MIXBACK

Privacy.

Last updated: October 4, 2026

On this page

Who is responsible for your data

The controller of the data described on this page is ABDULLAH TALAL KABLI Establishment, Riyadh, Kingdom of Saudi Arabia, which operates Mixback. Contact: support@mixback.app.

The Mac app

  • Your audio and your takes stay on your Mac: in the takes folder you choose and, when “Add each take to Music” is on, in the Music app on that Mac. Mixback never sends your recordings to us. Takes you add to Music follow your Music settings, which can sync them through iCloud. The free version needs no account. Pro will use an account, described below.
  • This covers your takes and the app. A track you choose to upload to your coin card on this site is different: we store it and anyone who opens your card can play it, as described under “Mixback coins”.
  • The app has no analytics, no telemetry and no ads. It connects to the internet only in the cases listed below.
  • Mixcloud is used only when you ask. Connect opens Mixcloud’s sign-in in your browser. This site trades the one-time code from that sign-in for a Mixcloud token and passes the token to the app; it never logs or stores the code or the token. The token is kept in your Mac’s keychain, and Disconnect in Settings removes it.
  • A take is sent to Mixcloud only when you press Post to Mixcloud. It goes straight from your Mac to Mixcloud, unlisted by default (only people with the link can play it), with your Mixcloud username as the artist.
  • While Mixcloud is not connected, opening the takes page or Settings asks this site once whether the Mixcloud sign-in is available. The request carries nothing about you or your takes beyond what every web request carries, such as your IP address.
  • Mixback can check for updates: once a day while “Check for updates daily” is on in Settings, and whenever you press Check. It reads one small file from this site and sends nothing else beyond what every web request carries, such as your IP address. The site adds one to that day’s count of update checks, a number that records nothing about you or your Mac (see “This site”).

This site

  • When you join the Pro early-access list we store your email, what you mix on, when you joined and which version of the consent text you agreed to, the campaign tag in the link you used (if it had one) and your browser family, such as “Safari on Mac”.
  • We use it only to email you about Pro early access and Mixback news.
  • Giving us your email is optional. You need it only to join the Pro list or claim a coin; the app works without it.
  • Our legal basis is your consent (GDPR Art 6(1)(a)). You can withdraw it at any time with the unsubscribe link or by emailing support@mixback.app.
  • When you unsubscribe we stop emailing you and clear the rest of your entry, except your address, the consent record, any Pro time a coin gave you, and the date you unsubscribed, so we never email you again and can show what you agreed to (our legitimate interest in honoring your choice and proving consent, GDPR Art 6(1)(f)). Email support@mixback.app to have that deleted too. Otherwise we keep your entry until you unsubscribe or ask us to delete it. Pro is not open yet; when it opens, we will post here how long we keep the entries of people who do not buy it.
  • It is kept in a Cloudflare D1 database. We do not sell it. Only the providers listed in “Where the data is kept and who handles it” handle it, on our instructions.
  • To stop repeat tries at the signup form, the Mixcloud sign-in, Pro code redemption, coin taps, coin codes, edit link requests and card reports, we keep a salted hash of your IP address, never the address itself. The date is part of the hash, so it changes every day. For photo and track uploads and for edit link requests we also count tries per coin, under a salted hash of the coin’s chip ID. Entries older than a day are deleted the next time any of these limits counts a try. Our legal basis for this is our legitimate interest in stopping abuse (GDPR Art 6(1)(f)).
  • Apart from the one cookie described under “Mixback coins”, this site sets no cookies and runs no tracking. The only measuring it does is daily counts: how many times each day the app is downloaded, the update file is read (mostly the app’s daily check), a coin is tapped, a claim page is opened, a claim goes through or is refused (and for which reason), the card editor is opened, and a card, photo or track is saved. Each count is a date, a step and a number. It holds no IP address, device, browser, email, name or coin. Cloudflare, which hosts it, handles each request like any web host, and may ask your browser to report connection errors to it.
  • This site does not track visitors across other sites, so it treats every visit the same whether or not your browser sends a Do Not Track signal.
  • You can unsubscribe from any email we send.

Mixback coins

When you claim a Mixback coin on this site, we store your email, your DJ name, the coin’s pressing number and chip ID, a page address made from your DJ name, the time you claimed it, and a record of the 1 year of Mixback Pro that comes with the coin. We use them to bind the coin to you and to give you that Pro time (performance of our agreement with you, GDPR Art 6(1)(b)). If you also checked the news box, we email you Mixback news (your consent, GDPR Art 6(1)(a)).

Your card is public. Claiming a coin makes a card on this site, at /dj/ followed by your page address. Anyone who taps your coin or opens that address sees it. It shows your DJ name, the coin number, the card design and whatever else you add: a city, up to three links, a photo and one track. Its Save contact button gives a contact file with your DJ name, city, links, coin number and the card address, never your email. We store the photo and the track in Cloudflare R2 storage and the rest in our database (performance of our agreement with you, GDPR Art 6(1)(b)). Before a photo is stored, the parts of the file that do not draw the picture, such as EXIF data with a location, are removed. You can hide the card, remove the photo, or remove the track at any time in the card editor. A hidden card shows only that it is hidden, and its photo and track stop playing. Card pages ask search engines not to index them.

Tracks. If you add a track to your card, we store the file, its title, its kind (original, edit or remix), its length, its size, the waveform shown on the card and a fingerprint of the file (SHA-256), and anyone who opens your card can play it until you remove it. If we take a track down after a rights notice, we keep its fingerprint so the same file cannot be uploaded again. The rules for what you may put on a card are in Coin cards and tracks in our terms.

Tap places. When someone taps your coin and the tap checks out, we store the time and the city and country that Cloudflare reports for the connection, never the IP address. Your card shows up to five recent cities, for example “Tapped in Riyadh and Amsterdam” (our legitimate interest in showing where the coin has been, GDPR Art 6(1)(f)). Hiding the card hides them too.

The edit cookie. This site sets one cookie, named mb_edit, and only after you claim a coin or use an edit link from your email. It keeps you signed in to your card editor on that phone. We set it ourselves, it is marked HttpOnly and Secure, it lasts 400 days, and it is used for nothing else. Without it you can still tap the coin and ask for a new link. The card editor also keeps a draft of your card in your phone’s local storage, so a call or a locked screen does not lose your work.

Edit links. If you ask to edit your card on a new phone, we email a one-time link to the address you claimed with. It works once, for 30 minutes. We store only a hash of the link, the coin and the times, never your address. Stored links older than a day are deleted whenever a new link is made.

Keeping and deleting. We keep your claim and card while the coin is active. Email support@mixback.app from the address you claimed with to have your claim, card, photo, track and tap records deleted; we answer within 30 days.

Reporting a card

When you report a card with its Report link, we store what you wrote, the email address if you give one, the card you reported, the time, and a salted hash of your IP address. The hash is cleared from reports more than a day old the next time anyone files a report. We email what you wrote, the card and the time to our support mailbox so a person reads it; that email does not carry your email address or the hash. We use your report to review the card and, if you gave your email, to answer you (our legitimate interest in keeping cards lawful, GDPR Art 6(1)(f)). Reports have no fixed deletion date yet; email support@mixback.app to have yours deleted.

Pro accounts (planned)

Pro is not open yet. When it opens, Pro will use an account. You will sign in with a one-time link sent to your email. When you create a Pro account or redeem a Pro code, we will store:

  • your email address;
  • the one-time sign-in links we send, kept until used or expired;
  • your Pro status: plan, start and end dates, and the Paddle customer and subscription IDs that link your account to your purchase;
  • the Macs that use your Pro license, as a random device ID we create and the device name you see in the app;
  • promotional codes you redeemed and when;
  • the date and time of each license check.

Why: to give you Pro and keep it working (performance of our contract with you; GDPR Art 6(1)(b)), and to stop license and code abuse (our legitimate interest; GDPR Art 6(1)(f)).

We do not store your name, postal address, or card details. We do not receive your recordings.

Payments through Paddle

Paddle.com is our reseller and the Merchant of Record for purchases on our website. Paddle collects your payment details, billing country, and tax information, and uses them as an independent controller under its own privacy policy (paddle.com/legal/privacy). Paddle tells us your email address, country, plan, and payment status so we can give you Pro. We never see your full card number.

Emails we send

  • Service emails: the link to edit your coin card on a new phone, sign-in links, receipts and renewal reminders (some sent by Paddle), and notice of changes to your subscription or these terms. You cannot opt out of these while you hold Pro, because they are part of the service.
  • News about Mixback: only if you opted in. Every such email has an unsubscribe link.

Support email

When you email support@mixback.app or use Help > Report a Problem in the app, we receive your email address, your message and any logs you chose to include (up to the last 200 lines of each). We use them only to answer you. Our legal basis is our legitimate interest in answering you (GDPR Art 6(1)(f)). The mailbox is hosted by Google (Google Workspace).

Where the data is kept and who handles it

  • Cloudflare, Inc. hosts this site, its database (Cloudflare D1) and the storage for card photos and tracks (Cloudflare R2). Cloudflare processes the data on our instructions.
  • Resend, Inc. sends our emails from hello@mixback.app: today the link that lets you edit your coin card on a new phone and the alert for each card report, and, when Pro opens, Pro sign-in and account emails.
  • Paddle, as described above.
  • Google hosts the support mailbox (Google Workspace), which receives your emails to us and the card report alerts.

These providers may process data outside your country, including in the United States and the European Union. We are based in Saudi Arabia. For transfers to our providers we rely on their data processing terms, which include the EU standard contractual clauses. The Saudi (SDAIA) standard contractual clauses and transfer risk assessments are being put in place with each provider.

How long we keep it

  • Pro account data: while your account is active, then deleted 90 days after you close it or after your last Pro period ends, whichever is later.
  • Records we must keep for tax or accounting are kept by Paddle as Merchant of Record; we keep our own payout records for the period Saudi law requires.
  • When Pro opens, license check logs will be kept for 30 days.
  • Coin claims, cards, photos, tracks, tap records and card reports: as described under “Mixback coins” and “Reporting a card”. Apart from the salted hashes and edit links, which are cleared after a day, nothing here is deleted on a schedule yet; we delete it when you ask.

Your rights

  • You can ask to see, correct, or delete your data, get a copy in a readable format, restrict processing, object to processing based on legitimate interest, or withdraw any consent you gave (the Pro list or news emails). You can hide your coin card yourself at any time in the card editor. Email support@mixback.app from the address you gave us. We answer within 30 days.
  • You can close a Pro account at any time by emailing support@mixback.app. Closing it ends Pro; cancel any paid subscription first, from the link in your Paddle receipt email, so it does not renew.
  • If you are in the EU or the UK, you may complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the United Kingdom it is the Information Commissioner’s Office (ico.org.uk). In Saudi Arabia it is SDAIA.

Security and breaches

Data travels over HTTPS and is stored with access limited to us. Sign-in links are single use and expire. If a breach puts your data at risk, we will notify the authorities and you as the law requires (for Saudi Arabia: SDAIA within 72 hours, and the Ministry of Commerce and you within 3 days; for the EU: the data protection authority of each affected country within 72 hours; for the UK: the Information Commissioner’s Office within 72 hours).

Children

Mixback is not directed at children under 16. We do not knowingly collect data from them, including for the Pro list, coins, news emails or Pro accounts.

Changes

We post changes here with a new date. For a material change we email Pro account holders before it takes effect.

Contact

Back to Mixback