SpotiQueue Hosting Provider Data Policies

Last updated: August 2026

1. Purpose

This document lists the infrastructure and third-party providers SpotiQueue relies on to run the service, what each one can access, and where relevant, their own data protection commitments. It's meant to sit alongside the Privacy Policy and Data Retention Policy as a more technical, subprocessor-level reference.

2. How data flows through our infrastructure

Traffic reaches SpotiQueue in this order: a visitor's browser connects over HTTPS to Cloudflare, which terminates TLS and routes the request through a private Cloudflare Tunnel to our application server, which runs on a Node.js server backed by a PostgreSQL database on the same machine. Our server is never directly exposed to the internet; all inbound traffic passes through Cloudflare first.

3. Primary hosting provider: OVHcloud

SpotiQueue's application server and database run on infrastructure from OVHcloud, currently a VPS in OVHcloud's Singapore data centre. OVHcloud is a French-headquartered cloud infrastructure company with data centres across Europe, North America, Australia, and Asia-Pacific.

What this means in practice:

• Everything lives here. The full application, the PostgreSQL database, and application logs all sit on this server. That covers every category of personal information described in the Privacy Policy, from host account details through to guest queue history.
• OVHcloud acts as our infrastructure provider, not as a party that actively uses SpotiQueue's data. They provide the compute and storage; we control what's stored on it.
• Security and compliance. OVHcloud maintains an ISO 27001-certified information security management system, undergoes annual external security audits, and runs regular technical audits including penetration testing and vulnerability scanning. They publish a GDPR compliance programme and, for transfers of data outside the European Economic Area, rely on standard contractual clauses with their own subsidiaries to keep an equivalent level of protection in place.
• Data centre location. Where a server is deployed in Singapore, OVHcloud's own materials describe that data centre as compliant with GDPR-equivalent certification standards. If the production server is later moved to a different OVHcloud region (for instance, to be closer to a majority of users), this section should be updated to reflect the new location.

4. Cloudflare

Cloudflare provides DNS, TLS termination, and the tunnel that connects the public internet to our server without exposing it directly. Cloudflare sees connection-level metadata for every request, including IP addresses, request headers, and the URLs being accessed. We don't currently run any Cloudflare-side analytics or tracking product beyond what's needed for DNS and the tunnel itself.

5. Email provider (Resend)

Resend delivers SpotiQueue's transactional email over SMTP. It only ever receives what's needed to send those messages: the recipient's address, and the subject/body of verification, password reset, account deletion confirmation, invite, waitlist, or policy-update emails. We don't send marketing newsletters through this channel. Resend processes email on its own infrastructure; see Resend's published privacy and data processing terms for details.

6. Sign-in providers

Each of these is a separate OAuth application under our control, and we only request the minimum scope needed to identify the signed-in user.

7. Spotify

Spotify is core to how SpotiQueue works. Each host connects their own Spotify Developer application (a "bring your own key" model), and we store their app's client ID and encrypted client secret, along with an encrypted refresh token for their linked Spotify account. We use this to search for tracks, queue songs, and read what's currently playing, using these scopes: user-read-playback-state, user-modify-playback-state, and user-read-currently-playing. Album art is served either directly from Spotify's CDN or through a proxy on our server with an allow-list restricting it to Spotify's image domains.

8. LRCLIB

We use LRCLIB (lrclib.net) for lyrics lookups. This integration only ever sends a track name and artist name, both already public information about the song itself, and doesn't include anything that identifies a host or guest.

9. Subprocessor summary

10. International transfers

Several of the providers above sit outside Australia. For anyone covered by the GDPR, UK GDPR, or a US state privacy law, here's how transfers to each one are currently handled:

• OVHcloud relies on standard contractual clauses between its own subsidiaries for personal data processed outside the European Economic Area, alongside its ISO 27001-certified security programme described in section 3.
• Our OAuth providers each publish their own transfer mechanisms for data leaving the EEA or UK, typically standard contractual clauses and, where applicable, participation in the EU-US Data Privacy Framework. We haven't independently audited each provider's current certification status; if that matters to you, their own privacy or data processing terms will have the specifics.
• Resend processes transactional email on its own infrastructure under its published data protection terms.
• Spotify is used under its own developer terms, and processes the refresh token and playback data described in section 7 on its own infrastructure.
• LRCLIB only ever receives a track name and artist name, which isn't personal information, so transfer mechanisms aren't really in play there.

11. Changes to our providers

If we change our primary hosting provider, add a payment processor, or bring on a new subprocessor that handles personal information, we'll update this document and, where the change is significant, let account holders know.

12. Contact

Email [email protected] with questions about our infrastructure or subprocessors.