Privacy Policy

Privacy Policy

1. Why do we collect information?

MeshMelo collects and uses the minimum information necessary to identify Members, enable login and account linking, prevent unauthorized access, provide playlists, community boards and other member functions, and handle important notices and inquiries. Acceptance is not consent to promotional messages or third-party marketing disclosures.

2. Information required at registration

Required information includes Member identifier, nickname, email, registration and last-access dates, registration and last-access IP addresses, and consent records. For registration with a username and password, we process a login ID and a one-way-hashed password; an additional name field is shown when required by the chosen registration method. With Google registration or linking, we obtain the unique Google account identifier and verified email to check existing links. We do not obtain Google passwords and do not automatically display Google real names or profile photos publicly. Other social-login providers supply only the information presented in their consent and registration interfaces.

3. Information generated during use

Playlists, posts, comments, reports, inquiries, and essential activity records are created when those features are used. Artist registration may involve YouTube channel IDs, public channel information, channel management verification results, and credentials needed to maintain an authorized link. Where additional information such as phone verification is required, the relevant screen explains its purpose, fields, and whether it is mandatory. Do not submit national identification numbers, sensitive data, or unnecessary third-party personal information in posts or evidence.

4. Who can see the information?

Nicknames, artist introductions, and content you choose to publish can be visible to the designated audience. Email addresses, passwords, internal account identifiers, and other artists connected to one Member's account are not shown to ordinary visitors. Anonymous posts do not publicly display their authors' accounts. Only personnel whose work requires it may access internal information for reports, security, and protection of rights. Information may be supplied to lawful recipients when legally required or separately consented to, limited to what is necessary.

5. How long is information kept? — Principles and exceptions after withdrawal

Personal information necessary for Membership is normally held until withdrawal or fulfillment of the collection purpose, then destroyed without undue delay. Generalized long-term storage of everyone's data merely because a future dispute is possible is not justified. If applicable law requires specific records to be retained, only those records may be separately held for the statutory period after withdrawal or revocation. Where actual e-commerce transactions trigger statutory recordkeeping, contracts and cancellations are held for five years, payment and supply records for five years, consumer complaints and dispute records for three years, and advertising records for six months. These are not general retention periods for every free Member.
If a concrete ongoing report, litigation, or investigation legally requires preservation, only relevant minimum records are retained with restricted access on a verified legal ground. Abstract dispute risk or civil limitation periods alone do not justify retaining all personal data indefinitely. To the extent lawful, we disclose the reason, affected fields, duration, or termination criteria and do not use the records for unrelated purposes. When the statutory period or justified preservation ground expires, records are deleted promptly even without an additional request; any remaining lawful obligation is confined to the minimum necessary scope.

6. How are records deleted and protected?

Digital information is deleted by methods designed to prevent recovery or reproduction; paper documents, if any, are shredded. Records retained by law are segregated from ordinary service data and access is restricted. Backup and restoration controls prevent information scheduled for destruction from returning to active service use. We apply access controls, password safeguards, secure communications, and personnel restrictions appropriate to the information.

7. Can I refuse or withdraw consent?

You may refuse mandatory personal-data collection and use, in which case account creation and corresponding member-only features cannot be provided, while publicly available music and pages remain accessible without membership. Declining optional data or marketing messages must not unjustifiably limit core member services. You may request access, correction, deletion, cessation of processing, and withdrawal of consent using account settings or the contact address below. We will verify your identity and respond as required by law, explaining any lawful restrictions and available remedies.

8. Authentication, processors, and international processing

Google, YouTube and other authentication services are also governed by their respective privacy policies. If MeshMelo uses external providers for hosting, security, or file storage, or transfers personal data abroad, it publishes separate information identifying actual recipients, tasks, destination countries, data categories, timing and methods, retention, legal grounds, and exercise of rights and carries out legally required notices or consents. General acceptance of these registration terms is not blanket consent to unspecified overseas transfers or third-party disclosures.

9. Login persistence and inquiries

Necessary cookies and session information may be used for login persistence and security. You may restrict or delete browser cookies, which can limit login and related features. Optional advertising and analytics are governed by separate information and controls where required. For privacy inquiries and rights requests, use the contact channel below. You may seek assistance from competent personal-data protection and dispute-resolution authorities if needed.

Google User Data Processing Notice (2026-10-11)

a. Data accessed through Google Sign-In and YouTube API; purposes

If you choose Google Sign-In, MeshMelo obtains your Google account identifier (sub) and verified email for account creation, linking, login, and protection against impersonation. We do not collect your Google password, and we do not publicly display your real name or profile picture without authorization. If an artist separately requests YouTube channel verification, the read-only YouTube Data API permission (youtube.readonly) allows us to inspect channels managed by that Google account, including channel IDs, names, handles, descriptions, thumbnails, subscriber counts, public videos, and statistics as needed for verification and eligibility. We link only the selected channel and proof of control to the MeshMelo account. Other channels viewed during verification are not registered as public artist profiles unless you choose them. We do not use the permission beyond channel lookup, public statistics, uploading eligibility, and optional channel-growth records for approved channels.

b. Storage and retention of Google user data

The Google identifier, email, selected channel ID, verification result, and other information needed for account linking may be stored in service databases. Short-lived access tokens for proving control of a channel are handled temporarily within server-side authentication sessions. A refresh token is encrypted and stored only if the user separately approves the optional channel-growth connection, for checking approved channel statistics. Regular sign-in or one-time channel verification does not itself store a long-term refresh token. Information no longer needed is deleted on withdrawal, unlinking, deletion request, or expiration of purpose, except for narrowly restricted legally required records and ongoing lawful disputes; those records are deleted when the relevant ground ends. You may revoke Google third-party access at https://myaccount.google.com/permissions. Revoking access at Google may not automatically remove MeshMelo's previously stored account or channel records; you can separately request their deletion.

c. Recipients, sharing, and disclosures

Google LLC / YouTube: When you opt for Google Sign-In or YouTube verification, your browser and MeshMelo exchange OAuth requests and channel queries with Google, whose own privacy terms also apply.
FastComet: As our website and database host, it may process account email, Google linking identifiers, and verification results to deliver hosting services, not for its own advertising.
Cloudflare, Inc.: As security, CDN and R2 provider, it may process visitor IPs and request metadata and store or deliver public media. It does not receive public media files containing Google passwords or private growth-feature refresh tokens.
Public visitors: Only the artist channel name, URL, description, artwork, and public statistics or content you elect to publish are visible. Google email, account identifiers, private tokens, and unselected channel lists are not publicly disclosed.
Advertising and outbound links: The destinations may process network data or cookies under their own terms; we do not sell or transfer private Google login emails, account IDs, or tokens to advertisers, data brokers, or third parties for personalized advertising or generalized AI model training.
Lawful disclosure: We may provide only necessary information in response to valid legal requests; new separately requested or consent-based disclosures will be explained in advance where required.
Details of actual processors, countries, and cross-border transfers are provided under “Current External Processing and Cross-Border Notice” below and updated when operating arrangements change.

d. How authentication and personal data are protected

HTTPS/TLS protects website and OAuth/API communications. Google Sign-In implements state, nonce, and PKCE checks against tampering and replay; YouTube channel verification uses server-side state and expiration checks. Passwords for local accounts are one-way hashed; we do not receive Google passwords. Optional long-term YouTube refresh tokens are encrypted in the database with AES-256-GCM; short-term access tokens have limited use and expiry, and OAuth secrets are kept outside public web paths. Role-based access limits protect member records, verification data and administration, while forgery checks are applied to administrative changes. Sensitive credentials are not intentionally exposed in error messages. Expired records are deleted or segregated where lawful retention is required. These descriptions reflect implemented source safeguards; the Operator must maintain HTTPS, database permissions, backups, updates, and incident procedures in production.

e. Your choices and contact

Public functions available without Google Sign-In remain accessible. You separately authorize channel ownership verification and optional growth records, and may revoke unwanted authorization in your Google account. You can request account access, correction, deletion, unlinking, or clarification of data uses and security using the contact below.

Google User Data & Security — English Summary

MeshMelo uses the Google account identifier and verified email for sign-in and account linking. Separate consent enables read-only YouTube verification and optional channel-growth statistics. Public selected channel information may be displayed; private Google identifiers, email and OAuth tokens are not publicly disclosed or sold. Google operates authentication and YouTube APIs, FastComet hosts account databases, and Cloudflare provides security, CDN and media delivery. We use HTTPS, limited access, short-lived credentials, and AES-256-GCM encryption for optional refresh tokens. Google access may be revoked, and MeshMelo-held records may be deleted on request according to law.

Current External Processing and Cross-Border Notice

Effective date: 2026-10-12 · Operator and privacy contact: MeshMelo · service@meshmelo.com