Privacy policy
Last updated 31 October 2026
quuuuu.com lets you make and share playlists of things that live elsewhere on the web. We collect as little as that needs, we don't track you, and we don't sell or share your data for advertising.
Who is responsible
The controller of your personal data is [Operator name], [Postal address], [Country]. Questions or requests: [privacy contact email].
What we store, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Your email address | Signing you in with a one-time link | Performance of our agreement with you (Art. 6(1)(b) GDPR) |
| Profile: handle, and optionally a display name and bio | Naming you as the creator of playlists you share; a profile page, if you turn it on | Performance of our agreement with you |
| Your playlists: titles, descriptions, links, notes, dates | The service itself | Performance of our agreement with you |
| Technical logs (IP address, browser, time of request) | Keeping the service running and secure | Legitimate interest in security (Art. 6(1)(f) GDPR) |
Everything you create is private by default. A playlist becomes visible to others only when you share it by link or make it public, and then shows your display name (or handle) as its creator. Your profile page, with your bio and public playlists, exists only if you turn it on.
Third-party players
Playlists contain content hosted by others, such as YouTube (Google), Vimeo, SoundCloud, Bandcamp, Mixcloud, Spotify, or whoever hosts an audio file. Their players load only after you allow that source. From then on, your browser connects to them directly: they receive your IP address, and they may set cookies or similar storage under their own privacy policies. We load YouTube from its privacy-enhanced domain (youtube-nocookie.com) and Vimeo with its "do not track" setting. Thumbnails are fetched through our own server, so showing a playlist doesn't contact the provider. The legal basis for loading a player is your consent (Art. 6(1)(a) GDPR), which you can withdraw on your account page. See the cookie policy.
Who processes data for us
- Vercel Inc. hosts the website.
- Supabase Inc. hosts the database and sends sign-in emails.
Both act as processors under data processing agreements. Where data leaves the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
Your account data stays until you delete it. Deleting your account removes your profile, playlists and login immediately; backups held by our processors expire within their retention window (at most 30 days). Technical logs are kept for up to 30 days.
Your rights
You can, at any time:
- get a copy of your data, in a machine-readable format, from your account page;
- correct your profile and playlists by editing them;
- delete your account and everything in it from your account page;
- object to processing, restrict it, or withdraw consent;
- lodge a complaint with your data protection authority.
For anything you can't do yourself, email us and we'll respond within one month.
Age
You need to be at least 16 to create an account.
Changes
If this policy changes in a way that matters, we'll tell signed-in users before it takes effect.