Privacy policy
Last updated:
Mix-a-Mash is made by Mixamash, Inc. This policy covers this website (mixamash.com), Mix-a-Mash accounts, the Mix-a-Mash desktop app for Mac, Windows and Linux, and the Mix-a-Mash phone app for Android, iPhone and iPad. During the beta, Mix-a-Mash is offered in the US. The apps show a short version under How Mix-a-Mash uses your data, the first time you open them and in Settings.
The short version
- We collect only what we need to run Mix-a-Mash.
- The apps send us technical logs automatically so we can keep Mix-a-Mash working. This is part of the service, and there's no switch to turn it off.
- We don't sell or share your personal information, and we don't use it for advertising.
- We don't store your IP address. If Google or Apple supplies your name, we keep it with your account until you delete it.
- Audio we analyze is deleted when the analysis ends. Nothing is trained on your music.
- You can delete your account on the account page or in the app, and ask us to delete anything else at [email protected].
The website
Waitlist. If you join the waitlist, we store your email address, when you signed up and which page you signed up from. We use it only to tell you about Mix-a-Mash.
Browsing. We run no analytics or advertising scripts and set no cookies of our own. Cloudflare hosts the site and stores the waitlist. Like any web host, it handles request data such as IP addresses to serve and protect the site.
Signing in. The sign-in form on the account page uses Cloudflare Turnstile to check that a person is asking for a code. Turnstile sends Cloudflare information about your browser and device. Once you're signed in, the website keeps your sign-in in your browser's storage, and signing out removes it.
Aggregate download counts
Download requests automatically increment required counts in Cloudflare D1, with no switch. Each row holds a UTC day, platform, beta ring, allowlisted source label and count. We store no IP, cookie, referrer, user agent, raw query or account/device ID in this counter. These aggregate rows have no fixed expiry: they remain until an operator deletes them. They are not linked to accounts and cannot be deleted per account.
Accounts
You need an account to host a party on your computer. Guests who join a party never do. You sign in with your email address and a 6-digit code that we email you through Amazon Simple Email Service. For an account we keep your email address, an account ID, which devices are signed in (we store a scrambled form of each sign-in, not the sign-in itself), and the random install IDs of the apps you've signed in with.
Sign-in codes are stored scrambled and deleted about an hour after we send them.
Deleting your account. Delete it on the account page or in the app's Settings. That deletes your email address and links to your install IDs, revokes sign-in sessions, and deletes app logs tied to your account. The account ID, deletion time and revoked sign-in fingerprints remain with no fixed expiry; these are not anonymous. Apple disconnection retries and a local host deletion receipt retain the limited data described below. Backups of the account database are deleted within 8 days.
The apps
Phones that join a party on your Wi-Fi talk to your computer directly, not through us. The phone app comes from Google Play or Apple's TestFlight. If we invite you to a test by email, we give Google or Apple that address.
Here is everything the apps send us, one item at a time.
Email address
Optional. You give it to us only if you make an account. We keep it until you delete your account.
Local deletion receipt
Accounts are optional for guests. If you use one on a host computer, deletion leaves a local generation, deletion reason and SHA-256 digest of the deleted account ID. This identifies the deleted account to the app; it is not anonymous or an upload. It has no fixed expiry and is replaced when you later sign in or sign out. Offline hosts may keep their old credentials until their next online refresh, normally within about an hour.
Account ID
Optional, like the account it belongs to. While you're signed in, it's attached to the app's logs. Deleting the account leaves its ID and deletion time in a tombstone with no fixed expiry, alongside revoked sign-in fingerprints. These are not anonymous.
Install ID
Required. Each app makes a random ID the first time it runs. It isn't based on your hardware, name or network. It's sent with every log upload and, on the desktop app, with the update check, which also carries the app version, the kind of operating system and whether the install is one of our test machines. We use the ID to count installs. Log copies are kept for 60 days, or deleted sooner with your account. We also keep a separate install-count record of the ID, app version, operating system and activity times. This record has no fixed expiry; when the store reaches its capacity, the least recently seen records are removed to make room. Deleting your account removes the link to your account, not this install record. Deleting the app's data resets its local ID, not the stored record.
Technical logs
Required: the apps send them automatically from the moment they open, and there's no switch, because they're how we find and fix problems. About every 5 minutes, the desktop app sends us what's new in its technical logs, and the app on your phone or computer screen sends its own about every minute. Logs cover errors, timings and connections, and can include the local network addresses of devices in your party. Each upload carries the app version, the kind of operating system, the install ID and, if you're signed in, your account ID. We delete these logs after 60 days, and sooner if you delete your account.
Crash data
Required. Crash files go out with the automatic logs. After a crash, the desktop app also keeps a copy of its logs on your computer, and the next time you open Mix-a-Mash it offers to send a full crash report, which goes only if you tap Send. Kept 60 days.
Performance data
Required. The logs include a summary of playback health and timings. Kept 60 days.
What you played
Required. The logs say which songs played and were mixed, as song IDs, with thumbs-up and thumbs-down counts. Kept 60 days.
Song titles and file names in logs
Required. Log lines can include file names, song titles and artists. Logs, diagnostics and feedback never contain audio or lyrics. Kept 60 days.
Feedback and diagnostics you send
Optional: nothing is sent until you tap. Send to developers sends the app's logs, crash files and playback health data, and we delete them after 60 days. Send feedback sends what you typed and the app version, and we keep notes during the beta unless you ask us to delete yours.
Your music on your computer
Required to match your library. When you scan a folder, the desktop app sends each song's acoustic fingerprint and length to us to see if we already know it. Songs we know never leave your computer. We keep the fingerprint and the timing and structure data, not linked to you, so the same song isn't uploaded twice.
Songs we don't know yet
Required for those songs. A song we don't know is uploaded for analysis, along with its vocals and instrumental if they were separated on your computer. The audio is deleted when the analysis ends. There's no way to download your songs from us.
Music on your phone
The phone app in the beta doesn't read music on your phone, so it sends no fingerprints. If a later version lets you add songs on your phone, it will send their fingerprints the same way, as required for matching, kept and not linked to you.
IP address
Our servers see your IP address when you connect, but we don't store it. Cloudflare carries traffic to our servers and handles IP addresses under its own privacy policy.
Your name
Optional. If Google or Apple supplies your name when you create an account, we keep it linked to your account until you delete your account. It helps identify your account; we don't use it for tracking.
Apple disconnection retries
Apple sign-in is optional. If you used it, we retry unconfirmed disconnection after deleting your account. For up to 7 days we retain the encrypted revocation token, its stable Apple provider identifier, client binding and delivery metadata. This is linked data, not anonymous. We remove it after confirmed revocation or expiry. If Apple has not confirmed, remove Mix-a-Mash in Apple Account settings under Sign in with Apple. Google disconnection cannot retry automatically: if native disconnection is unconfirmed, remove Mix-a-Mash at Google connections.
Sign in with Apple
Optional, like any account, on iPhone and iPad once we offer it. Apple gives us an account ID and either your email address or a private relay address that forwards to it, and may share your name on first sign-in. We keep these linked to your account until you delete your account.
Who handles your information
- Cloudflare: hosts the website and the waitlist, carries traffic to our servers, and runs Turnstile.
- Amazon Web Services: runs our servers, song analysis, logs, backups and sign-in emails (Amazon SES).
- Google and Apple: deliver the phone app through Google Play and TestFlight.
- AcoustID, MusicBrainz, Genius, LRCLIB and Cover Art Archive: help us recognize songs and find their details, lyrics and cover art. We send them song fingerprints and song details such as titles and artists, never anything that identifies you.
How long we keep it
- Waitlist emails: until we've contacted you about the launch, or until you ask us to remove yours.
- Account details: until you delete the account, except the tombstone, up to 7 days of Apple disconnection retry data, and the local deletion receipt described above.
- Aggregate website download counts: no fixed expiry; removed by an operator.
- Sign-in codes: about an hour.
- App logs and diagnostic bundles: 60 days.
- Separate install-count records: no fixed expiry, bounded by storage capacity. Account deletion removes the account link, not the install record.
- Feedback notes: during the beta, or until you ask us to delete yours.
- Song fingerprints and analysis data: kept, not linked to you.
Children
Mix-a-Mash isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has given us information, email us and we'll delete it.
Changes
If what we collect changes, we'll update this page and the date at the top.
Contact
Questions, or requests to see or delete your information: [email protected].