Privacy.

You can use Beatomat without an account

Listening, the AI DJ, the decks and every finished mix require no account and no sign-in. An account exists for one reason: to keep the sets you kept and the mixes you saved.

What is stored, if you make an account

• Your email address — so you can sign back in.
• A hash of your password, not the password. Passwords are hashed with scrypt and cannot be read back, by us or by anyone with a copy of the database.
• Your username and, if you give one, a display name — shown on your profile, which today only you can see.
• The sets you kept — the name you gave each one and the list of records in it — and the mixes you saved.
• Your plan — Free or Unlimited.
• What you listened to — which tracks, when, and for how long. Signed out, the same measurement happens but is attached to no name. Signed in, it is attached to your account, and the person who runs Beatomat can see it.
• A session cookie, so a signed-in browser stays signed in. It is strictly necessary for the account to work, and there are no advertising, tracking or analytics cookies on this site.

What is stored whether or not you have an account

• A rate-limit counter keyed to your IP address, so one visitor cannot exhaust the daily allowance the app has with YouTube and Google. It records a number and a timestamp, not what you asked for, and is not used for anything else.
• A search cache: the text of searches sent to YouTube and the results that came back, kept for four weeks so the same question is never paid for twice. It is not linked to you or to any account.
• Usage measurement. Beatomat counts what happens on the site so it can be improved: which screens are opened, which tracks are played and for how long, which mixes the machine made, and which buttons are pressed. Nothing is stored on your device to do this — no analytics cookie, and no identifier that survives the day. Visits are grouped using a one-way hash of your IP address and browser, recalculated with a fresh secret every 24 hours; the IP address itself is never written down, and tomorrow the same browser is a different number that cannot be linked to today's. Two further things are noted about a visit: the country it came from, worked out from the IP address and stored as two letters and nothing finer, and the website that linked you here, stored as a bare host name such as google.com — never the full address, which could carry something you typed somewhere else. Beatomat does this itself, in its own database. No third party receives any of it.
• Three preferences, in your own browser: whether the lights are on, the volume, and the last mix you played. They are kept in your browser's local storage, never sent anywhere, and clearing the site's data removes them.

What is not stored

There is no advertising, no third-party analytics, no tracking or advertising cookies, no fingerprinting, and no identifier that follows you between days or between sites. Beatomat does not sell or share personal data with anyone, and the measurement described above never leaves Beatomat's own database.

Other services this site uses

• YouTube. Tracks from YouTube play in YouTube's own embedded player. Using Beatomat therefore means you are also agreeing to the YouTube Terms of Service, and Google's handling of any data collected by the embedded player is covered by the Google Privacy Policy. Beatomat asks YouTube only for public information about videos and never for anything about you; it does not use OAuth and never asks you to sign in to a Google account.
• Audius. Independent tracks stream from Audius under the Open Audio License, directly from their content nodes.
• The Internet Archive. Netlabel records stream from archive.org.
• Deezer. To find out a track's key, tempo and loudness, Beatomat asks Deezer's public API about the track by its title and artist. Nothing about you is sent with the question.
• MusicBrainz. To find an artist's official YouTube channel, Beatomat asks MusicBrainz about the artist by name. Nothing about you is sent with the question.
• An AI model: Google Gemini or Anthropic Claude. To choose and order the next records, Beatomat sends the model the titles, artists, tempos and keys of the record playing, the last few played, and a shortlist of records that fit, plus the sentence the chips composed when you asked for something. Nothing about you is sent: no account, no IP address, no identifier.
• Vercel hosts the site and Neon hosts the database. Both keep standard server logs, which include IP addresses, for security and operational purposes.

How long things are kept

Account data, kept sets and saved mixes are kept until you remove them or ask for the account to be deleted. Rate-limit counters expire on their own within minutes. Cached searches are discarded after four weeks, which is inside the 30 days the YouTube API Terms allow. Usage events are deleted after 90 days; daily totals worked out from them may be kept longer, because they are numbers about the site, not records about a person.

Your rights

Under the GDPR you may ask for a copy of your data, ask for it to be corrected, or ask for it to be erased — and erasure here means the row is deleted, along with your kept sets, your saved list and your listening history. Email andinicolescu02@gmail.com and it will be done. You also have the right to complain to a supervisory authority; in Romania that is the ANSPDCP.

Children

Beatomat is not directed at children under 13 and does not knowingly hold data about them.

Changes

If this policy changes, the date at the top changes with it.