Privacy Policy

Who is responsible?

For the public instance https://web-syncplay.de: github.com/Yasamato.

If you self-host Web-SyncPlay, the operator of that instance is the controller — not us.

What we process (and why)

Processing is limited to running sync rooms (Art. 6(1)(f) GDPR — legitimate interest in offering a free hobby service) and keeping the service stable (rate limits / abuse protection).

• Temporary participant identity (ID, encrypted secret, display name, avatar style) in your browser; server stores a hash of the secret with room state
• Room data: playlist metadata/URLs, playback state, roles, optional join password, short in-room activity log
• Connection data (e.g. IP) via normal HTTP/WebSocket handling
• Player preferences in localStorage (volume)
• Short-lived rate-limit counters (~60 seconds) for DDoS/abuse protection only

How long

• Room state (including activity log): Redis/Valkey TTL of 1 hour while inactive; log entries older than 1 hour are pruned even if the room stays busy. No separate long-term log archive
• Rate limits: ~60-second windows, then gone
• Browser storage: until you clear site data

Local media

Files you share from your device are not uploaded as a stored library. They stay on the providing browser; we only relay bytes to other viewers and may keep short-lived metadata (~1 hour) and an ephemeral relay cache (~2 minutes).

Who else sees data

• Other people in the same room (names, presence, playlist/playback)
• Upstream media sites when someone adds a remote URL (their own policies apply)

Avatars are generated in your browser (bundled Dicebear). No marketing cookies or analytics. Essential localStorage only — no cookie banner.

Your rights

You may request access, correction, deletion, restriction, or object to legitimate-interest processing, and complain to a data protection authority. In practice, clearing browser data or letting a room expire removes most data. Contact: github.com/Yasamato.