App

Privacy Policy

Effective date: August 17, 2026

1. About This Service

MUSIXQUARE is an independently operated, non-commercial browser service for real-time audio synchronization and shared playback. It is provided free of charge. Google sign-in is optional, and the service can still be used without creating an account.

MUSIXQUARE does not require legal names, postal addresses, phone numbers, Google account passwords, or payment information. Limited account, technical, and session data is processed only when needed to provide, secure, and improve the service.

2. Data We Process

Room and connection data
Room codes, optional room passwords, temporary device or peer identifiers, coarse device-platform categories (such as iOS, Android, Windows, macOS, Linux, or other), IP and WebRTC connection information, connection status, and related signaling data may be processed to create and maintain rooms and manage individual active device connections.
Ordinary-room session content
In ordinary rooms, device names, chat messages, playback commands, playlist state, and local session content are ordinarily transmitted over peer-to-peer WebRTC connections and are not retained as chat or playback history in a central MUSIXQUARE database. Where a direct connection is unavailable, WebRTC traffic may pass through Cloudflare TURN relay infrastructure, but MUSIXQUARE still does not retain that relayed chat or playback content as room history. MUSIXQUARE's signaling service temporarily stores limited room, membership, authentication, and reconnection state needed to operate and secure the live room.
PRO-room session state
PRO rooms use server-authoritative Cloudflare storage and may persist room-session identifiers, nicknames and roles, coarse device-platform data, playlist metadata, playback and queue state, upload metadata, and short-lived command, idempotency, and rate-limit records. PRO-room chat messages and notices pass through MUSIXQUARE signaling but are not retained as room chat history. Moderation state and short-lived AI BOT correlation records may be stored.
Optional account data
If you choose Google sign-in, Google provides an OpenID identifier and a verified-email claim. MUSIXQUARE uses that claim only to require a Google-verified account and does not store the email address. It stores a random account ID, an HMAC-pseudonymized form of Google's subject identifier, your chosen nickname, profile status, account-session timestamps, and the cumulative totals shown in the account menu: sessions joined, seconds listened, and tracks played. These totals do not include room codes, track titles, event timestamps, or per-session or per-track history. Google tokens, your email address, Google name, and profile photo are not stored. Sign-in uses a Secure, HttpOnly cookie, and the database stores only a keyed digest of the random session token.
PRO grants and voucher redemption
Operator-run PRO campaigns and voucher redemption may process the random account ID; campaign, batch, voucher, grant, allocation, entitlement, and redemption identifiers; the assigned room code and generation; status and timestamps; and operator or audit identifiers. MUSIXQUARE stores a keyed digest of each one-time voucher code rather than the plaintext code. These records are used to enforce one-time redemption and per-account limits, allocate the correct room, recover a partially completed operation, prevent replay, and audit security-sensitive changes.
Room identity
In account-aware rooms, a signed-in user is represented by a room-scoped member identifier and nickname rather than a Google identifier or email address. Multiple devices signed in to the same account may be grouped as one room member. Other participants may see the nickname, member number, connected-device count, room role, and, for each active connection, a coarse platform label and shortened room-session identifier. The shortened identifier is derived from a temporary connection ID; it is not a hardware serial number, advertising ID, or persistent device fingerprint. Each device's connection and audio output remain separate.
AI BOT beta requests
When a participant uses /bot in a PRO room, MUSIXQUARE sends the command text, the minimum playlist metadata needed to carry it out, and, when search is needed, a short search summary to the Google Gemini API. The command is also displayed in room chat and can be seen by the other room participants. It does not automatically attach media bytes or stored media URLs, the room's full chat history, room PINs or API keys, or participant lists. Anything entered directly in the command, including a URL, is part of the command text sent to Gemini, so users should not enter secrets or other sensitive information. Gemini produces a one-shot action plan, and MUSIXQUARE validates every proposed action against a fixed allowlist before execution.
System audio
System audio may use direct WebRTC or Cloudflare Realtime for live delivery. A share is limited to four connected devices and two hours. MUSIXQUARE does not intentionally record or store this audio.
Ordinary-room file data
Ordinary-room files are usually transferred directly when participants are on the same network. For remote participants or in large rooms, files are temporarily kept in private Cloudflare R2 storage and made available only to room participants with temporary download authorization. These objects are automatically deleted within an intended maximum of 24 hours.
PRO-room media
In a PRO room, original media uploaded by an authorized room participant is stored persistently in a private Cloudflare R2 bucket for the room playlist. The ordinary room's 24-hour retention limit does not apply. File name, title, artist, thumbnail, media type, size, content hash, uploader relationship, and upload state may also be stored as room metadata. Downloads are issued only through short-lived authorized URLs.
Operational and security records
MUSIXQUARE may store PRO-room registry and grant-ledger data, operator labels, administrator audit records, aggregate reliability metrics, Developer API key digests, scopes and usage timestamps, and deletion-security records. Operator labels should not be used to enter personal or sensitive information.
Cloudflare data stores
Cloudflare D1 databases hold optional-account and authentication records, aggregate service metrics, administrator audit, PRO-room registry and grant records, and Developer API records. Durable Objects hold live ordinary-room and PRO-room state plus service-control, quota, and rate-limit state. R2 holds temporary ordinary-room remote-share objects, persistent PRO-room media, and mirrored Soro featured images. Workers KV holds a backup copy of the public Soro RSS feed; it is not used for room messages or media.
Cookies and browser storage
Optional account sign-in and its temporary Google OAuth flow use Secure, HttpOnly, SameSite=Lax cookies. PRO rooms use room-specific Secure, HttpOnly, SameSite=Strict cookies for the room session and owner-recovery credential. Browser localStorage and sessionStorage hold non-credential preferences and limited browser coordination data, such as language, theme, audio and synchronization settings, account-refresh signals, and short-lived return-route, reconnection, update, or activity state. OAuth codes and state, Google tokens, room passwords, and PRO claim or recovery credentials are not copied into Web Storage. The service worker uses CacheStorage for app assets and offline navigation responses; API responses, local media, and navigations containing sensitive query parameters are excluded.
Operational logs
Sampled, credential-free custom Cloudflare Worker logs are enabled for service health, failures, abuse prevention, and security operations. Automatic invocation logs that include request URLs and automatic Worker traces are disabled for all six Worker deployments; not every deployment has a public route. Application logging does not include raw request URLs, query strings, credentials, cookies, or authorization headers. MUSIXQUARE does not configure a separate retention period for the sampled custom logs in application code; Cloudflare account settings and provider policies govern their retention.
YouTube data
YouTube search terms are sent through the MUSIXQUARE service to the YouTube Data API. Video identifiers, playback requests, and player interactions may be processed by YouTube or Google when YouTube features are used.
Website analytics
On selected standalone production pages, and only when the URL has no query string or fragment and the referrer exposes neither a query nor a six-digit room route, page paths, referrers, browser, operating system, device type, performance measurements, and approximate region may be processed through Cloudflare Web Analytics. The main MUSIXQUARE single-page app does not load Web Analytics, so room navigation and six-digit room routes are not measured. Cloudflare Web Analytics is cookie-free and is designed not to collect visitors' personal data.

3. Why We Process Data

Data is processed to provide optional sign-in, keep a chosen nickname, represent a person across their devices, establish and protect rooms, synchronize playback, deliver requested sharing features, issue and redeem operator-controlled PRO grants, show cumulative account activity totals, interpret individual AI BOT requests, diagnose failures, prevent abuse, and understand aggregate service reliability.

MUSIXQUARE does not access, analyze, or retain ordinary-room shared content except as technically necessary to provide the requested sharing feature.

MUSIXQUARE does not sell user data or use shared content for advertising or profiling.

4. Retention and Deletion

Ordinary-room live state is kept only as needed to operate and secure the room, subject to short authentication, security, and reconnection windows. Disconnecting a device does not necessarily delete that temporary state immediately.

Temporary download authorization for ordinary-room remote files normally expires after one hour. A bucket-level R2 lifecycle rule automatically deletes ordinary remote-share objects, with a maximum intended retention of 24 hours. Expired objects cannot be downloaded through MUSIXQUARE.

PRO-room media remains stored until its last playlist reference is removed and cleanup succeeds, or until the operator deletes the room data. If cleanup fails, deletion may be delayed until a retry succeeds.

PRO-room state and reconnectable room sessions may remain after a device disconnects so that the persistent room can continue operating. Administrator audit records and aggregate metrics follow their operational retention schedules. When a PRO-room incarnation is permanently deleted, minimal generation, allocation, and deletion tombstone records may be retained as permanent security boundaries so credentials from the deleted room cannot become valid in a later room that reuses the same public code.

PRO campaign, voucher, grant, allocation, entitlement, redemption, and grant-audit rows form the current retained acquisition and security ledger. Their status may change, but the schema does not delete the rows; grant audit and account-deletion fences are append-only. The internal account ID, room code and generation, keyed voucher digest, source identifiers, status, and timestamps may therefore remain after an account or room lifecycle change to prevent voucher replay and duplicate allocation and to preserve the audit trail. Plaintext voucher codes are never stored.

A PRO-room browser session and its room-session record expire no later than 30 days after issuance under the current service configuration. The separate owner-recovery cookie may remain in that browser for up to 400 days unless it is cleared, replaced, or invalidated earlier. Clearing a browser cookie ends that browser's stored access but does not itself delete the persistent room or its media.

An account record remains until the account is deleted. Each account session expires no later than 30 days after it is created and ends earlier after sign-out or account deletion. Temporary sign-in-flow records expire after about 10 minutes. After account deletion, one-way digests of the deleted browser sessions may remain for up to 10 minutes only to remove account-linked authority from active ordinary rooms; they cannot sign in or restore the deleted account. Account-linked permissions in an ordinary room last only while that room exists. Signed-in PRO-room membership and authority may remain until the room owner revokes them, the room is deleted, or the account is deleted.

Once deletion is accepted, sign-in ends and MUSIXQUARE removes, or schedules removal of, the account profile, cumulative account activity totals, account sessions, and that account's membership and account-linked authority, including a linked owner association, from PRO rooms. If cleanup fails before deletion is accepted, the account remains active and deletion can be retried. If linked-room cleanup cannot finish after deletion is accepted, sign-in remains disabled and MUSIXQUARE retries automatically; the remaining account record and cumulative totals are removed after cleanup finishes. Account deletion does not decommission a PRO room or invalidate its separate room-recovery credential, and it does not automatically delete media already shared in that room. The media follows the room's retention rules. Account deletion does not erase the retained PRO grant/security ledger described above; an internal account ID retained there cannot be used to sign in. Provider-managed point-in-time recovery data may remain for the applicable backup-retention period.

Short-lived rate-limit records used to protect Remote Share, signaling connection opens, and paid-provider API access use derived one-way identifiers and fixed-window counters rather than raw IP addresses as their Durable Object names. Remote Share uses a keyed pseudonym and a window of about one hour; the current signaling and paid-API counters use one-minute windows. The stored counter is scheduled for removal after its window ends.

Infrastructure providers may retain limited security and operational metadata under their own service settings and policies.

5. Service Providers and International Processing

MUSIXQUARE uses Cloudflare for website delivery, signaling, relay services, remote system audio, temporary private remote-file delivery, persistent private PRO-room media storage, security, and aggregate web analytics. Cloudflare may process technical data in the countries and regions where its network and service providers operate. See the Cloudflare Privacy Policy.

MUSIXQUARE's public blog is sourced from Soro. Featured images are served through MUSIXQUARE, but images embedded in article bodies may load directly from Soro or Supabase-hosted domains. When such an image loads, the image host may receive the visitor's IP address, browser and request metadata, access time, and MUSIXQUARE's origin as referrer, subject to its own policies.

YouTube features use YouTube API Services and the YouTube embedded player. Their use is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Optional sign-in uses Google OpenID Connect and requests only the openid and email scopes. The email claim is checked but not retained, and the Google subject identifier is HMAC-pseudonymized before storage. Google sign-in access can be reviewed at Google Security Settings. Revoking Google access does not by itself delete the MUSIXQUARE account; use the account menu in MUSIXQUARE to do that.

The AI BOT beta in PRO rooms uses the Google Gemini API to interpret commands using only the limited request data described above. Google's processing is also subject to the Google Privacy Policy.

6. Security

MUSIXQUARE uses HTTPS, WebRTC transport security, browser security controls, restricted service capabilities, and Cloudflare infrastructure. Ordinary remote-share files are kept temporarily in private storage and made downloadable only with participant-bound temporary authorization. Persistent PRO-room media is kept in a separate private bucket and made downloadable only through short-lived authorized URLs.

No internet service can guarantee absolute security. Users should share room codes and passwords only with people they trust and should not share content they are not authorized to distribute.

7. Your Choices and Requests

Sign-in is optional. From the account menu, a signed-in user can change their nickname, sign out, or delete the active MUSIXQUARE account. You can stop processing live session data by leaving or closing a room. Cookies, localStorage, sessionStorage, and cached app data can be cleared through your browser settings. Clearing browser storage does not delete an optional account, a persistent PRO room, or media already stored for that room; use the in-app account and room controls for those actions.

For privacy questions, access or deletion requests, or concerns about the handling of data, contact contact@musixquare.com. Requests will be reviewed and addressed where technically and legally applicable.

8. Changes

This policy may be updated when MUSIXQUARE's features, infrastructure, or legal obligations change. Material changes will be reflected by a new effective date and may also be announced through the website or app.