Privacy Policy

The data controller for dj-fy is dj-fy, Denmark. For any question about this policy or your personal data, contact [email protected].

Guests do not create an account. To join a party you provide only a nickname of your choosing — we ask for no email address, no phone number, no payment details, and no Spotify account. You do not have to use your real name.

While you are in a party, we store:

• •the nickname you chose, and the party you joined;
• •the songs you add to the queue and the songs you vote for;
• •a timestamp of your last activity, used only to free up a guest slot when someone has been inactive for 15 minutes;
• •a cookie named guest_<party code>, so the party remembers you between page loads. It expires after 24 hours.

Your nickname is visible to the host and to other guests next to the songs you queue, and on the party screen if the host shows one on a TV. Everything else stays within the party.

To run parties you create an account, and we store:

• •your email address and a cryptographic hash of your password (scrypt) — never the password itself;
• •your Spotify profile basics: Spotify user id, display name, profile picture and account tier, used to connect playback to your account;
• •your Spotify access and refresh tokens, and the client ID and secret of the Spotify developer app you create during setup. Tokens and secrets are encrypted at rest (AES-256-GCM);
• •the parties you create and their settings — name, party code, chosen playlist, guest limits and permissions;
• •a record of any purchase: amount, date and the Stripe session reference;
• •a cookie named session, which keeps you logged in, and a short-lived hashed token if you request a password reset.

We never see or store your Spotify password, and we never receive your card details — see below.

• •To perform our contract with you (GDPR art. 6(1)(b)): running your account, your parties, the queue and voting, and processing your purchase.
• •Our legitimate interests (art. 6(1)(f)): keeping the service secure, preventing abuse, and understanding basic usage so we can improve it.
• •Your consent (art. 6(1)(a)): advertising and analytics cookies, where applicable.
• •Legal obligation (art. 6(1)(c)): keeping accounting records of purchases.

We do not sell your data, and we do not share it with anyone except the service providers needed to make dj-fy work:

• •Spotify — playback control and music catalogue. Your host account is connected to Spotify by you, through Spotify's own login. Their handling of your data is governed by Spotify's privacy policy.
• •Stripe — payment processing. Card details are entered on Stripe's own checkout page and never reach our servers; we receive only a confirmation and a payment reference.
• •Resend — sending transactional email, such as password reset links.
• •Google — advertising measurement and, where enabled, website analytics.
• •Our hosting provider — the servers and database that run dj-fy.

Some of these providers are based outside the EU/EEA. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

dj-fy uses a small number of cookies:

• •session — strictly necessary. Keeps a host logged in.
• •guest_<party code> — strictly necessary. Remembers a guest inside a party for 24 hours.
• •Google Ads / Analytics cookies — used to measure whether our advertising works and how the site is used.

The strictly necessary cookies cannot be turned off without breaking login. You can block or delete any cookie in your browser settings.

• •Host accounts — until you delete your account, or ask us to delete it.
• •Parties, queues and votes — parties end automatically after two hours without music, and their data is retained only as long as needed to run and support the service.
• •Guest records — tied to the party; guests are only ever identified by their chosen nickname.
• •Purchase records — retained for as long as accounting law requires (in Denmark, five years from the end of the financial year), even if the account is deleted.

Passwords are hashed with scrypt and never stored in readable form. Spotify tokens and your Spotify app secret are encrypted at rest with AES-256-GCM. All traffic to dj-fy is served over HTTPS. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Under GDPR you have the right to:

• •access the personal data we hold about you;
• •have inaccurate data corrected;
• •have your data deleted (“the right to be forgotten”);
• •restrict or object to how we process your data;
• •receive your data in a portable, machine-readable format;
• •withdraw consent at any time, where processing is based on consent.

To exercise any of these, email [email protected]. We will respond within one month. If you are unhappy with how we handle your data, you may complain to Datatilsynet (the Danish Data Protection Agency).

dj-fy is not directed at children under 13, and hosts must meet Spotify's own minimum age requirements. Guests are only ever asked for a nickname.

We may update this policy as the service changes. The date at the top always shows the current version, and material changes will be communicated to registered hosts by email.