Legal
Privacy policy
Updated October 18, 2026
1. Data controller
The controller is the individual who owns brstmplayer.com and runs the service as a non-profit personal project. Contact for any privacy matter, including exercising your rights: support@brstmplayer.com.
2. What data we process
| Data | When |
|---|---|
| Name, email and password (stored hashed with bcrypt; we never see it) | If you sign up with email |
| Name, email and profile picture from your Google account | If you sign in with Google |
| Your library: album and track names, Drive file identifiers, playlists, favorites, listening history (the last 500 plays), listening times and assigned covers | While you use the player |
| Preferences: language, theme, accent color and volume | While you use the player |
| IP address and email of sign-in and sign-up attempts | When you sign in or sign up (protection against attacks) |
| Aggregated browsing data (pages viewed, device, language, approximate country) | Only if you accept analytics cookies |
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account, showing your library and syncing it across devices | Performance of the contract: the terms of use you accept when signing up (art. 6.1.b) |
| Protecting the service against attacks and abuse (sign-in attempt limits) | Legitimate interest in the security of the service (art. 6.1.f) |
| Aggregated usage statistics with Google Analytics to improve the website | Your consent, which you can withdraw at any time (art. 6.1.a) |
| Answering your messages and requests | Your request and, where applicable, legal obligations |
We do not use your data for advertising, we do not build commercial profiles and we do not make automated decisions that affect you.
4. Google data and the "Limited Use" policy
If you sign in with Google, we receive your name, email and profile picture (openid, email and profile scopes) only to identify you. If you connect Google Drive, the app uses the drive.file scope, which only grants access to the files in the folder you pick in Google's picker; never to the rest of your Drive.
BRSTM Player's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use that data only to provide the player's features, we do not sell it, we do not use it for advertising and we do not allow anyone to read it except when necessary for security, to comply with the law or with your permission.
You can revoke BRSTM Player's access to your Google account at any time from your Google account security settings, or disconnect Drive from the player itself.
5. How long we keep it
- Account, library and preferences: for as long as you keep your account. If you ask us to delete it, we erase all its data.
- Listening history: only the 500 most recent plays; older ones are deleted automatically.
- Sign-in and sign-up attempts (IP and email): deleted after 24 hours.
- Analytics data: according to Google Analytics' retention settings (14 months at most).
6. Who we share it with
We do not sell or hand over your data. Only the providers we need to run the service have access to it, as data processors and with the safeguards the GDPR requires:
- Web server and database hosting, where your account and library data are stored.
- Google: Google sign-in, Google Drive (if you connect it) and Google Analytics (if you accept it).
To recognize each album's game we use the album name, without any data that identifies you. The covers, screenshots and trailers in the info panel are loaded directly from IGDB.com and YouTube servers, which, like any website, receive your browser's IP address when serving them.
7. International transfers
Some of these providers process data outside the European Economic Area:
- Google (United States): certified under the EU-U.S. Data Privacy Framework, covered by a European Commission adequacy decision, and standard contractual clauses.
- Web server: the server that runs the application is hosted in the Russian Federation, a country without an adequacy decision. Your account data travels through it encrypted (HTTPS) when you use the service, and that transfer is necessary to provide the service you request (art. 49.1.b GDPR). The database is hosted in Germany.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, at any time by writing to support@brstmplayer.com from your account email. We will reply within one month at most.
If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) or your local data protection authority.
9. Security
All communication with the service is encrypted (HTTPS), passwords are stored with a one-way hashing algorithm (bcrypt), API access uses signed, expiring tokens, and we limit sign-in attempts to stop attacks.
10. Minors
You must be at least 14 years old to create an account. If you are under 14, your parent or guardian needs to do it for you.
11. Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change is significant, we will let you know within the service.