Privacy policy
Last updated October 3, 2026
Jukebox (jukebox.rocks) lets a host share their Spotify playback with guests, who pick songs from a playlist the host chose. It's run by Santiago Hernández, who is responsible for the personal data described here. Questions or requests: privacy@jukebox.rocks.
What we collect, and why
- Your Google account, when you sign in. Google shares your name, email address, profile picture and account id with our authentication provider (Supabase), which keeps them to sign you in. Jukebox itself uses only two of them: your name, to show the host who picked a song, and your account id, to keep your tokens and your requests apart from everyone else's. It doesn't use your email address or show your picture. You can look at a jukebox without signing in; you only need to sign in to queue a song or claim tokens.
- Your Spotify account, if you host a jukebox. Your Spotify account id and the access tokens Spotify issues when you connect. We use them only to read your playlists and what's playing, and to queue, play, pause and skip songs on your own account. They're never shown to anyone, including you. We also keep the name you give your jukebox and which of your playlists is active.
- Your requests and tokens. Which songs you queued (title and artist) at which jukebox, when, and the name you had at the time, plus every token you spent, received or got back. The host sees who picked each recent song. This history is what the song cooldown and your token balance are calculated from.
- Technical data. Your IP address is used to limit how often sign-in and token links can be tried, and is written to our logs when you hit that limit. Our hosting provider also records each request (IP address, browser, the page requested, time), and our own logs can include your account id next to what happened, such as a refunded token. We use logs only to keep the service running and secure. Supabase keeps its own logs of sign-ins.
We don't sell your data, show ads, or use analytics or tracking of any kind.
Cookies
One cookie keeps you signed in; it lasts seven days from your last visit. Two more exist for a few minutes each, while you sign in or connect Spotify, to make sure the response comes back to the browser that asked for it. There are no other cookies.
Who else handles it
- Supabase stores the data above and runs sign-in (servers in London, UK).
- Google Cloud hosts the app and its logs (Belgium, EU).
- Google handles Google sign-in, and serves the fonts these pages load, so your browser contacts Google Fonts when a page opens.
- Spotify plays the music, and serves the album artwork your browser loads.
- Cloudflare provides DNS for jukebox.rocks and forwards email sent to our address.
How long we keep it
Your account, requests and token history are kept until your account is deleted. Your requests and tokens at a jukebox also go if its host deletes their account. Logs are deleted by our hosting provider after 30 days. To delete your account, email us; there's no button for it yet. Everything tied to it goes with it: your jukebox, your Spotify connection, your requests and your tokens.
Your rights
You can ask to see the data we hold about you, correct it, delete it, or get a copy, and you can object to how we use it. Write to privacy@jukebox.rocks and we'll answer within a month. You can also complain to your local data protection authority. Jukebox isn't meant for children under 16.
Changes
If this policy changes, this page changes with it, and the date at the top says when.