Privacy Policy

Effective: 26 August 2026

This Privacy Policy explains how Marcus Barta ("we", "us", "our"), operator of Cue (the "Service"), collects, uses, and handles personal information. It applies to venue operators and their staff who use the Service.

1. Information we collect

We collect:

• Venue account information — venue name, login PIN, and configuration settings, including playlist tags (time-slot and crowd-level assignments).
• Spotify connection data — when a venue links its Spotify account, we store the OAuth access and refresh tokens needed to control playback and read playlist data on the venue's behalf. We do not receive or store the venue's Spotify password.
• Playback and crowd-level activity — which playlists and devices a venue selects, and the crowd-level state staff set, so the Service can automate and log playlist switching.
• Technical data — standard web server logs (IP address, browser type, timestamps) generated by our hosting infrastructure in the course of serving the Service.

We do not currently use third-party analytics, advertising, or tracking scripts within the Service, beyond what is necessary to integrate with Spotify's API.

2. Who provides this information

Venue account information and PINs are provided by the venue operator. Spotify connection data is provided by Spotify, via the OAuth authorization the venue operator grants when linking their account.

3. How we use information

We use the information collected to: operate and provide the Service; authenticate venue logins; control and switch playback on the venue's connected Spotify account as configured; maintain the security and integrity of the Service; and communicate with venue operators about their account.

We do not sell personal information.

4. Where information is stored

The Service is hosted on Cloudflare Pages and Cloudflare Workers. Application data, including Spotify tokens, is stored in Supabase (a hosted PostgreSQL database provider). These providers may store data outside your country of residence. We rely on these providers' security measures and our own access controls (including PIN-based authentication and service-role API access) to protect stored data.

5. Data retention

We retain venue and playlist configuration data for as long as a venue account remains active, plus a reasonable period afterward in case the venue wishes to reactivate. Spotify tokens are retained only for as long as the venue's Spotify connection remains linked, and are deleted if the venue disconnects Spotify or the account is closed. You may request deletion of your venue's data at any time by contacting us (see Section 7).

6. Sharing of information

We do not share personal information with third parties except: with the infrastructure and API providers described in Section 4 and Spotify itself, to the extent needed to operate the Service; where required by law, regulation, or valid legal process; or with your consent.

7. Your rights and contact

Depending on your location, you may have rights to access, correct, or request deletion of personal information we hold about you. You can disconnect your venue's Spotify account at any time within the app, which revokes our access to it. For anything else, contact us at marcusbarta@icloud.com.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Effective" date above when we do.