Privacy

Last updated 5 October 2026 · På svenska

Who we are

Trackback is a free music game in beta, made by Jacob Johansson in Sweden, who decides how the data below is used (the “data controller” under the GDPR). Questions, or requests about your data: hello@trackback.site.

What we store

• Your account, if you make one. Your email address (to send you sign-in codes and know it's you), the name and colour you pick, and when you made the account. Players who know your exact name can send you a friend request; friends and players you exchange requests with see your name and colour, never your email. Signed in, each device you play on also saves the records its Stats page shows (best scores and streaks, Daily Sort results, songs heard and placements per decade) to your account, under a random ID for that device, so Stats can add them up everywhere you sign in.
• Friends and friend requests. The two accounts, who sent the request, when it was sent, whether it is pending, accepted or declined, and when it was accepted. Only the two players see their friendship or request. A declined request still looks sent to its sender. Removing a friend or cancelling a sent request deletes it; deleting either account deletes it too.
• Online status. When you have the app open, accepted friends can see whether you are online. “Show when I'm online” is on by default in Settings; turn it off and friends see you as offline, while you can still see them. We keep no last-seen times or online history. Cloudflare holds only the current socket state while connected and for a 10-second reconnect grace, then deletes it. Your visibility preference is saved with your account.
• Challenges. When you challenge an online friend, Cloudflare passes your account name, avatar colour and a 1v1 or Jam session room code only to that friend. Each friend gets their own invitation, which never names the other invited players. Replies and cancellations go between the two accounts. The invite lasts 60 seconds and is not stored. A per-account counter limits challenges for a minute to prevent spam; it contains no invite or room code. The room itself follows the online-match rules below.
• Your games. Which songs you were dealt, where you placed them, your guesses and your score. A game is linked to a random ID, not to you, so we can't tell who played it.
• Online matches. The nicknames you and your friend type, the match code, and the game itself. Pick a nickname that isn't your full name.
• Feedback you send. Your message, what kind it is (a bug, a wrong year or an idea) and which song it's about. Feedback from a match also includes that match, with both nicknames, so we can see what happened.
• Abuse protection. To stop anyone flooding the game with requests, we count requests per visitor using a one-way scramble (a hash) of the IP address that changes every day. It can't be turned back into the address, and the counts are deleted after a day. Signed-in friend requests and changes are also counted per account for up to an hour.

Your account is kept until you delete it. "Delete account" on the Me page deletes it straight away, with your name, email address, friends, requests and the records saved to it. You can also email us and we'll delete it within a month.

We keep games, matches and feedback while the beta runs, to fix bugs and improve the song list. Ask us and we'll delete anything you can point us to, such as a match code or a feedback message you sent.

What stays on your device

Your settings (language, theme, sound, motion, and each game's settings), which game you last started, your best scores and streaks, how many games you've played, your Daily Sort results, what your Stats page counts (songs heard, artists named, and how many songs from each decade you placed right), your nickname, and the game or match you're in are saved in your browser's storage. They never leave your device, apart from the nickname, which is sent when you start or join a match, and the game or match, which is sent to our server to pick it up again after you reload the page. Clearing this site's data in your browser removes them. If you sign in, your login is kept there too, until you sign out, along with a random ID for this device.

Trackback sets no cookies of its own. Cloudflare may set a short-lived security cookie (__cf_bm) that tells people from bots; it's needed to keep the site running and isn't used for tracking.

Who else sees data

These services run parts of Trackback for us:

• Cloudflare hosts the site and protects it from attacks. It sees your IP address to deliver the page, and counts visits without cookies (Cloudflare Web Analytics). Its privacy policy.
• Supabase runs the game server, the database and signing in, in the EU (Stockholm). Its servers see your IP address in short-lived request logs. Its privacy policy.
• Resend sends the emails with sign-in codes, so it sees your email address and the email itself. Its privacy policy.
• Deezer provides the 30-second song previews and album covers. Your browser loads them straight from Deezer's servers, so Deezer sees your IP address and which previews were played. Its privacy policy.
• Google (Gmail) holds our inbox, so if you email us, Google stores that email.

Cloudflare, Google and Resend are US companies. They transfer data under the EU–US Data Privacy Framework or the EU's standard contract terms.

Why we're allowed to

We handle this data because we have a legitimate interest in running the game, keeping it safe from abuse and fixing what goes wrong (GDPR article 6(1)(f)). Feedback is only stored because you choose to send it. An account is handled because you asked for one: we need it to give you the account (article 6(1)(b)). The same basis applies to the friends list, requests, challenges and online status you choose to use.

Your rights

You can ask to see, correct or delete data about you, get a copy of your account's data, or object to how we use it. Email hello@trackback.site and we'll answer within a month. If you think we've got it wrong, you can complain to the Swedish data protection authority, IMY, or the one where you live.

Children

Anyone can play Trackback without an account or any personal details. Accounts are for people aged 13 or older. If you're under 13, use a made-up nickname and ask a parent before sending us feedback or email.

Changes

When Trackback starts storing something new (friends, for example), this page will say so first, with a new date at the top. The terms of use say what you agree to with an account.