Privacy policy

GuessTheSong (guessthesong.gg) is a non-commercial hobby project run by an individual living in France. This person is the controller of your data under the General Data Protection Regulation (GDPR).

For any question about your data, write to [email protected].

Your account

• Your email address.
• Your password, only in hashed form: we never know it in plain text.
• If you choose "Continue with Google": your Google account identifier, your name and the link to your Google profile picture, as Google sends them to us, along with the sign-in tokens provided by Google. We never receive your Google password.
• Your username and, if you add one, your avatar. Our server crops and converts the image, which removes its metadata (for example the GPS location of a photo).

Your games

• Your daily challenge results, your streaks and your stats.
• Your matches (scores, placements, results), your ranked rating and your season rewards.
• Challenges you send to or receive from other players.
• The playlists you import: the playlist link, its title and cover, the list of tracks found in our catalogue and the titles of tracks that were not found.

Your username, your avatar, your stats and your leaderboard position are visible to other players.

Chat. Chat messages (matches and party rooms) are not saved in our database. The server only keeps the last 50 messages of each room in memory, for at most one hour after the last message, so that context can be attached to a report. A filter automatically masks some swear words; the original text stays visible to moderators.

Reports, moderation and blocks. When you report a player, we save the report (who reported whom, the reason, any details you add, the match concerned) together with that player's latest messages you received in that room (20 at most). We also keep moderation decisions and the list of players you have blocked.

Technical data

• Your IP address, used to limit the number of requests and protect the service against abuse. Anti-abuse counters stay in memory and are not saved.
• Your sign-in session, saved with the IP address and browser type used to sign in.
• Technical server logs, which contain IP addresses and requested pages, for security and troubleshooting.

We do not ask for your real name, your date of birth, your postal address or any payment details.

• Voice chat is peer to peer (WebRTC): audio goes directly from one browser to another, without passing through our servers. We do not listen to it and never record it.
• Our server only relays the technical messages that let browsers connect to each other (signaling), never the audio.
• To set up the connection, your browser contacts a STUN server (by default, Google's public STUN server), which sees your IP address. Because the connection is peer to peer, the other players in the voice room can also technically see your IP address.
• The microphone is only used if you join voice and allow it in your browser. You can withdraw this permission at any time in your browser settings. Voice is entirely optional.

We only use cookies that are strictly necessary for the site to work. There are no advertising cookies, no analytics tools and no third-party trackers. That is why you do not see a cookie banner.

• Session cookie: keeps you signed in to your account. It goes away when you sign out or when the session expires.
• Guest cookie: a random identifier that lets you play the daily challenge without an account and pick up your game again. It lasts one year.
• Language cookie: remembers the language you chose. It lasts one year.
• Browser local storage: your daily challenge progress and your favorite match filters. This data stays on your device.

Cloudflare, which protects the site, may set its own technical security cookies, for example to filter out bots.

The GDPR requires a legal basis for each use of your data. Here are ours:

• Performance of a contract (our terms of use): creating and managing your account, running the game, your stats, matches, leaderboards and playlists, and sending you the essential emails (verifying your address, resetting your password).
• Our legitimate interest: keeping the service secure, limiting abuse, handling reports, moderating and making backups.
• Your consent: microphone access for voice chat, which your browser asks you for, and signing in with Google, which is your choice.

We do not send promotional emails. We do no profiling and make no automated decisions that significantly affect you.

We rely on a few service providers, who process data on our behalf and only for this service:

• Amazon Web Services: hosting of the site, the database and the backups, in France (Paris region).
• Cloudflare: domain name, content delivery network, proxy and security. All site traffic goes through Cloudflare, which therefore sees your IP address.
• Resend: sending address verification and password reset emails. Resend receives your email address and the content of these emails.
• Google: only if you choose "Continue with Google", and for the voice chat STUN server described above.
• Deezer: our server fetches music previews and track information from Deezer. No data about you is sent.
• Spotify and YouTube: when you import a playlist, our server only sends the public link of that playlist to their API.

Some album and playlist covers are loaded by your browser directly from the image servers of Deezer, Spotify or YouTube. As with any image on the web, these servers then see your IP address.

Cloudflare, Resend and Google are American companies. The resulting data transfers outside the European Union are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

We never sell, rent or share your data for advertising.

• Account and game data: until your account is deleted.
• Backups: the database is backed up every day and each backup is erased after 30 days at most. Deleted data therefore also disappears from backups within that time.
• Chat messages: in memory only, for at most one hour after the last message in the room, and erased whenever the server restarts.
• Reports and moderation decisions: as long as needed for moderation, for example to spot repeat offenders, and at the latest until the account concerned is deleted.
• Sign-in session: until you sign out or it expires.
• Technical logs: 30 days at most.

There is no button to delete your account in the app yet. To delete it, write to [email protected] from your account's email address. We handle it within 30 days and all data linked to the account is erased.

You have the following rights over your data:

• Access: find out what data we hold about you and get a copy.
• Rectification: correct inaccurate data. You can change your username and avatar yourself in the settings.
• Erasure: have your account and your data deleted.
• Portability: receive your data in a machine-readable format.
• Objection and restriction: object to processing based on our legitimate interest, or ask for it to be restricted.
• Withdrawing consent: at any time, for example by turning off microphone access.

To exercise these rights, write to [email protected], preferably from your account's email address so we can check that it is really you. We reply within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr.

You must be at least 15 years old to create an account. Under 15, you need the consent of a parent or another holder of parental authority.

If we learn that an account was created by a child under 15 without that consent, we delete it. A parent can contact us at [email protected].

The site is only available over HTTPS. Passwords are hashed, the database is not exposed to the internet, our servers can only be reached through Cloudflare and backups are stored encrypted. No system is flawless, but we do our best to protect your data.

We may update this policy as the service evolves. The date at the top of the page shows the latest version. If there is an important change, we will let you know in the app or by email.