Last updated: August 2026
This policy explains how SpotiQueue collects, uses, stores, and shares personal information. It covers three kinds of people:
SpotiQueue ("we", "us") operates spotiqueue.com and its subdomains, including the dashboard (dash.spotiqueue.com).
SpotiQueue is based in Australia and this policy is written primarily around Australian privacy law. Sections 9 and 10 below add extra detail for anyone using SpotiQueue from the EU, EEA, UK, or US, since those rights sit on top of, rather than replace, everything else in this policy.
If you have questions about this policy, contact [email protected].
| Category | What we collect | Notes |
|---|---|---|
| Login details | Email address, password (stored as hashed, not plaintext) | |
| Account status | Whether you've been banned, whether your email is verified | |
| Linked logins | OAuth provider account ID, username, and avatar, plus the time you linked them, when you choose to connect one | Some providers are only used for linking and guest sign-in, not to log into your own dashboard |
| Plan | Whether you're on the free or Pro plan, and when your plan expires | We don't currently process card payments ourselves; this is entitlement data, not billing data |
| Preferences | Theme, optional release-notes webhook URL (encrypted at rest), and where you're up to in any product tour or onboarding checklist | If you save a webhook on the release notes page, we POST to that URL when new notes are published |
| Spotify connection | Your Spotify Developer app's client ID and client secret, encrypted at rest (AES-256-GCM), plus your Spotify account's refresh token, also encrypted | This is what lets your queue actually control your Spotify playback |
| Two-factor authentication | If you turn on TOTP: an encrypted secret and hashed backup codes. If you register a passkey: the credential ID, public key, and a usage counter | |
| Session metadata | IP address and browser user agent tied to your login session, plus session timestamps |
When you run a queue, SpotiQueue stores the settings and history for that instance: its URL slug and display name, its feature toggles (fingerprinting, OAuth requirements, voting, prequeue review, explicit track bans, cooldowns, and similar), any vanity URLs you've set up, and a record of songs banned from that instance. It also keeps a log of guest queue attempts, votes, and any songs waiting for your approval, tied to the instance rather than to you personally.
| Category | What we collect | Notes |
|---|---|---|
| Device identifier | A random identifier stored in a cookie on your device | This isn't browser fingerprinting software, it's a randomly generated value we set ourselves |
| Username | Only if the host has turned on "require username" for that instance | |
| Linked login | An OAuth provider ID, username, and avatar, only if the host requires sign-in to use their queue | |
| Guest identity token | An opaque token stored in a cookie, hashed before we store it, used to recognise you if you return to a queue | |
| Queue activity | Songs you've requested or voted on, and their outcome (added, rejected, pending) |
If a host has an OAuth requirement or username requirement turned on, that identity information is visible to that host in their admin console. It is not shared with other hosts.
You must be signed in. From the account dashboard footer you can send general feedback or a feature suggestion.
| Category | What we collect | Notes |
|---|---|---|
| Feedback type | Whether you chose general feedback or a feature suggestion | |
| Message | The text you submit | |
| Account id | Your host user id | Required; used so we can identify your account |
| Account email | The email on your SpotiQueue account at the time you submit | Stored with the submission so we can reply |
Platform admins can read, update status on, and delete these submissions in the platform admin Feedback inbox.
Pro (and equivalent entitled accounts) can send async messages from the Account hub Support tab. We store one ongoing thread per account.
| Category | What we collect | Notes |
|---|---|---|
| Message text | What you send in the thread | Max 2000 characters per message |
| Account id | Your host user id | Required |
| Account email | The email on your SpotiQueue account | Shown to platform admins in the Pro support inbox |
| Thread status | Open or closed | Admins may close a thread; sending a new message reopens it |
Platform admins can read, reply, delete individual messages, and close threads in Platform Admin → Pro support. Messages older than six months are deleted automatically; admins may delete messages sooner.
Some preferences, like your theme, whether you've dismissed a tip on the big-screen display, and a short cache of the current queue, are stored locally in your browser rather than sent to our servers.
Our application writes structured logs, mainly for debugging and abuse prevention. These can include IP addresses and request details. Known sensitive fields (like passwords or tokens) are redacted before logging. We don't currently run these logs through a separate analytics or error-tracking product.
We don't run product analytics tracking (no Google Analytics, Mixpanel, or similar), we don't use a third-party error monitoring service, we don't store payment card details, and we don't knowingly collect information from children as part of a children's product. We also don't collect precise geolocation, government ID numbers, or biometric identifiers.
| Cookie | Purpose | Who it's set for | Lifetime |
|---|---|---|---|
spotiqueue.sid | Keeps you logged into your host account | Hosts | 24 hours, or up to 30 days with "remember me" |
fingerprint_id | Identifies your device on a queue | Guests | 365 days |
spotiqueue_guest_id | Persistent guest identity across visits | Guests | 365 days |
spotiqueue_guest_session | Access to a specific instance's queue | Guests | 365 days |
guest_oauth_binder | Proves an OAuth sign-in happened in the same browser | Guests, during sign-in only | 15 minutes |
| OAuth state cookies | Prevents cross-site request forgery during OAuth sign-in | Anyone signing in | Cleared once sign-in finishes |
We don't use cookies for advertising, and there's currently no ad network integrated into SpotiQueue. If that changes, this policy and the cookie table above will be updated first.
We use a small number of providers to run SpotiQueue. A full technical breakdown, including data centre locations and each provider's own compliance posture, is in our separate Hosting Provider Data Policies document. In summary:
We don't sell personal information, and we don't share it with data brokers or advertisers.
Our hosting infrastructure is provided by OVHcloud, and our production server currently runs in OVHcloud's Singapore data centre (this is subject to change; see the Hosting Provider Data Policies document for the current arrangement). Some of our other providers, including our OAuth providers and Spotify, process data in their own infrastructure, which may be located outside Australia, commonly in the United States. Where a provider is based outside Australia, we expect them to have their own safeguards in place, such as standard contractual clauses, and we choose providers that publish clear commitments around data protection. If you're in the EU, EEA, or UK, section 9 below has more detail on the safeguards that apply to these transfers.
Retention periods differ by data type, from minutes for one-time sign-in tokens through to indefinite retention for queue history until you delete your account or instance. The full schedule is set out in our Data Retention Policy, which this policy incorporates by reference.
We don't currently offer a self-service export or deletion tool for guests, since guest activity isn't tied to an account you control. You have two options: ask the host of the queue you used to reset guest data for their instance (which clears fingerprints, queue history, and votes for that instance), or contact us directly at [email protected] with details of which instance you used and we'll assist. If you signed in with an OAuth provider to use a queue, you can also unlink that connection through the guest interface, where available.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you can ask us for access to, or correction of, personal information we hold about you, and you can lodge a complaint with us directly or with the Office of the Australian Information Commissioner (OAIC) if you're not satisfied with our response.
This section applies on top of section 8 if you're located in the European Union, the wider European Economic Area, or the United Kingdom. It's written to reflect the GDPR and, for UK users, the UK GDPR and Data Protection Act 2018.
Who's responsible for your data. SpotiQueue is the controller for the personal information described in this policy.
Our legal basis for processing. We rely on different legal bases depending on what we're doing with your information:
We don't currently do anything that relies on marketing consent, since we don't send marketing email.
International transfers. Personal information is processed in Singapore (our hosting location) and, for some providers, in the United States. Where we or our providers move personal data out of the EEA or UK, we rely on recognised safeguards, such as the standard contractual clauses OVHcloud has in place with its own subsidiaries for data processed outside the EEA, and equivalent mechanisms used by our US-based sign-in and integration providers. If you'd like more detail on a specific transfer, contact us.
Your rights. Subject to the usual exceptions under GDPR/UK GDPR, you can ask us to:
We aim to respond to these requests within one month, extendable by a further two months for complex or numerous requests, as GDPR allows. You also have the right to lodge a complaint with your local supervisory authority, such as the Irish Data Protection Commission for most of the EU, or the Information Commissioner's Office (ICO) in the UK.
This section applies on top of section 8 if you're a resident of the United States. Comprehensive state privacy laws, most notably the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in states such as Virginia, Colorado, Connecticut, and Utah, give residents of those states a set of rights over their personal information.
What we collect, in CCPA terms. Mapped to the categories in section 2: identifiers (email, account and OAuth IDs, IP address), internet or network activity (logs, cookies, queue activity), and account/profile information (theme, plan, onboarding status). We don't collect the categories CCPA treats as sensitive personal information, such as precise geolocation, government ID numbers, or biometric data.
Selling and sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. Because of that, there's no "opt-out of sale or sharing" link on our site; if that ever changes, we'll add one and update this policy first.
Your rights. You can ask us to:
We won't discriminate against you for exercising these rights, for example by charging a different price or providing a lower level of service. You can use an authorised agent to make a request on your behalf, and if we decline a request, you can ask us to reconsider. To protect your information, we may need to verify your identity, typically by confirming details against your account email, before actioning a request.
Other US states. If you're in a state with a comprehensive privacy law not specifically named above, we'll honour requests consistent with that law's requirements on the same basis described in this section, contact us and we'll work out what applies.
SpotiQueue isn't directed at children and doesn't have an age verification step. If you're under 16, please only use SpotiQueue with the involvement of a parent or guardian; in the EU, the age at which a child can consent to online services without parental involvement varies by member state, from 13 to 16. In the US, we don't knowingly collect personal information from children under 13, consistent with COPPA. If we become aware that we've collected information from a child without appropriate consent, contact us and we'll delete it.
We take reasonable steps to protect the information we hold, including:
No system is completely secure, and we can't guarantee the absolute security of information transmitted to us. If we experience a data breach that's likely to result in serious harm, we'll follow the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the OAIC where required, and we'll meet any equivalent breach notification obligations that apply under GDPR/UK GDPR or US state law.
We may update this policy as SpotiQueue changes. If we make a material change, we'll update the "last updated" date above, and where appropriate, let account holders know by email.
Email [email protected] for anything relating to this policy, including access, correction, deletion, or other rights requests under any of the frameworks described above.
Questions? [email protected].
We use essential cookies to keep you signed in, run guest queues, and complete OAuth sign-in. We do not use advertising or third-party analytics cookies. Details are in our Privacy Policy.