Privacy

Last updated 20 October 2026

Pass the Aux is a small DJ app made by Small Victories. This page says what it keeps about you, and why.

Who runs Pass the Aux

Small Victories BV, Mellestraat 303, 9090 Merelbeke-Melle, Belgium · enterprise number BE0793.301.929 · [email protected]. Small Victories BV is responsible (the controller) for the data described here.

If you have an account

• Your login: your username, your password (stored only as a salted hash), and the two-factor sign-in secret and recovery codes (the codes stored only as hashes). If you skip two-factor sign-in, the secret is removed.
• Your library: the music you add, its cover art, and what the app works out about each track (tempo, key, energy, beat grid), plus the crates you make. It is private to your account.
• Record stores you connect: the name, address and access key you enter, so the app can search them for you. When you search or import from one, the server sends your search to that store.
• To fill in cover art and track details, the server may look up a track's artist and title in public music databases. Nothing about you is sent with it.

If you join a party as a guest

You don't need an account. The first name you give, your requests and your votes are shared with the DJ and the other guests of that party. The server keeps the party in its database so it survives a restart: your requests with your first name, and your votes under a random guest number your browser makes up (not your name). Your name and votes are also remembered in your own browser, so you don't have to type them again.

Why

• Your account, library and parties: to provide the service you use (GDPR art. 6(1)(b)).
• Backups and protection against abuse: our legitimate interest in a safe, reliable service (art. 6(1)(f)).
• Analytics: only with your consent (art. 6(1)(a)), which you can withdraw at any time.

Pass the Aux doesn't sell data, show ads or send marketing email.

Who else receives it

• Oracle Cloud Infrastructure: the servers, the database and the storage for your music, in Amsterdam (EU).
• Hetzner Online (Germany): an encrypted copy of the nightly backup and of the music storage, in the EU.
• Cloudflare: DNS, the secure connection to the site and protection against attacks. It sees your IP address and the pages you request.
• Google: fonts on some pages, and analytics only if you accept (see below).

Cloudflare and Google may process data outside the EU; those transfers are covered by the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

How long it is kept

• Your account and library stay until you ask us to delete them. There is no delete button for those, so mail us.
• Crates and record stores you delete in the app are deleted at once.
• Backups: the database is backed up every night and each backup is kept for 30 days; music files you no longer have are kept in the backup copy for 30 days. So deleted data is gone from the backups within about 30 days.
• Parties are deleted 48 hours after the last activity. A party can still be in a nightly backup for up to 30 days after that.
• Your browser: your settings, guest name, votes and cookie choice stay until you clear your browser's storage.

Cookies and your browser

• Sign-in cookie (dj_sess): keeps you signed in for up to 7 days. It is needed for the app to work.
• Local storage: your settings, your guest name and votes, and your cookie choice. They stay in your browser.
• Fonts: the guest and mobile pages load a font from Google Fonts, which means Google sees your IP address.

Analytics, only if you say yes

To see how many people use the app, it can use Google Analytics, loaded through Google Tag Manager.

• Nothing is tracked until you accept. A banner asks first. Until you click Accept, Google Analytics is told consent is denied and sets no cookies. Reject keeps it that way.
• If you accept: it counts the pages you open, where you came from, your approximate country, and your device and browser type, using the cookies _ga and _ga_…. The music you play, request or search for is never sent. Advertising cookies stay off, whatever you choose.
• Who processes it: Google, possibly outside the EU. See how Google uses data from sites like this one.
• Changed your mind? Click Cookie settings (also at the bottom of the sign-in page) and choose again. If you reject, analytics stops and the Google Analytics cookies are removed.

Your rights

You can ask for a copy of your data, have it corrected or deleted, object to or restrict its use, and withdraw consent at any time. Mail [email protected]; we answer within one month. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority where you live.

Back to Pass the Aux