Privacy Policy

1. Who we are

SyncWave is a web app to listen to music together in sync. Its owner is responsible for your personal data (the "controller") under the General Data Protection Regulation (GDPR) and Spanish data protection law. You can reach us at sergiotrabajo33@gmail.com.

2. What data we process

If you use SyncWave without an account

• An anonymous session ID, created when you open a room, so the room knows you are you.
• The name others see in the room: a random one, or the one you choose.
• Your presence in a room: when you joined and when you were last active.
• What you do in a room: songs you add, skip votes and the chat messages you send.

If you create an account

• Your email and password, if you sign up with email. The password is stored encrypted by our authentication provider; we never see it.
• Your name, email and photo from Google, if you sign in with Google.
• Your public profile: display name, photo, bio, social links and name colour. Anyone can see it at your profile page.
• Your saved playlists and the rooms you keep open.
• Invitations: your invitation code, who you invited or who invited you, and the time spent in rooms with other people, which decides the rewards.

If you connect YouTube

When you sign in with Google you can let SyncWave read your YouTube account (read-only, the youtube.readonly permission) to import your playlists. We only read your playlists and their videos when you import one, and we keep the access tokens to do so until you disconnect YouTube in Settings > Connections or revoke access in Google. We do not read anything else and never publish anything on your behalf.

If you pay for a plan

Stripe processes your payment and card details; we never see or store your card. We keep your Stripe customer and subscription references, your plan, its status and its billing dates.

Technical data

• Your IP address, held briefly in memory to limit abuse (for example, too many rooms in a minute). We do not store it.
• Error reports when something fails (see Sentry below).
• Visit statistics: the pages visited, where the visit came from, country, browser and device type. Vercel Web Analytics counts them without cookies, with a code computed from the request that it discards after 24 hours, so we only see totals that cannot be linked to you.

3. Why we use it and on what legal basis

• To provide the service you ask for: rooms, sync, chat, your account, profile, playlists, paid plans and invitation rewards. Basis: performing our contract with you (Art. 6.1.b GDPR).
• To keep SyncWave secure and working: preventing abuse and fixing errors. Basis: our legitimate interest (Art. 6.1.f GDPR).
• To measure visits and know what to improve: our legitimate interest (Art. 6.1.f GDPR). The statistics do not identify you and are not used for advertising.
• To keep billing records: required by tax law (Art. 6.1.c GDPR).

We do not sell your data and we do not show ads.

4. How long we keep it

• Rooms, with their queue, chat and announcements: a free room is deleted when its host leaves, or within a day at most. A room kept open by a paid plan is deleted when that time runs out.
• Your presence in a room: removed when you leave, or after 90 seconds without activity.
• Account data: until you delete your account in Settings > Security. That deletes your profile, photo, playlists, connections and invitation data, and cancels your subscription. Chat messages you sent stay in their rooms as "[deleted]".
• Billing records: for as long as tax and commercial law requires.
• Error reports: for a limited time, then deleted by Sentry.

5. Who helps us process it

These providers process data on our behalf, only to provide their service to us:

• Supabase: database, accounts and real-time rooms, on servers in the EU.
• Vercel: hosting the app and visit statistics.
• Stripe: payments.
• Sentry: error monitoring. When something fails it receives technical details (the page, your browser and device type, and your account ID), never your name, email, cookies or messages.
• Google / YouTube: the music player, Google sign-in and, if you connect it, reading your YouTube playlists. See the Google Privacy Policy and the YouTube Terms of Service.

Some of them may process data outside the European Economic Area, such as in the United States. When that happens it is covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Your rights

You can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Write to sergiotrabajo33@gmail.com; we will answer within one month.

Most of it you can do yourself: edit your profile in Settings, disconnect YouTube in Settings > Connections and delete your account in Settings > Security.

If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Minors

To create an account you must be at least 14 years old. If you are younger, you need the consent of your parents or guardians.

8. Google API Services

SyncWave's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only request what the service needs: your basic profile to sign you in, and read-only access to YouTube to import your playlists.
• We do not sell your Google data or use it for advertising.
• We do not transfer it to third parties unless needed to provide the service, to comply with the law, or as part of a merger or acquisition with adequate protection.
• We do not use it for anything unrelated to SyncWave's features.

You can revoke SyncWave's access at any time in your Google Account permissions.

9. Cookies

Which cookies we use and what for: Cookie Policy.

10. Changes to this policy

If we change this policy we will update this page and its date. If the change is important, we will let you know in the app or by email before it applies.

11. Contact

Any question about your privacy: sergiotrabajo33@gmail.com.