Privacy Policy

JamHaul ("we", "our", "us") is operated by Misfit Mindset. This policy explains what data we collect, why, and what rights you have over it.

What we collect

• Account data: email address, name, and a hashed password.
• Platform connections: OAuth refresh tokens and Apple Music User Tokens (AES-256-GCM encrypted at rest), playlist names, and track identifiers. We do not store audio or listening history.
• Sync logs: records of what was added or removed, when, and from which run. Free accounts retain 30 days; Premium retains indefinitely until deletion.
• Consent records: which cookie choices you made and when.
• Billing: Stripe handles all payment data. We store only your Stripe customer ID and subscription status.
• Usage analytics (optional): only collected if you opted in to analytics cookies.

Google and YouTube user data

If you sign in with Google, JamHaul receives your Google account email, name, and profile so we can create or open your JamHaul account. If you connect YouTube Music, JamHaul uses the YouTube Data API to list, create, and update playlists you choose to sync. We store encrypted OAuth tokens, playlist names, and track identifiers. We do not access Gmail, Google Drive, Calendar, Contacts, or YouTube watch history. We do not store audio. We do not sell Google user data. Disconnecting YouTube Music or deleting your account revokes and deletes those tokens.

Apple Music user data

If you connect Apple Music, JamHaul uses Apple MusicKit and the Apple Music API to list and update playlists you choose to sync. We store an encrypted Music User Token, your storefront, playlist names, and track identifiers. We do not store audio or listening history. Disconnecting Apple Music or deleting your account deletes that token.

How we use it

• To authenticate you and maintain your session.
• To perform playlist synchronisation on your behalf.
• To send transactional email (sync alerts, receipts, deletion confirmation).
• To calculate and display your sync history.
• To process payments via Stripe.

Legal basis (GDPR)

Contract performance for core sync features. Legitimate interest for fraud prevention and security logging. Consent for analytics cookies and marketing email.

Your rights

• Access: export all your data from Settings → Privacy & data.
• Erasure: request account deletion from Settings. We complete deletion within 30 days.
• Correction: update your name and email in Settings → Account.
• Portability: your data export is a machine-readable JSON file.
• Objection: opt out of analytics from Settings → Privacy.

Retention

We retain account data until you delete your account, then purge it within 30 days. Audit logs are retained for 7 years for legal compliance. Stripe billing records are retained per Stripe's policy.

Third parties

We share data with Stripe (payments), Resend (transactional email), and Hostinger (VPS hosting). A full list is on the Subprocessors page. We do not sell your data.

Contact

Privacy questions: [email protected]