Privacy Policy

Last updated: June 13, 2026

Overview

JustList (“we”, “our”, “the service”) is a web application that helps users discover similar songs and create personalized playlists in their YouTube Music account. This policy explains what data we collect, how we use it, and your rights.

We do not sell your personal data. We do not show advertisements. We do not track your behavior across the web.

Who We Are

JustList is an independent project operated from Türkiye by Kadir Günay. You can contact us at kadirgunay@gmail.com.

Data We Collect

Information you provide via Google sign-in

When you sign in with Google, we receive the following from Google OAuth via Supabase Auth:

• Your Google account email address
• Your display name and profile picture URL
• Your Google user identifier
• A YouTube access token and refresh token used to call the YouTube Data API on your behalf

Information from YouTube

With the access scope you grant during sign-in (https://www.googleapis.com/auth/youtube), we may read or write the following on your behalf:

• Your YouTube channel info (channel ID, title, avatar)
• The list of playlists you own (for display in the app)
• New playlists you create through JustList, and the videos you add to them (write actions are only performed when you click “Save”)

We never modify or delete videos you did not create through JustList. We never read your watch history or subscriptions.

Automatically collected information

We store a small shared cache of public YouTube search results (artist, title, video ID, thumbnail URL) so that repeated queries do not consume additional API quota. This cache contains no personal data.

We use a cookie set by Supabase Auth to keep your session active across page reloads. We also use localStorage to remember your theme preference (light or dark). We do not use third-party analytics or tracking cookies.

How We Use Your Data

• To authenticate you and keep you signed in
• To display your YouTube channel name, avatar, and existing playlists in the app interface
• To create new playlists on your YouTube account when you ask
• To send anonymized artist + track names to the Last.fm public API to fetch similarity recommendations
• To send anonymized artist + track names to the YouTube Data API to match recommendations to YouTube videos

Third-Party Services

The following third parties process data in order to provide JustList:

• Google / YouTube — for authentication and YouTube playlist creation (see Google’s Privacy Policy). JustList’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Supabase — for authentication, session storage, and the YouTube search cache.
• Last.fm — for music similarity data. Only the artist name and song title of the seed track are sent. No user-identifying data is sent.
• Vercel — for application hosting and edge delivery.

Google API Limited Use Disclosure

JustList’s use of information received from Google APIs (including the YouTube Data API) adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use YouTube user data for advertising, sell it to third parties, or use it for any purpose unrelated to providing the playlist generation feature you requested.

Data Retention

• Account data (name, email, OAuth tokens) is retained while your account is active. If you sign out, your session is cleared from the cookie immediately. If you revoke YouTube access via your Google account settings, our tokens become invalid.
• The YouTube search cache contains no personal data and is retained indefinitely or until purged for storage management.
• On account deletion (see below), we delete all data associated with your user identifier within 30 days.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Revoke JustList’s access to your YouTube account at any time via your Google Account permissions
• Export the data we hold about you (on request)

To exercise any of these rights, email kadirgunay@gmail.com. We respond within 30 days.

Children’s Privacy

JustList is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided data to us, please contact us so we can delete it.

International Data Transfers

Our infrastructure providers (Supabase, Vercel) operate servers in the EU, US, and other regions. By using JustList you consent to your data being processed in these regions.

Security

We use industry standard practices to protect your data: TLS encryption in transit, encrypted storage at rest via Supabase, and server-side handling of OAuth tokens (tokens are never exposed to the browser).

Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any change. For material changes we will notify users via the app or by email if applicable.

Contact

Questions or requests: kadirgunay@gmail.com