Skip to main content
Together

Privacy Policy

Effective July 6, 2026

Together ("Together," "we," "us," or "our") is a synced watch-and-listen service available at together.chtnnhfoundation.org. This Privacy Policy explains what information we collect when you use Together, how we use it, and the choices you have.

Together is operated by chtnnh. By using the service, you agree to the practices described here. If you do not agree, please do not use Together.

Summary

  • You can create and join rooms without creating an account. Optional sign-in uses email magic links via Supabase.
  • We store room metadata, optional account data, and ephemeral realtime session state to run the service.
  • Playback uses YouTube embeds and related APIs. Optional imports may connect to Spotify or SoundCloud when you choose to use those features.
  • Some preferences and identifiers are stored locally in your browser unless you sign in to sync account preferences.

Information we collect

Information you provide

  • Display name — chosen when you create or join a room. Stored in your browser and sent to room participants while you are connected.
  • Room details — room title, privacy setting, optional password (stored as a hash, not plain text), queue contents, chat messages, reactions, and moderation actions you take as a host or co-host.
  • Chat and activity — messages, emoji reactions, skip votes, and similar in-room activity visible to other participants.
  • Account email (optional) — if you sign in with a magic link, we receive and store your email address through Supabase to identify your account.
  • Saved playlists (optional) — if you are signed in, playlist names and track metadata you save are stored in our database.
  • Third-party import tokens (optional) — if you connect Spotify to import a playlist, a short-lived access token may be stored in an HTTP-only cookie for that import session.

Information collected automatically

  • Anonymous identifier — a random ID generated in your browser (`localStorage`) to distinguish guests for moderation, bans, and queue limits.
  • Local preferences — theme, audio-only mode, stream quality, volume, recent rooms, and similar settings stored in your browser unless synced to your account when signed in.
  • Technical data — IP address, request timestamps, and basic logs used for security, abuse prevention, and rate limiting (for example, on room password attempts and API routes).
  • Service analytics — aggregated, privacy-oriented usage analytics via Cloudflare Web Analytics (page views on the web app) and Cloudflare Workers Analytics Engine (aggregated realtime events such as joins and skips). We do not use third-party advertising trackers.
  • Realtime session data — while a room is active, playback position, queue state, participant list, and a rolling chat buffer are processed and stored temporarily in Cloudflare Durable Object storage to keep participants in sync.

How we use information

We use the information above to:

  • Provide synchronized playback, queues, chat, and room moderation features
  • Create, join, and secure public, unlisted, and private rooms
  • Persist optional account features such as saved playlists and synced preferences
  • Resolve tracks to YouTube videos and cache resolution results
  • Protect the service against abuse, spam, and unauthorized access
  • Operate, maintain, and improve Together

We do not sell your personal information. We do not use your data for targeted advertising.

Cookies and local storage

Together uses cookies and browser storage for essential functionality, including:

  • Authentication cookies — when you sign in via Supabase, session cookies maintain your logged-in state.
  • Room access cookies — for private rooms, cookies remember that you entered the correct password or used a valid invite link for that room.
  • OAuth cookies — short-lived cookies during optional Spotify import to complete authorization securely.
  • Local storage — display name, anonymous ID, UI preferences, and recent rooms are stored locally in your browser.
  • Service worker cache — if you install or use the PWA, cached app shell assets may be stored on your device for offline fallback.

You can clear cookies and local storage in your browser settings. Doing so may sign you out, reset local preferences, or require you to re-enter room passwords.

Third-party services

Together relies on third parties to operate. Those services may collect information according to their own policies when you interact with them through Together:

We are not responsible for the privacy practices of third-party websites or services linked from rooms, chat, or queue items.

Data retention

  • Room and account records — kept while the room or account exists and as needed to operate the service. Room owners may delete rooms; signed-in users may delete saved playlists.
  • Realtime session data — chat buffers, live queue state, and participant lists in Durable Object storage are temporary and tied to active or recently active sessions.
  • Security logs and rate-limit counters — retained for a limited period appropriate for abuse prevention, then discarded or aggregated.
  • Local browser data — remains on your device until you clear it.

Your choices

  • Use Together anonymously without signing in.
  • Choose what display name you share in a room.
  • Clear browser storage or sign out to remove local or account session data.
  • Request deletion of account-linked data by contacting us (see Contact). We may retain certain information where required for security, legal compliance, or legitimate operational needs.

Children's privacy

Together is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us so we can delete it.

International users

Together is operated from the United Arab Emirates and uses infrastructure providers that may process data in other countries. By using the service, you understand that your information may be transferred to and processed in jurisdictions with different data protection laws than your own.

Changes to this policy

We may update this Privacy Policy from time to time. We will revise the effective date at the top of this page when we do. Continued use of Together after changes become effective constitutes acceptance of the updated policy.

Contact

Questions about this Privacy Policy or a data request? Open an issue on GitHub or contact the operator via me.chtnnhfoundation.org.