DJ Tango Privacy Policy

Last updated: October 10, 2026

1. Who we are

This Privacy Policy describes how the DJ Tango application and website (collectively, the “Service”) handle information. The Service is operated by the DJ Tango team (“we”, “us”, or “our”). The Service is available as:

• The website at djtango.com (and the underlying host tangoplaces.web.app).
• The DJ Tango app for iPhone and iPad on the Apple App Store.
• The DJ Tango app for Android on Google Play.

The mobile apps are thin wrappers (WKWebView on iOS, WebView on Android) around the same web application. This Policy covers all three.

2. Scope

This Policy applies to information the Service handles directly. It does not govern YouTube, Spotify, Apple Music, Apple’s Shazam matching, Google, Firebase, your operating system, or the App Store / Google Play. Those services have their own privacy policies (see Section 6).

3. Information we collect

3.1 Information you provide

• Account (optional). Most of the Service works without an account. You can sign in with Google, with email and a password, or with an access code we have given you.
  • Google or email. Sign-in is handled by Firebase Authentication. We receive the email address and the name on that account, plus a Firebase user ID. Email verification and password reset use a short-lived code. We store that code only as a hash, and only for a few minutes.
  • Access code. This is a code we issue, not an email address. We associate it with an internal user ID, a display name, and a role. It is not a Firebase account.
• Favorites, playlists, and settings. If you sign in with Google or email, these sync to your account in Google Cloud Firestore so they follow you across devices. An access-code account keeps them on the device only. A few preferences, including the playback source you picked, stay on the device either way.
• Song edits and uploaded audio. Signed-in users can save corrections and, for a song they add or edit, one audio file (MP3 or M4A). The file is stored in Google Cloud Storage under that account. It is not added to the public catalog.
• Feedback. If you send feedback, we store the message and email it to the team. We also file it in our support tracker (Linear). The record can include your message, your name and email when you are signed in, the country of the request, and the IP address. You can attach diagnostic details; those stay out unless you include them.

3.2 Information collected automatically

• Server logs. Our backend (Google Cloud Run in the European Union, region europe-west1) records ordinary request data for security and debugging: IP address, user-agent, path, status, time, and your user ID when you are signed in. Logs are kept for a limited time and then deleted.
• Streaming. Our own player is available to signed-in listeners in the EU, the UK, and Switzerland, for recordings from 1962 and earlier. To apply that limit we look up the country of the request. The app then plays the file through a short-lived address pointing at Google Cloud Storage. We do not build a listening profile from those requests.
• Usage counters. The app assigns the browser or device a random identifier (clientId) stored only on that device. It counts things like opens, plays, listening time, which player you used, app version, platform, operating system, language, and a short list of the songs you play most. When the device model is available, that is included too. If you are signed in, the snapshot can also include your name and email. With the snapshot we store the country of the request and a hash of the IP address, not the address itself. We send it no more often than every 15 minutes, and only after new activity. It is one record per device, overwritten in place, and it expires after 7 days. A separate daily summary is kept for about 90 days. We use this to understand the product. We do not use it for advertising.
• Identify. If you use Identify, the iOS or Android app uses the microphone for that moment only, to match tango playing nearby. We do not store the recording. Matching runs against a catalog on the device and, if that misses, Apple’s Shazam service. Shazam is governed by Apple’s privacy policy.
• Diagnostic logs (mobile). The iOS and Android apps write technical messages to the device log. Those stay on the device unless you choose to send them with feedback.

3.3 Information we do not collect

• We do not use third-party analytics SDKs, advertising SDKs, attribution SDKs, or cross-site trackers.
• We do not request the iOS Identifier for Advertisers (IDFA) or the Android Advertising ID, and we do not use Apple App Tracking Transparency (ATT).
• The iOS app asks for the microphone (Identify) and for Apple Music (playback from your subscription). It does not ask for the camera, contacts, photos, location, calendar, Bluetooth, motion, HealthKit, or speech recognition.
• The Android app asks for Internet access, a wake lock so playback can continue, and the microphone for Identify. It does not ask for location, contacts, or broad access to your files.
• We do not knowingly collect personal information from children (see Section 9).

4. How we use information

We use the information above only to:

• Sign you in and apply the right permissions.
• Save and sync favorites, playlists, settings, and song edits for Google and email accounts.
• Play catalog audio, including the country check for our own player.
• Review feedback, corrections, and uploaded audio.
• Understand how the Service is used and keep it reliable.
• Secure the Service and comply with the law.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

5. Data stored on your device

The web app and the mobile apps store the following on your device. You can clear it by signing out, clearing site data, or removing the app.

• tangodj_token — your session token. Removed on sign out.
• tangodj.user.v1 (and an account-specific key when you are signed in) — favorites, playlists, and synced settings. For a Google or email account this is also copied to Firestore.
• tangodj.userLocal.v1 — preferences that stay on this device, such as the playback source.
• tangodj.stats.v1 and tangodj.stats.songPlays.v1 — the usage counters described in Section 3.2, including the random clientId.
• WebView caches. The mobile apps may cache catalog data and images. The operating system manages those caches.

6. Third-party services

6.1 YouTube, Spotify, and Apple Music

If you pick one of these players, playback is handled by that service. We pass it the identifier of the song you chose. We do not receive your YouTube, Spotify, or Apple Music account or that service’s listening history. Their own policies apply:

• Google Privacy Policy and the YouTube Terms of Service. YouTube may set cookies.
• Spotify’s Privacy Policy.
• Apple’s Privacy Policy, which covers Apple Music and Shazam.

6.2 Google Cloud and Firebase

The website is hosted on Firebase Hosting. The API runs on Cloud Run in europe-west1. Audio files and feedback logs are in Cloud Storage. Accounts use Firebase Authentication, and synced user data lives in Firestore. Google processes this for us under the Google Privacy Policy and the applicable Google Cloud terms.

6.3 Support tracker

Feedback messages are filed in Linear so the team can track them. Linear receives the contents described in Section 3.1. Linear’s own privacy policy applies to that processing.

6.4 App Store / Google Play

Apple and Google handle distribution of the mobile apps. The store you install from collects download, crash, and rating information under its own policy.

7. Cookies and similar technologies

Our own website does not set tracking, advertising, or analytics cookies. We use the browser’s localStorage for the items in Section 5. Embedded YouTube, Spotify, and Apple Music players may set cookies under their own domains.

8. How we share information

We share personal information only:

• With the processors in Section 6 (Google Cloud, Firebase, Linear, and the player you choose).
• When the law, legal process, or a valid government request requires it.
• To investigate fraud, security incidents, or violations of our terms.
• If the Service moves to a successor, in which case this Policy still applies or we will tell you about the change.

We do not sell or rent personal information, and we do not use it for cross-context behavioral advertising.

9. Children’s privacy

The Service is intended for adults interested in tango music. We do not direct it to children under 13 (or under 16 in the European Economic Area / United Kingdom) and we do not knowingly collect personal information from them. If you are a parent or guardian and believe a child has provided us with personal information, contact us (Section 13) and we will delete it.

10. International transfers

Our servers are in the European Union (Google Cloud europe-west1). If you use the Service from outside the European Union, your information is processed there. Where required, transfers from the EEA, UK, or Switzerland rely on the safeguards our hosting provider puts in place, such as Standard Contractual Clauses.

11. Data retention

• Google or email account (user ID, email, name, synced favorites, playlists, settings, edits, and uploaded audio): kept while the account exists. Deleted when you delete the account in Settings, or sooner if you ask.
• Access-code account: kept while we issue that code. Data on the device stays until you clear it. Email us if you want the code retired.
• Feedback: kept so we can review and answer it.
• Email verification and password-reset codes: hashed, and deleted after they expire (about 10 minutes) or are used.
• Usage records: the per-device snapshot expires after 7 days. Daily summaries are kept for about 90 days.
• Server logs: kept for a limited period (typically 30 days) by Google Cloud Logging, then deleted.
• Data on your device: kept until you sign out, clear site data, or uninstall the app.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, or delete personal information, to object to or restrict certain processing, to receive a portable copy, to withdraw consent where we rely on it, and to complain to your data-protection authority (EEA / UK residents).

To use these rights, contact us at the address in Section 13. You can also:

• Sign out to drop the session token on this device.
• Delete a Google or email account from Settings. That removes the Firebase login and the data stored for that account, including uploaded audio. Access-code accounts do not have this button; email us instead.
• Uninstall the app or clear browser data to remove what is stored on the device.

For California residents: we do not “sell” or “share” personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. You have the right to know, delete, correct, and not be discriminated against for exercising these rights.

13. Contact us

For privacy questions, requests, or concerns:

• Email: djtango@tango-logic.com
• Web: https://djtango.com

We are the data controller for personal information processed under this Policy.

14. Changes to this policy

We may update this Policy from time to time. When we do, we will change the “Last updated” date at the top. Material changes will be noted on the site or in the app before they take effect.