Skip to content
MIXVA

Legal

Privacy Policy

Last updated:

This policy describes what personal data shakthi.xyz and the Mixva beta collect, why, how long it’s kept, and the rights you have under the EU General Data Protection Regulation (GDPR). Plain language wherever possible; the legal shape is Art. 13/14 GDPR.

1. Who runs this site

Shakthi Prasad Kizhikki Thara, based in Berlin, Germany. Full contact details on the Impressum page. For questions about your data, email hello@shakthi.xyz.

There is no separately appointed Data Protection Officer. The site is small enough that Art. 37 GDPR does not require one. The controller and the contact are the same person.

2. What we collect, and why

2.1 Account signup (Mixva)

When you create a Mixva account, we store your email address and a bcrypt hash of your password (never the plaintext). If you sign in with Google, we store the verified email address and Google’s stable subject identifier (sub): enough to recognise you on the next sign-in, nothing more from your Google profile. Optional display name if you choose to set one.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We need the account to provide the service.

2.2 Sessions & auth cookies

When you sign in, we issue a signed session cookie (xyz_session) and store the session record server-side with your IP address, user-agent, expiry, and a server-side revocation flag. Sessions last 30 days. During Google sign-in, a short-lived google_oauth_state cookie is used to prevent CSRF and cleared immediately after the callback.

Legal basis: contract performance (session cookie is strictly necessary to keep you signed in) and legitimate interest in fraud + abuse detection (IP + user-agent) under Art. 6(1)(f) GDPR.

2.3 Beta waiting-list signup

The public Mixva beta form captures your email address, a self-selected role (DJ / producer / label / other), the request IP, and user-agent. We use the email to invite you when a beta slot opens; role helps us prioritise a balanced first cohort; IP + user-agent are stored so we can distinguish real signups from bot spam.

We also record the exact moment you ticked the “I have read the Privacy Policy” checkbox on the form as a durable, per-row timestamp. This is our proof-of-consent record under Art. 7(1) GDPR. You can request its contents any time.

Legal basis: consent (Art. 6(1)(a) GDPR). You actively submit the form and tick the consent checkbox before it will let you through. You can withdraw consent by emailing us to remove your entry.

2.4 Mixva desktop licence tokens

When the desktop app is signed in, we store one licence-token row per device: a device label (user-supplied, e.g. “Shakthi’s iMac”), issued-at + expires-at timestamps, and a lastSeenAt that is bumped whenever the app validates its token with the server. This lets you revoke a device from the account and lets us end a compromised session server-side.

Legal basis: contract performance (the licence is what authorises the desktop app).

The desktop app does not upload your audio files, your rendered mixes, or your identified tracklists to our servers. All audio processing is local; the only network traffic to shakthi.xyz is licence validation.

2.5 Audit log

Sensitive account events (sign-in, sign-out, admin actions, licence issuance, licence revocation) are appended to an audit log with the actor’s user id, the request IP, and a small action-specific metadata payload. This is a security record and lets us investigate suspicious activity.

Legal basis: legitimate interest in the security + integrity of the service (Art. 6(1)(f) GDPR).

2.6 CMS admin (single-password)

A single-password gate protects the site’s content management at /admin. When the correct password is entered, a signed admin_session cookie is set with a 7-day expiry. Only the site’s owner uses this surface; no personal data of visitors passes through it.

2.7 Analytics & performance telemetry

We use Vercel Analytics + Speed Insights to see how the site performs (page views, route latencies, Web Vitals). Per Vercel’s documentation these are cookie-less and do not identify individual visitors; readings are aggregated into anonymous, IP-anonymised metrics. No advertising network, no cross-site tracking, no Google Analytics.

Legal basis: legitimate interest in understanding aggregate site usage (Art. 6(1)(f) GDPR). If you’d rather not contribute even to the anonymous aggregate, a network-level tracker blocker (uBlock, Ghostery, or your browser’s built-in) will stop the telemetry beacon at the source.

3. Cookies we set

  • xyz_session : 30-day authenticated session for the site + Mixva account. HttpOnly, SameSite=Lax, HMAC-signed.
  • admin_session : 7-day session for the CMS at /admin. Owner use only.
  • google_oauth_state : transient (a few minutes) during Google OAuth. Set on “Continue with Google”, cleared on the callback, used only to prevent CSRF.

No advertising, tracking, or third-party analytics cookies are set by this site.

4. Retention

  • Accounts + associated data: until you ask us to delete them. Deleting an account cascades to sessions and licence tokens.
  • Sessions: automatic expiry after 30 days, or immediately on sign-out / server-side revocation.
  • Beta requests: retained until the beta period closes or you ask us to remove your entry, whichever is sooner.
  • Audit log: retained for the operational lifetime of the service. A future cron will age off entries older than 12 months; that’s a follow-up.
  • Analytics: Vercel’s standard retention (approximately 12 months for detailed metrics; aggregate dashboards persist beyond).

5. Who else touches this data

We use a small set of well-established processors. None of them receive more than they need for the specific task; all of them are contractually bound by GDPR-compliant data processing agreements.

  • Vercel (USA / EU): application hosting, Blob storage for CMS uploads, analytics, and speed insights.
  • Turso (edge SQLite): primary database for accounts, sessions, and beta requests.
  • Google: OAuth sign-in only. We send Google an authorisation code and receive an ID token containing your verified email + subject id. No further data is shared.

Some processors are US-headquartered and rely on the EU-U.S. Data Privacy Framework (or equivalent Standard Contractual Clauses) for lawful transfer. Nothing sensitive (payment details, contents of your recordings, DJ history) touches these processors.

6. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data erased (“right to be forgotten”)
  • Restrict how we process it
  • Receive a portable copy of it (JSON export on request)
  • Object to processing based on legitimate interest
  • Lodge a complaint with the supervisory authority. For Berlin residents this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

To exercise any of these, email hello@shakthi.xyz. We aim to respond within 30 days per Art. 12(3) GDPR.

7. Security

Passwords are stored bcrypt-hashed. Cookies are HttpOnly, SameSite=Lax, and HMAC-signed. Session state is server-side so a stolen cookie can be revoked centrally. All traffic runs over TLS.

If you spot a security issue, please email hello@shakthi.xyz before disclosing publicly.

8. Changes

We’ll update this page when the data we handle changes materially. The “Last updated” date at the top always reflects the current revision. For substantive changes that affect existing accounts, we’ll email you.