Privacy Policy

Information we collect

Organizers — when you create an account, we collect your name, email address, and a securely hashed password.

Guests — RSVPing to an event doesn't require an account. We store the name you enter, an optional email address (only if you choose to provide one, to send you a confirmation), and any note you add, tied to a signed cookie in your browser rather than a login.

Event data — event details an organizer enters (name, date, location, description, flyer customizations) and the song queue built for that event (song titles, who requested them, and approval status).

YouTube connection — if an organizer connects a YouTube account (see below), we store which Google account is connected (its email address) and an encrypted OAuth refresh token used solely to manage that event's playlist on your behalf. We never see or store your Google password.

Basic technical data — standard server logs (IP address, timestamps, request paths) generated by our hosting provider for security and reliability, not used for tracking or advertising.

YouTube API Services

RunTheMic uses YouTube API Services.

When an organizer connects their YouTube account from Settings, RunTheMic requests permission to manage playlists on that account (create a playlist for the event, and add or remove the songs guests request). This is a separate, optional step from signing in — logging into RunTheMic with Google never grants YouTube access on its own. An organizer can revoke this access at any time from Google's security settings, or by disconnecting YouTube from RunTheMic's Settings page.

By using RunTheMic's YouTube integration, you also agree to be bound by the YouTube Terms of Service. For more on how Google handles your data, see the Google Privacy Policy.

Google user data

This section describes how RunTheMic handles data it receives from Google when an organizer connects a YouTube account.

What we access.

• The email address of the connected Google account (and basic profile information that Google includes with it). We store only the email address, to show which account is connected.
• YouTube video search results (video titles, channel names, thumbnails, and durations) used to let guests find karaoke tracks.
• The playlist RunTheMic creates for an event on the connected account, and the songs it adds to or removes from that playlist. We also check that this playlist still exists before syncing to it.

We do not access your uploaded videos, other playlists, subscriptions, comments, watch history, or any other YouTube data.

How we use it. Only to provide the features you see: showing which account is connected, searching for songs, and keeping an event's YouTube playlist in sync with its song queue. We don't use it for advertising, profiling, or to develop, improve, or train AI or machine-learning models.

Who we share it with. No one. We don't sell or transfer Google user data to third parties. It is processed only on our own application servers, and the connection record is stored in our database with our hosting provider, Railway. We disclose it only if required by law or to protect against security threats or abuse.

How we protect it. The OAuth refresh token is encrypted at rest (AES-256-GCM) with a key kept separate from the database, is only ever used server-side, and is never sent to your browser. We don't store access tokens. All traffic to RunTheMic is encrypted in transit over HTTPS.

Retention and deletion. We keep the connection only until you disconnect YouTube, delete your account, or revoke access. Clicking Disconnect in Settings revokes RunTheMic's access with Google and deletes the stored token and account email from our database immediately. If you revoke access from Google's security settings instead, the token we hold stops working, and you can remove it from our systems by disconnecting in Settings or emailing us. Playlists RunTheMic created remain on your YouTube account — they belong to you, and you can delete them there at any time.

RunTheMic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

• To operate the core features you use: events, RSVPs, flyers, and the song queue.
• To manage a connected YouTube playlist in sync with an event's song queue.
• To send transactional email — account verification and, if you opt in as a guest, an RSVP confirmation, or as an organizer, a notification when someone RSVPs.
• To keep the service secure and prevent spam or abuse (e.g. a bot-detection check on signup and RSVP forms).

We don't sell your information, and we don't use it for advertising.

Who we share data with

We use a small number of third-party services to run RunTheMic, each only for its specific purpose:

• Google — YouTube search and playlist management, as described above. Google user data is not shared with any of the services below.
• Resend — delivering transactional email (verification, confirmations, notifications).
• Cloudflare — spam/bot filtering on public forms, and content delivery.
• Railway — application hosting and database infrastructure.

Data retention and deletion

Deleting an event permanently removes that event and everything tied to it — RSVPs, the song queue, flyer customizations, and its YouTube playlist link — immediately (the playlist itself stays on your YouTube account). To delete your organizer account and all data tied to it, email us at the address below; we'll complete the deletion within 30 days.

Cookies

We use a session cookie to keep organizers signed in, and a separate, per-event cookie so guests don't have to re-enter their RSVP. We don't use third-party advertising or tracking cookies.

Children's privacy

RunTheMic is not directed at children under 13, and we don't knowingly collect information from them.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page.

Contact us

Questions about this policy or your data? [email protected]