Privacy Policy
Last Updated: July 23, 2026
Data We Collect
When you connect your accounts, TIKO Music accesses, collects, and stores the following information:
- From YouTube API Services: Your playlist names, video titles, video publish dates, and playlist item counts. This data is accessed via the YouTube Data API v3.
- From Spotify: Your playlists, saved/liked tracks, top artists, and listening history. This data is accessed via the Spotify Web API.
- From SoundCloud: Your liked tracks and playlists, used to build your music taste profile. This data is accessed via the SoundCloud API.
- Account Information: Your email address (via Sign in with Apple, Google, or a connected music service), used for account identification and login authentication.
- Approximate Location: Your city or coordinates (which you provide or allow), used only to find and rank events near you. We do not track your precise location in the background.
How We Use Your Data
We use the data collected from your connected services to build your personal music taste profile. This includes computing genre preferences, artist affinity scores, and personalized event match scores. Match scores are calculated entirely by TIKO Music and are not provided by or affiliated with YouTube, Spotify, or Google.
Data Sharing:
- We do not sell, rent, share, or transfer your data (including YouTube API data) to any third party.
- We do not share data with external analytics, advertising, or data brokerage services.
- Your data is processed exclusively within TIKO Music's servers for the sole purpose of computing your taste profile and event recommendations.
- No YouTube API data is shared with any internal or external parties beyond the core TIKO Music service.
TIKO Music's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and Device Storage
TIKO Music uses the following technologies that store or access information on your device:
- Session Cookies: Used for authentication to maintain your login state. These are essential cookies required for the app to function.
- Local Storage: Used to cache UI preferences such as selected tab state and display settings.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. No YouTube API data is stored on your device — all API data is processed and stored server-side only.
Data Retention
Raw YouTube API data (playlist names, video titles, publish dates) is stored for a maximum of 30 days. For active users, this data is automatically refreshed every 3 hours to ensure accuracy and freshness.
TIKO Music also computes derived metrics (genre preference percentages, artist affinity scores, event match scores) from your connected service data. These derived metrics are TIKO Music's own calculations and do not contain or reproduce raw API data.
Revoking Access and Deleting Your Data
You can revoke TIKO Music's access to your YouTube data at any time via Google Security Settings.
When you revoke access:
- TIKO Music's YouTube access tokens are immediately invalidated.
- Your YouTube provider is marked as disconnected in TIKO Music.
- All raw YouTube API data is automatically purged within 30 days per our retention policy.
To request immediate deletion of all your stored data, contact us at [email protected].
Data Protection & Security
TIKO Music protects your data, including sensitive data obtained from connected services such as Google user data, with the following mechanisms:
- Encryption in transit: All communication between your device and TIKO Music servers, and between TIKO Music and YouTube, Spotify, SoundCloud, Google, and Apple APIs, is encrypted using HTTPS/TLS. No API data or credential ever travels over an unencrypted connection.
- How your data is stored: Google user data (playlist names, video metadata) and OAuth access/refresh tokens are stored server-side in TIKO Music's database, which runs on our production server and accepts connections only from that server — it is not reachable from the public internet. Google user data is never placed in browser storage (localStorage or readable cookies): your browser session is maintained by an encrypted, HttpOnly session credential that page scripts cannot read, and OAuth tokens are never written into application logs. On mobile, TIKO Music stores its session credential in the operating system's secure storage (iOS Keychain / Android Keystore).
- Automated processing — no human access: Google user data is read and processed only by TIKO Music's automated backend services, for the sole purpose of building your music taste profile and event recommendations. It is not read by humans in the normal operation of the service; narrow exceptions (debugging with your consent, security investigation, or compliance with applicable law) follow Google's Limited Use policy.
- Least-privilege access: TIKO Music requests only read-only scopes (for example, YouTube read-only access). We cannot modify, post to, or delete anything on your connected accounts.
- Access controls: Your data is accessible only through your own authenticated session. Production infrastructure access is restricted to key-based authentication for authorized operators and is used only for maintenance and incident response.
- Limited retention and deletion: Raw API data is retained for a maximum of 30 days (see Data Retention above). Account deactivation and deletion requests permanently remove stored data, including OAuth tokens and raw API data. You can also revoke TIKO Music's access at any time from your Google account settings (see above).
- No sale or third-party transfer: Sensitive data, including Google user data, is never sold, rented, shared, or transferred to third parties, including analytics or advertising services. Data leaves our systems only as required to provide the service itself (for example, authenticated requests to the YouTube API on your behalf).
- Incident response & breach notification: If we become aware of a security incident affecting your data, we will promptly investigate, contain, and remediate it, revoke or rotate any affected credentials, and notify affected users at their account email without undue delay.
Contact
If you have questions about this privacy policy or your data, contact us at:
Email: [email protected]