App

Privacy Policy

Effective date: August 1, 2026

1. About This Service

MUSIXQUARE is an independently operated, non-commercial browser service for real-time audio synchronization and shared playback. It is provided free of charge. Google sign-in is optional, and the service can still be used without creating an account.

MUSIXQUARE does not require legal names, postal addresses, phone numbers, Google account passwords, or payment information. Limited account, technical, and session data is processed only when needed to provide, secure, and improve the service.

2. Data We Process

Room and connection data
Room codes, optional room passwords, temporary device or peer identifiers, coarse device-platform categories (such as iOS, Android, Windows, macOS, Linux, or other), IP and WebRTC connection information, connection status, and related signaling data may be processed to create and maintain rooms and manage individual active device connections.
Ordinary-room session content
In ordinary rooms, device names, chat messages, playback commands, playlist state, and local session content are ordinarily transmitted over peer-to-peer WebRTC connections and are not retained as chat or playback history in a central MUSIXQUARE database. Where a direct connection is unavailable, WebRTC traffic may pass through Cloudflare TURN relay infrastructure, but MUSIXQUARE still does not retain that relayed chat or playback content as room history. MUSIXQUARE's signaling service temporarily stores limited room, membership, authentication, and reconnection state needed to operate and secure the live room.
PRO-room session state
PRO rooms use server-authoritative Cloudflare storage and may persist room-session identifiers, nicknames and roles, coarse device-platform data, playlist metadata, playback and queue state, upload metadata, and short-lived command, idempotency, and rate-limit records. PRO-room chat messages and notices pass through MUSIXQUARE signaling but are not retained as room chat history. Moderation state and short-lived AI BOT correlation records may be stored.
Optional account data
If you choose Google sign-in, Google provides an OpenID identifier and a verified-email claim. MUSIXQUARE uses that claim only to require a Google-verified account and does not store the email address. It stores a random account ID, an HMAC-pseudonymized form of Google's subject identifier, your chosen nickname, profile status, account-session timestamps, and the cumulative totals shown in the account menu: sessions joined, seconds listened, and tracks played. These totals do not include room codes, track titles, event timestamps, or per-session or per-track history. Google tokens, your email address, Google name, and profile photo are not stored. Sign-in uses a Secure, HttpOnly cookie, and the database stores only a keyed digest of the random session token.
Room identity
In account-aware rooms, a signed-in user is represented by a room-scoped member identifier and nickname rather than a Google identifier or email address. Multiple devices signed in to the same account may be grouped as one room member. Other participants may see the nickname, member number, connected-device count, room role, and, for each active connection, a coarse platform label and shortened room-session identifier. The shortened identifier is derived from a temporary connection ID; it is not a hardware serial number, advertising ID, or persistent device fingerprint. Each device's connection and audio output remain separate.
AI BOT beta requests
When a participant uses /bot in a PRO room, MUSIXQUARE sends the command text, the minimum playlist metadata needed to carry it out, and, when search is needed, a short search summary to the Google Gemini API. The command is also displayed in room chat and can be seen by the other room participants. It does not automatically attach media bytes or stored media URLs, the room's full chat history, room PINs or API keys, or participant lists. Anything entered directly in the command, including a URL, is part of the command text sent to Gemini, so users should not enter secrets or other sensitive information. Gemini produces a one-shot action plan, and MUSIXQUARE validates every proposed action against a fixed allowlist before execution.
System audio
System audio is usually exchanged directly when participants are on the same network, but it may be relayed through Cloudflare infrastructure for remote participants or in large rooms. MUSIXQUARE does not intentionally record or store this audio.
Ordinary-room file data
Ordinary-room files are usually transferred directly when participants are on the same network. For remote participants or in large rooms, files are temporarily kept in private Cloudflare R2 storage and made available only to room participants with temporary download authorization. These objects are automatically deleted within an intended maximum of 24 hours.
PRO-room media
In a PRO room, original media uploaded by an authorized room participant is stored persistently in a private Cloudflare R2 bucket for the room playlist. The ordinary room's 24-hour retention limit does not apply. File name, title, artist, thumbnail, media type, size, content hash, uploader relationship, and upload state may also be stored as room metadata. Downloads are issued only through short-lived authorized URLs.
Operational and security records
MUSIXQUARE may store PRO-room registry data and operator labels, administrator audit records, aggregate reliability metrics, Developer API key digests, scopes and usage timestamps, and deletion-security records. Operator labels should not be used to enter personal or sensitive information.
YouTube data
YouTube search terms are sent through the MUSIXQUARE service to the YouTube Data API. Video identifiers, playback requests, and player interactions may be processed by YouTube or Google when YouTube features are used.
Website analytics
Page paths, referrers, browser, operating system, device type, performance measurements, and approximate region may be processed through Cloudflare Web Analytics. Cloudflare Web Analytics is cookie-free and is designed not to collect visitors' personal data.

3. Why We Process Data

Data is processed to provide optional sign-in, keep a chosen nickname, represent a person across their devices, establish and protect rooms, synchronize playback, deliver requested sharing features, show cumulative account activity totals, interpret individual AI BOT requests, diagnose failures, prevent abuse, and understand aggregate service reliability.

MUSIXQUARE does not access, analyze, or retain ordinary-room shared content except as technically necessary to provide the requested sharing feature.

MUSIXQUARE does not sell user data or use shared content for advertising or profiling.

4. Retention and Deletion

Ordinary-room live state is kept only as needed to operate and secure the room, subject to short authentication, security, and reconnection windows. Disconnecting a device does not necessarily delete that temporary state immediately.

Temporary download authorization for ordinary-room remote files normally expires after one hour. A bucket-level R2 lifecycle rule automatically deletes ordinary remote-share objects, with a maximum intended retention of 24 hours. Expired objects cannot be downloaded through MUSIXQUARE.

PRO-room media remains stored until its last playlist reference is removed and cleanup succeeds, or until the operator deletes the room data. If cleanup fails, deletion may be delayed until a retry succeeds.

PRO-room state and reconnectable room sessions may remain after a device disconnects so that the persistent room can continue operating. Administrator audit records and aggregate metrics follow their operational retention schedules. When a PRO-room incarnation is permanently deleted, minimal generation, allocation, and deletion tombstone records may be retained as permanent security boundaries so credentials from the deleted room cannot become valid in a later room that reuses the same public code.

An account record remains until the account is deleted. Each account session expires no later than 30 days after it is created and ends earlier after sign-out or account deletion. Temporary sign-in-flow records expire after about 10 minutes. After account deletion, one-way digests of the deleted browser sessions may remain for up to 10 minutes only to remove account-linked authority from active ordinary rooms; they cannot sign in or restore the deleted account. Account-linked permissions in an ordinary room last only while that room exists. Signed-in PRO-room membership and authority may remain until the room owner revokes them, the room is deleted, or the account is deleted.

Deleting an account removes the active account profile, cumulative account activity totals, account sessions, and that account's membership and account-linked authority, including a linked owner association, from PRO rooms. If room cleanup is temporarily unavailable, the account is kept and deletion can be retried. Account deletion does not decommission a PRO room or invalidate its separate room-recovery credential, and it does not automatically delete media already shared in that room. The media follows the room's retention rules. Provider-managed point-in-time recovery data may remain for the applicable backup-retention period.

Short-lived rate-limit records used to prevent remote-share abuse identify an IP address with a keyed, one-way pseudonym rather than storing the raw address in the record key. These records normally expire after about one hour.

Infrastructure providers may retain limited security and operational metadata under their own service settings and policies.

5. Service Providers and International Processing

MUSIXQUARE uses Cloudflare for website delivery, signaling, relay services, remote system audio, temporary private remote-file delivery, persistent private PRO-room media storage, security, and aggregate web analytics. Cloudflare may process technical data in the countries and regions where its network and service providers operate.

YouTube features use YouTube API Services and the YouTube embedded player. Their use is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Optional sign-in uses Google OpenID Connect and requests only the openid and email scopes. The email claim is checked but not retained, and the Google subject identifier is HMAC-pseudonymized before storage. Google sign-in access can be reviewed at Google Security Settings. Revoking Google access does not by itself delete the MUSIXQUARE account; use the account menu in MUSIXQUARE to do that.

The AI BOT beta in PRO rooms uses the Google Gemini API to interpret commands using only the limited request data described above. Google's processing is also subject to the Google Privacy Policy.

6. Security

MUSIXQUARE uses HTTPS, WebRTC transport security, browser security controls, restricted service capabilities, and Cloudflare infrastructure. Ordinary remote-share files are kept temporarily in private storage and made downloadable only with participant-bound temporary authorization. Persistent PRO-room media is kept in a separate private bucket and made downloadable only through short-lived authorized URLs.

No internet service can guarantee absolute security. Users should share room codes and passwords only with people they trust and should not share content they are not authorized to distribute.

7. Your Choices and Requests

Sign-in is optional. From the account menu, a signed-in user can change their nickname, sign out, or delete the active MUSIXQUARE account. You can stop processing live session data by leaving or closing a room. Browser storage used for local preferences can be cleared through your browser settings.

For privacy questions, access or deletion requests, or concerns about the handling of data, contact contact@musixquare.com. Requests will be reviewed and addressed where technically and legally applicable.

8. Changes

This policy may be updated when MUSIXQUARE's features, infrastructure, or legal obligations change. Material changes will be reflected by a new effective date and may also be announced through the website or app.