §7.5 for full disclaimer.

7. Data Sharing

We do not sell, trade, or share your personal information with third parties. We may disclose information only if required by law.

8. Data Retention

• Account data — kept until you delete your account
• Email preferences — when you were offered the reminder email, whether it was sent, and the date you unsubscribed; kept until you delete your account
• Newsletter subscription — your email address, kept until you unsubscribe (the link in every issue deletes it)
• Session cookies — the session cookie expires when you close your browser; the persistent login token lasts up to ~1 year and renews while you stay active
• Cross-device playback state — the latest state is kept per device (overwritten on each play on that device); deleted with your account, or on request at [email protected]
• Push subscription & reminder schedule — kept while a reminder is on; deleted when you turn off the reminder (the schedule goes with it), and otherwise with your account or on request at [email protected]
• Notes (ideas & to-dos) — kept until you delete them or delete your account
• Custom shelves — kept in your account settings until you delete the shelf or delete your account, or on request at [email protected]
• Vision Board — kept with your account until you delete your account, or on request at [email protected]; photos on your device or in your Google Drive stay there until you delete them
• Goals Journal — each page is kept until you delete it or your account; a deleted page is emptied, and only an empty marker stays (so your other devices remove it too) until you delete your account
• Focus timer stats (Pomodoro) — kept in your account settings until you delete your account, or on request at [email protected]; the per-day counts roll off automatically after 30 days. The copy on your device is cleared when you clear your browser storage
• Rubber Duck — your bug tally is kept in your account settings until you delete your account, or on request at [email protected]; the duck's lines are cached for 24 hours, not linked to you
• Reminders — deleted when sent or when you cancel them (check off the task, turn the reminder off, or plan a new trip); unsent reminders are auto-deleted after 24 hours
• Screen-lock PIN — the bcrypt PIN hash is kept until you change or remove it (Player Settings) or delete your account
• Workout & health data — fitness profile, workout history, weight and cycle logs are kept until you delete your account, or on request at [email protected]
• Analytics data — retained by Google for 14 months, then auto-deleted
• Shared mixes — kept until deleted with your account or on request
• Party surprise links — kept until deleted on request
• Lyric search queries — cached up to 24 hours, then auto-deleted
• Playprint — built albums cached up to 12 hours; daily usage counters deleted after about 25 hours
• Drive & Run location — not stored by Mixtuby's servers; your position is held in your device's memory only while the tool is open, and the last 20 destinations you picked, your Home and Work places, and your last parking position stay in your browser's storage on this device until you remove them or clear your browser data (the parking position is replaced by your next drive and ignored after 30 days)
• Run history (start time, duration, distance of runs you chose to save) — until you delete the run or your account
• Listening history — your 200 most recent plays; older ones are deleted automatically, and all of it when you delete your account
• Donation records — kept in our PayPal account for as long as tax and accounting law requires, then deleted

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access — request a copy of your personal data
• Rectification — update or correct your information
• Erasure — delete your account and all associated data (via Profile Settings)
• Withdraw consent — change your cookie choice at any time with Cookie settings, which forgets your answer and shows the banner again
• Data portability — export your playlists; your saved runs are listed under Your runs in Drive, and a full copy of your data is available on request
• Lodge a complaint — with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro

10. Children's Privacy

Mixtuby is a general-audience service intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 — or under 16 where local law sets a higher age for consent to online services, as Romania and parts of the EU do. Accounts, notes, reminders and analytics are meant for adult users, and Mixtuby has no children's mode and no age verification. Some tools ask for an age as a music preference (for example Playprint, including a child's age for a birthday album). It is a number used only to choose music, is not linked to your identity, and is not stored with your account.

Mixtuby offers a "Kids & Cartoons" category of classic cartoon episodes. It exists for an adult who wants to put a cartoon on for a child in their care — it is one category among many, it requires no account, and it builds no profile of whoever is watching. The episodes are embedded from the rights holders' own YouTube channels; YouTube marks most of them "made for kids", and on such videos Google applies its own reduced data collection and does not serve personalised advertising. That treatment is controlled by Google, not by us.

If you believe a child has provided us with personal information, contact us at the address in section 12 and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use after changes constitutes acceptance.

12. Contact

For privacy-related questions or to exercise your rights, contact us at [email protected]