Privacy Policy

Who we are

GuessSong (“we”, “the site”) is a free, open-source party game published at www.guessong.app. The source code is public at github.com/Waynting/GuessSong, so every claim on this page can be checked against the code that makes it. For any privacy question, write to [email protected].

We do not have accounts

There is no sign-up, no login, no password and no Spotify authorisation step. We do not know your name, email address or Spotify identity, because the site never asks for them and has nowhere to put them. There is no user database.

What stays in your browser

A game in progress is held in your device’s session storage— a per-tab store the browser clears when you close the tab. It contains the tracks drawn from the playlist you pasted, the player names you typed, the clip length you chose and the running scores. It is never transmitted to us.

The site also uses local storage for small preferences, such as whether you have already seen the current release notes. Clearing your browser data for this site removes both.

What reaches our servers

Playlist lookups

When you paste a Spotify playlist link, that link is sent to our server, which asks Spotify’s public Web API for the playlist’s name and track list. We use Spotify’s Client Credentials flow, which authenticates this application and not you: Spotify is never told who is asking, and we never gain access to your Spotify account, library or listening history. The resulting track list is cached on our side for a few hours, keyed by the playlist id, so that a popular playlist is not fetched repeatedly.

Audio clip lookups

Spotify stopped supplying preview clips for most tracks in late 2024, so for each song the site sends the song title and artist name to the iTunes Search API and, if that finds nothing, to Deezer, in order to locate a 30-second preview. Only the title and artist are sent. The result is cached by track id, including “no preview exists” results.

Mixed Playlist Mode rooms

If you create a room so that other people can submit playlists from their phones, we store — in a temporary key-value store — the room code, the display names players type in, and the track lists drawn from the playlists they submit. This record carries an expiry from the moment it is created and is deleted automatically when that expiry passes; it is also intended to be consumed once, when the host starts the game. Type a nickname rather than your legal name if you would rather not appear in it.

Buzzer rooms

Buzzer Mode runs on Cloudflare Durable Objects and holds, for the life of the room only, the player names in it and who pressed first. Nothing survives the room.

Rate limiting and abuse prevention

To stop one visitor from exhausting the shared quotas we have with Spotify and iTunes, our server counts requests per IP address in a short fixed window. What is stored is a counter against a key derived from the address, held for the length of that window (minutes) and then gone. We do not build profiles from it and do not use it to identify anyone.

Server logs

Our hosting provider, Vercel, records standard request logs (timestamp, path, response status, IP address, user agent) as part of operating the service. These are retained by Vercel under their own policy and are used only for debugging and security.

Counting, not tracking

We keep a small set of aggregate counters — how many games were started, how many people arrived from a shared link — as plain numbers per day. They are totals with no identifier attached and cannot be traced back to a person or a device.

Third parties, cookies and advertising

Three Google services run on this site, and each sets its own cookies or similar identifiers under its own policy:

• Google AdSense serves the advertising on this site. Google and its partners may use cookies to serve ads based on your prior visits to this and other websites.
• Google Analytics 4 gives us aggregate usage statistics — page views, which features are used, which errors occur. Failure reasons are recorded as fixed categories, never as raw text, so nothing you paste or type is forwarded to Analytics.
• Google Fonts serves the two typefaces the site uses.

Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You can opt out of personalised advertising at Google Ads Settings, or opt out of third-party vendors’ use of cookies for personalised advertising at aboutads.info/choices. Google’s own handling of data is described in its privacy and terms.

We also depend on Spotify, Apple (iTunes Search), Deezer, Vercel, Upstash and Cloudflare as described above. We do not sell or share personal information, and there is no personal information here to sell.

Visitors in the EEA, UK and Switzerland

Where a lawful basis is required, we rely on legitimate interestsfor the technical processing that makes the game work (playlist and clip lookups, rate limiting, server logs), and on consent for advertising and analytics cookies, collected through Google’s consent mechanism where it applies. You have the right to access, correct, delete, restrict or object to processing of your personal data, and to complain to your local supervisory authority. Because we hold no accounts, in most cases we have nothing on file to return — but write to us and we will tell you exactly that.

Visitors in California

We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA. To exercise any CCPA right, contact us at the address below.

Children

GuessSong is a general-audience game and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted personal information through a Mixed Playlist room, tell us and we will remove it — and note that these rooms expire on their own within hours regardless.

Changes to this policy

If this policy changes materially, the date at the top of the page changes with it. The site’s release notes, linked in the footer, record when.

Contact

Questions, requests and complaints: [email protected]. There is more on how to reach us on the contact page.