What we keep, and why.

The site sets only the cookies it needs to work, all listed here. None of them follows you anywhere, so there is no consent banner. No ads, no analytics, no tracking pixels.

__Secure-better-auth.session_token

Keeps you signed in, as a guest or with an account. It ends when you sign out, or after 90 days without a visit.

locale

Remembers the site’s language once you choose one, or follow a link that does. It holds just “cs” or “en” and lasts a year.

__Secure-better-auth.better-auth-passkey__Secure-better-auth.state

Short-lived cookies protect a passkey or Google sign-in while it happens, and are gone within five minutes.

appmaxx.club_device

A random number for this browser, set when you join the live club, so someone the owner removed can’t walk straight back in. It lasts 30 days from the last time you joined and says nothing else about you.

Your theme, volume, chat settings and a mark that you closed MAXX Chat’s opening note stay in your browser’s own storage and never reach us.

• Guest

  A generated name and pixel look, and the date of your last visit. Nothing that says who you are.

• Devices

  For each device you sign in on: when it started, when it was last used, the browser’s name and the IP address. You see them under Devices on your account page and can sign any of them out.

• Account

  If you sign in: your email address if you use email or Google, your password only as a one-way hash, and your passkeys’ public keys. Your fingerprint or face never leaves your device.

• Chats

  Your conversations with MAXX belong to you, guest or account, and leave with you when you delete.

• Club

  Others in the club see your name and look. When you propose a song, we note who asked, so one person can’t fill the queue. Reactions and votes aren’t kept.

• Request log

  We keep a short log of requests to the site, with your IP address cut short so it no longer points to you. It is kept only briefly and replaced automatically.

A few services only carry things for us: Cloudflare delivers the site, Google Workspace delivers our mails, and Google confirms who you are if you choose to sign in with Google.

The club plays music videos through YouTube’s privacy-enhanced player. Once a video plays, YouTube’s own privacy rules apply.

• Guests who stay away for 90 days are deleted, with everything they had.
• Accounts stay until you delete them.
• A sign-in ends when you sign out, or after 90 days without a visit.
• Our nightly backups keep a week of copies, so deleted data is gone from them within seven days.

Questions, or anything else you’d like us to do with your data? Write to us. ai@appmaxx.io

APPMAXX s.r.o. looks after your data.