Privacy Policy

Last updated: October 6, 2026

What CoVibe Music is

CoVibe Music finds the songs a group of friends all love across Spotify, Apple Music and YouTube Music. It is a free service run by an individual developer in Israel.

What we store

• Account: a technical ID, the username you chose and an avatar. Guest accounts have no email. If you choose to save your account, we also store your email address.
• Your liked songs from the platform you connected: title, artist, the platform's song ID and an artwork link. No listening history and no audio.
• Spotify only: an encrypted refresh token, used to refresh your liked songs once a day in the background. Revoke it anytime with "Disconnect" in your profile.
• Sessions: which sessions you joined, with whom, and the shared songs. A session is deleted automatically 30 days after its last activity.
• Usage statistics: basic product events (session created, platform connected, playlist exported) with a hashed, non-reversible user identifier. No tracking cookies, no advertising services.
• Error reports: when something breaks, technical details (browser type, error message) are sent to Sentry so we can fix it. No songs or personal details are sent.

What we don't do

• We do not sell or share data with third parties for advertising.
• We never modify your music account without your action. A playlist is created only when you tap the playlist button in a session.
• We read nothing beyond what matching needs: your liked songs and, on platforms that support it, your own playlists and the artists you follow. No listening history, no contacts, no payment data.

Who sees your data

People in the same session see your username, avatar, connected platform and the shared songs only. Songs that are not shared are never shown to anyone. A playlist created from a session is kept in the music account of whoever created it — see the next section.

Shared playlists — what to know before you create one

• Where the playlist is created: in the personal music account (Spotify, Apple Music or YouTube Music) of the participant who tapped the playlist button. Each participant who taps gets their own playlist in their own account. Its title includes participants' first names (e.g. "CoVibe Dana & Yossi"), and it contains only the songs you share.
• Who controls it: the owner of the account where it was created — and only them. They can keep, share, rename or delete it. We and the other participants have no access to it.
• Spotify-only fallback: when a participant has no active personal Spotify connection, the playlist is created in CoVibe Music's Spotify account as a public playlist: anyone with the link can open it, and it may appear in Spotify search. Such a playlist is under our control and we remove it when a participant deletes their account (see "Deletion").
• What this means for you: once another participant has created a playlist in their account, it stays with them even if you delete your CoVibe Music account. If that concerns you, join sessions only with people you trust, or choose a username that doesn't identify you.

Third-party services

Data is stored on Supabase (EU, Frankfurt). The site is served by Cloudflare. Avatars are generated by DiceBear. Spotify, Apple Music and YouTube provide access to your liked songs under the permission you granted, which you can revoke with them at any time.

Google and YouTube data

This section states exactly which data we receive from your Google account when you sign in with Google or connect YouTube Music, and what happens to it. CoVibe Music's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data we access

• Sign in with Google (openid, email, profile scopes): the email address, name and profile picture of your Google account.
• YouTube Music connection — read only (youtube.readonly scope): the videos you rated "Like", the playlists you created in your account and the videos in them, and the channels you subscribe to. From each video we keep only the song title, artist, video ID and a thumbnail link. From each channel we keep only the artist name. We do not read watch history, comments, messages, payment details or data from other accounts.
• Creating a YouTube playlist (youtube scope): requested only at the moment you tap the create-playlist button in a session, and used solely to create a new playlist in your account and add the shared songs to it. If no song could be added, the empty playlist we just created is deleted. We never modify, delete or read your other playlists, likes or subscriptions.

How we use it

• Your email identifies your account and lets you sign in from any device. Your name and profile picture are the defaults for your username and avatar (you can change both in your profile).
• Your YouTube songs and artists are compared with those of the other participants in a session to compute which songs and artists you share and your match score. That is all we do with them.
• We do not use Google user data for advertising, do not sell it, do not build profiles from it for other purposes, and do not use it to train AI or machine-learning models. Humans at CoVibe Music do not read it unless you ask for support or it is required for security or by law.

Who we share it with

• Participants in your session see your username, avatar, connected platform and the shared songs and artists only. Your email, and songs that are not shared, are never shown to anyone.
• Infrastructure providers that process the data solely on our behalf: Supabase (storage, EU — Frankfurt) and Cloudflare (website delivery). Sentry receives technical error reports only, with no Google user data.
• We do not transfer Google user data to anyone else, except where required by law.

How we protect it

• All traffic is encrypted (HTTPS/TLS). Data is stored encrypted at rest by Supabase and is accessed only through our server with keys that are never exposed to the browser.
• The Google/YouTube access token is short-lived (about one hour), is held in the app's memory only for the duration of the action, and is never stored on our server or in our database. We do not request a refresh token from Google, so every refresh of your YouTube songs requires your renewed approval.

Retention and deletion

• Your email, name and avatar are kept for as long as your account exists.
• Songs from YouTube are kept while YouTube Music is connected. Tapping "Disconnect" in your profile deletes them immediately. The artist list is deleted when you delete your account.
• A session and all shared songs in it are deleted automatically 30 days after its last activity.
• "Delete account" in your profile deletes everything above immediately (see "Deletion"). You can also revoke CoVibe Music's access at any time in your Google account settings.

Deletion

Your profile has a "Delete account" button that immediately removes your account, profile, liked songs and tokens. In addition:

• Every session you took part in is deleted — for all participants, including the shared songs and match scores, so nothing about your music taste remains with us or with other participants inside CoVibe Music.
• Other participants keep only a line saying "This session is no longer available: one of the participants deleted their account" — without your name, avatar or a playlist link.
• Playlists of those sessions that live in CoVibe Music's Spotify account are emptied, renamed to a generic title without names, and removed from the account. (Spotify has no true playlist deletion, so we empty it first; an old link leads to an empty playlist.)
• What we cannot delete: a playlist created in another participant's personal music account (Spotify, Apple Music or YouTube Music), and any copy someone saved, duplicated or downloaded before the deletion. These live in those people's accounts with the music provider, outside our control. Playlists you created in your own music account stay with you — you can delete them there yourself.

See Data deletion.

Contact

[email protected]