Privacy.

You can use Beatomat without an account

Listening, the AI DJ, the decks and every finished mix require no account and no sign-in. An account exists for one reason: to keep the sets you kept and the mixes you saved.

What is stored, if you make an account

• Your email address — so you can sign back in.
• A hash of your password, not the password. Passwords are hashed with scrypt and cannot be read back, by us or by anyone with a copy of the database.
• Your username and, if you give one, a display name — shown on your profile, which today only you can see.
• The sets you kept — the name you gave each one and the list of records in it — and the mixes you saved.
• Your plan — Free or Unlimited — and, if you took a founding seat, when you took it and the date your Unlimited runs to.
• Password reset links, if you ask for one: a one-way hash of the link (never the link itself), which expires after an hour and works once.
• What you listened to — which tracks, when, and for how long. Signed out, the same measurement happens but is attached to no name. Signed in, it is attached to your account, and the person who runs Beatomat can see it.
• A session cookie, so a signed-in browser stays signed in. It is strictly necessary for the account to work, and there are no advertising, tracking or analytics cookies on this site.

What is stored whether or not you have an account

• A rate-limit counter keyed to your IP address, so one visitor cannot exhaust the daily allowance the app has with YouTube and Google. It records a number and a timestamp, not what you asked for, and is not used for anything else.
• A search cache: the text of searches sent to YouTube and the results that came back, kept for four weeks so the same question is never paid for twice. It is not linked to you or to any account.
• Usage measurement, for everyone. Beatomat counts what happens on the site so it can be improved: which screens are opened, which tracks are played and for how long, which mixes the machine made, which buttons are pressed, the answers you tap on the feedback questions (a 👎 on a mix, with the two records; a 👍 or 👎 on a whole mix, with which mix and what it replaced; and the fixed answer you chose; never anything typed), and errors in the site's own scripts (the error message, with email addresses, web-address parameters and long identifiers removed). This part needs no consent and stores nothing on your device. Visits are grouped using a one-way hash of your IP address and browser, recalculated with a fresh secret every 24 hours; the IP address itself is never written down, and tomorrow the same browser is a different number that cannot be linked to today's. Two further things are noted about a visit: the country it came from, worked out from the IP address and stored as two letters and nothing finer, and the website that linked you here, stored as a bare host name such as google.com — never the full address, which could carry something you typed somewhere else. If the link you followed carried campaign tags (utm_source, utm_medium, utm_campaign or ref, the labels that say where a link was posted), those are kept too, as short lowercase words; nothing else in the address is. Beatomat does this itself, in its own database. No third party receives any of it.
• A few things, in your own browser, in its local storage: whether the lights are on, the volume, the last mix you played, the last 300 records you heard (so a new set does not open on the same ones), where the set you were playing had got to (bt-resume: which record, how many seconds in, AI DJ or Decks, and the records coming up after it, by id with their title, artist, tempo and key, never any audio; it is offered as Continue where you left off for a week, and the × removes it), which sound Just play opened on last and the day (bt-justplay, so the next press opens on another), whether you have seen the Decks tour, whether you have opened the list of what the codes mean (bt-legend), today's mixing minutes on the Free plan, your answer to the returning-visitor question (bt-consent: yes or no, when, and when it lapses — no id in it), the initial and display name of the account last signed in here (bt-who, so the header does not say 'Sign in' to you for a second while it checks; no email and no password), and for the feedback questions (bt-ask): minutes heard in this browser and whether you already answered the question, so it is asked once; your own 👍 or 👎 on each mix (bt-mix-votes, by the name of the mix), so the thumb you chose is still lit next time; and bt-test, set only by the site's own test tools, so their visits are left out of the counts. None of it is a cookie, none of it is sent anywhere, and clearing the site's data removes all of it. The one exception, only after a yes, is described next.

Returning visitors — only if you say yes

The first time you visit, a short question (at the top of the page; on a phone, one line at the bottom of the screen: “Count my visits?”) asks: may we remember this browser to count returning visitors and how the app is used? No ads, no third parties. Nothing below happens until you press Accept, and if you press Decline, or never answer, you are measured exactly as described above and nothing more.

• What is stored. A random id, made by your browser (16 random bytes), kept in its local storage as bt-vid. It is not made from your IP address or browser, and it is not a cookie, so it is not sent with every request: it leaves your browser only inside Beatomat's own usage measurement, next to the daily number described above, never instead of it.
• What it is used for, and only this. Three things. Linking your visits: your first visit, whether you started a set, whether you came back the next day or within a week, signing up, and asking for or getting Unlimited — credited to the link that first brought you (the referring site and campaign tags of your first visit after saying yes). Minutes listened: per week, split by AI DJ and Decks, and which library mixes you play again. Device type: phone, tablet or desktop, worked out from whether the screen is a touch screen and how large it is, and the width of the window in three sizes (360, 768 or 1440). Nothing else is read from your browser, and nothing is used to fingerprint it.
• How long. The id and your answer expire in your browser 13 months after you answer, and the question is then asked again. The usage events that carry the id are deleted after 90 days, like all the others.
• Who sees it. Only the person who runs Beatomat, as counts on its own admin page. No ads, no third parties: it is never sold, shared, or sent to an advertising or analytics company.
• Changing your mind. Press Privacy choices at the bottom of any page, Change your choice in Settings, or the button below. Decline deletes the id from your browser at once and keeps only the word no. Events already recorded with it expire within 90 days; to have them deleted now, email ${MAIL}.

Change your choice

Your mixing allowance

On the Free plan, today's minutes of mixing are counted in your own browser and kept in its local storage under one entry (the day and a number of seconds), so the limit works with or without an account. It is not a cookie, is never sent anywhere, and is replaced every day. When the minutes run out, a signed-in browser reports that once, as a usage event like the others.

What is not stored

There is no advertising, no third-party analytics, no tracking or advertising cookies, and no fingerprinting. Without a yes to the returning-visitor question there is no identifier that links your visits across days; with one, there is exactly one, the id described above, and it is never shared with another site. Beatomat does not sell or share personal data with anyone, and the measurement described above never leaves Beatomat's own database.

Other services this site uses

• YouTube. Tracks from YouTube play in YouTube's own embedded player. Using Beatomat therefore means you are also agreeing to the YouTube Terms of Service, and Google's handling of any data collected by the embedded player is covered by the Google Privacy Policy. Beatomat asks YouTube only for public information about videos and never for anything about you; it does not use OAuth and never asks you to sign in to a Google account.
• Audius. Tracks published on Audius stream from Audius under the Open Audio License, through Beatomat's server, without keeping a copy. Nothing about you is sent to Audius with them. Audius' own handling of data is covered by the Audius Privacy Policy and Audius API Terms.
• The Internet Archive. Netlabel records stream from archive.org.
• Deezer. To find out a track's key, tempo and loudness, Beatomat asks Deezer's public API about the track by its title and artist. Nothing about you is sent with the question.
• MusicBrainz. To find an artist's official YouTube channel, Beatomat asks MusicBrainz about the artist by name. Nothing about you is sent with the question.
• An AI model: Google Gemini or Anthropic Claude. To choose and order the next records, Beatomat sends the model the titles, artists, tempos and keys of the record playing, the last few played, and a shortlist of records that fit, plus the sentence the chips composed when you asked for something. Nothing about you is sent: no account, no IP address, no identifier.
• Vercel hosts the site and Neon hosts the database. Both keep standard server logs, which include IP addresses, for security and operational purposes.
• Resend sends Beatomat's emails: the one that says your founding seat is yours, and password reset links. It receives your email address and the text of that email, and nothing else. No marketing email is sent.

How long things are kept

Account data, kept sets and saved mixes are kept until you remove them or ask for the account to be deleted. Rate-limit counters expire on their own within minutes. Cached searches are discarded after four weeks, which is inside the 30 days the YouTube API Terms allow. Usage events are deleted after 90 days; daily totals worked out from them may be kept longer, because they are numbers about the site, not records about a person.

Your rights

Under the GDPR you may ask for a copy of your data, ask for it to be corrected, or ask for it to be erased — and erasure here means the row is deleted, along with your kept sets, your saved list and your listening history. Email hello@beatomat.com and it will be done. You also have the right to complain to a supervisory authority; in Romania that is the ANSPDCP.

If Beatomat changes hands

If Beatomat is ever sold or handed to someone else to run, your account data moves to the new owner under this same policy, and they take on the same promises. We will email account holders before it happens, so you can ask for your account to be deleted first: write to hello@beatomat.com.

Children

Beatomat is not directed at children under 13 and does not knowingly hold data about them.

Changes

If this policy changes, the date at the top changes with it.