Who we are
Mixtape Maker (mixtape-maker.com) is a hobby project run by a single developer based in Belgium. For anything about your data, email contact@mixtape-maker.com. Under the GDPR the developer is the "data controller" for the information described below.
What we collect and why
You can use the mixtape editor and J-card designer without an account; then nothing is stored on our side and your work lives in your browser only (see "Data in your browser"). When you sign up we store:
| Data | Why |
|---|---|
| Email address and a hashed password | To sign you in and send account emails such as confirmation or password reset. If you use Google sign-in we get your email and Google account id instead of a password. |
| Profile: username, picture, bio, private setting | To show who made a mixtape and to give you a profile page. The username defaults to the part of your email before the @; you can change it. |
| Mixtapes, J-cards and uploaded images | So you can save your work to the cloud and reach it from other devices. Song data (titles, artists, album art links) comes from Spotify. |
| Feedback messages | If you use the Feedback button we keep your message, the page you sent it from and, only if you typed one, an email address to reply to. Signed-out visitors can send feedback anonymously. |
| Which announcement you dismissed | So the "What's new" popup stops showing once you click "Don't show again". |
| Support-prompt preferences | When the "Buy me a coffee" note was last shown, whether you muted it or the print checklist, and when you last clicked through — so we don't keep asking, on any of your devices. Nobody else can read these. |
| Timestamps | When your account and items were created or last changed, used for sorting and for the "Joined" date on your profile. |
We use this data only to run the site. We don't sell it, share it with advertisers, or build profiles of you for marketing. The legal basis is performing the service you asked for (your account) and our legitimate interest in keeping the site working and free of abuse (bot protection, rate limits, the language filter on public content).
What other people can see
Everything is private by default. Things become visible to anyone on the internet only when you choose:
- A mixtape you set to Public appears on the Explore page with your username next to it.
- A J-card you set to Public appears on your profile and on the page of the mixtape it is linked to.
- A mixtape you share by link is visible to anyone who has that link, even if it isn't public. Revoking the link stops that.
- Your profile page shows your username, picture, bio and public items. Set it to private on your profile page and visitors see only "This user has set their profile to private". Your username still appears next to public mixtapes.
Your email address is never shown to other users.
Services that process data for us
We don't run our own servers. These companies process data on our behalf and are bound by their own privacy terms and by data-processing agreements with us:
Your account, profile, mixtapes, J-cards, uploaded images and feedback are stored here. Supabase handles password hashing, email confirmation and login sessions.
Serves the website. Vercel Analytics counts page views without cookies; it records the page, referrer, country and device type, not who you are.
Search terms you type are forwarded to Spotify through our server. If you export a mixtape, you connect your own Spotify account; the access token is kept only in your browser and lets us create a playlist and set its cover image on your behalf.
If you choose "Sign in with Google", Google tells us your email address and account id. We do not receive your contacts, calendar or anything else.
A captcha that runs a Cloudflare script and sees your IP address and browser details to decide whether you are a human.
When something breaks, the error, the page you were on, your browser type and IP address are sent to Sentry so we can fix it. For sessions that hit an error, and a small sample of others, Sentry also records a replay of how the page was used: text is masked and images are blocked before anything leaves your browser, so we see layout and clicks, not what you typed or uploaded.
The button image in the footer is loaded from their servers, which see your IP address. Nothing is shared unless you click through and donate on their site.
Fonts are served from our own site, not from Google. Some of the providers above are based in the United States; where data leaves the EU it is covered by the EU-US Data Privacy Framework or standard contractual clauses.
Data kept in your browser
The site stores some things in your browser's local storage so you don't lose work. None of it is used to track you across other sites, and we don't use advertising or tracking cookies, so there is no cookie banner.
- The mixtape and J-card you're currently working on, plus J-cards you haven't uploaded.
- Your login session token, so you stay signed in.
- Your Spotify access token if you connected Spotify for playlist export. It is never sent to our server.
- Small flags such as "feedback sent recently", "notification closed in this tab" and, when signed out, whether you muted the "Buy me a coffee" note or the print checklist.
Clearing your browser's site data removes all of it.
How long we keep it, and how to delete it
Your account and everything in it is kept until you delete it. Feedback messages are kept until they've been read and acted on. Analytics are aggregated and hold no personal data. Error reports and session replays in Sentry are deleted automatically after 90 days.
You can delete individual mixtapes and J-cards from your library at any time. To remove everything, open your profile page and use Delete my account: this erases your account, profile, cloud mixtapes, J-cards and uploaded images immediately. Feedback you sent stays but is no longer linked to you. Anything saved only in your browser stays on your device until you clear it.
Your rights
Under the GDPR you can ask to see the data we hold about you, correct it, have it deleted, receive a copy in a portable format, or object to how it's used. Most of that you can do yourself from your profile and library; for the rest, email contact@mixtape-maker.com and we'll respond within a month. If you're unhappy with how we've handled something you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or your local supervisory authority.
Children
Mixtape Maker is not aimed at children. You must be at least 16, or the age at which you can consent to online services in your country, to create an account. If you think a child has made an account, email us and we'll remove it.
Changes to this policy
If we add a feature that changes what we collect or who processes it, we'll update this page and the date at the top, and announce it through the site's "What's new" notification for signed-in users.