Popmelon privacy policy

The short version

Voice, video and shared screens are forwarded live and never recorded.
Chat messages, what your party played, IP addresses, and playback and connection samples are kept for 30 days. Someone who joins a party sees the messages sent in it in the last 15 minutes.
Your watch history — what you watch and listen to in parties, with links to it, for how long, how you reacted and who with — is kept for 12 months. We use it to recommend what to watch and to suggest public parties, never for advertising.
Party records, the names used in them, how long each member watched, and the activity log are kept for 12 months.
Your age group and gender only if you choose to give them, with a separate agreement you can take back at any time. We never use your IP address to work out where you are.
You sign in with Google to start or join a party. Your account — your name, photo and the email address Google has verified — is kept until you ask us to delete it.
If you make or join a friend group, the people in it see your name, your Google photo and who else is in it, and anyone you send its invite link to sees the group’s name, your name and photo and how many people are in it. We keep the group’s name and who is in it until you leave the group or delete your account. What you do in a group (share the party you’re in, say you’re free to watch, plan a party, add to its watch list, chat) is seen by its members; its chat is kept 30 days.
You agree once, in the extension, when you first sign in. We ask again only if this policy changes.
If you report a problem, we keep your report and our replies until 12 months after we close it, to fix it and to answer you in Popmelon. The tickets we track reports in hold no name or email address.
No advertising and no analytics trackers. We do not sell or share your information.
You can ask for a copy of your records, or for them to be deleted. See Your rights.

What changed

Until 5 October 2026, Popmelon held parties only in the server's memory and kept no record of them after they ended. From that date we keep the records described below, so that we can fix synchronisation and connection problems, investigate abuse and security problems, recognise the same person or installation across parties, and understand how Popmelon is used. No party records exist from before that date.

On 23 October 2026 we added your watch history (see What we keep): what you watch and listen to in parties, with links to it, how long you watched, waited or were connected with nothing playing, how many reactions and messages you sent during each title, how often your player had to catch up with the party, who you watched with, your browser's language, which browser and operating system you use, the time zone your browser is set to and the country it is in (never worked out from your IP address), how you joined each party, how long you were in the party's call and on camera, when you copied a party's link, and your thumbs up or down for what you watched. If you choose to, you can also give your age group and gender, with a separate agreement. We use all this to recommend what to watch, to suggest public parties, and to understand how Popmelon is used and growing. We work it out on our server from what the relay receives, and keep it only for people who agreed to this version of the policy. We also count installs and removals of Popmelon, and the reasons people give, without knowing who they are, and look up what public film and music catalogues say about the titles parties play, without sending them anything about you.

On 3 November 2026 we added that we count what party invitation pages show, without knowing who sees them, and that the fingerprint we use to count each visit only once now lasts until the end of the day (UTC) instead of ten minutes.

On 5 November 2026 we added problem reports (see What we keep): what you send us from “Report a problem” in Popmelon, and our replies, which you read in Popmelon under “Your reports”. We keep a report only when you choose to send one, so this needs no new agreement.

On 11 November 2026 we added friend groups (see What we keep): the groups you make or join, who is in each, who owns it and when each person joined, and the invite links members make. The people in a group see each other’s names and Google photos, and an invite link shows the group’s name, who sent it and how many people are in it. We count what group invitation pages show, without knowing who sees them. In a group you can share the party you are in, say you are free to watch, plan parties (with times suggested from when its members usually join parties), keep a list of what to watch, and chat; the group’s chat is saved for 30 days, and our server can now read a group’s messages back to show them to its members (saved party chat is still never shown back). We may suggest people you have watched parties with when you invite people to a group, and they can invite you from inside Popmelon; you can turn that off. Desktop alerts, if you turn them on, use Chrome’s notifications.

On the same day we added four things to parties. When a host removes someone from a party, or mutes someone in the party’s call or lets them talk again, the activity log records that it happened and which host did it, never why. When you join a party, you see the messages sent in it in the last 15 minutes: the relay holds a party’s latest messages in its memory for that, and nowhere else. You can choose the name you go by in parties and whether your Google photo shows; your browser keeps your choice (see What your browser stores). And on Spotify, people in a party can add songs to its Up next list: the relay holds the list, with who added each song, in its memory only. This is a new version of the policy, so the extension asks you to agree to it before any of this applies to you.

Who we are

Popmelon is run by GRADIENTFLOW AI PTE. LTD. (“Gradientflow”, “we”), a company registered in Singapore. We decide what Popmelon collects and why, so we are responsible for it under data protection law. You can reach us, and our Data Protection Officer, our founder, at hello@popmelon.app.

Watch together

In Watch together mode, Popmelon does not stream, relay, record, cache or proxy the movie. Everyone in a party is playing their own copy from their own account. What we synchronise is a position in time — the same information as someone saying “go to 41 minutes” out loud. We do keep a record of which video or song a party played; see What we keep.

Screen Share in the party room opens your browser's picker. Only the host can approve a tab, window or whole screen to send to party participants; audio is included only when supported and selected. Sharing an entire screen can expose other windows and notifications, so choose the narrowest source you need. The toolbar's separate Share this tab + audio action broadcasts only one tab (including subsequent navigation). Neither path captures your microphone or camera. Use Stop sharing to end capture. Sharing is not silently restarted after an extension restart, and protected content may not be capturable.

The browser asks you to choose a source every time you use Screen Share. The toolbar's optional tab-capture permission is requested only for that shortcut. Declining either does not disable synchronized playback or chat. Revoking tab-capture permission stops an active toolbar tab broadcast.

What is shared is forwarded live and never recorded or stored. We keep a record that sharing started and stopped, and the IP addresses of the people who connected to send or watch it, but nothing that was shown or heard.

What passes through the relay

While you are in a party, our relay handles:

the party code, the name you go by in parties (your Google name, unless you chose another), and the colour assigned to you; when signed in, your Google-hosted profile photo is shown to people in your party room, unless you turned it off
host requests and approvals, so only the current host can pass control to another member
if you host, removing someone from the party, and muting someone in the party’s call or letting them talk again
playback position, whether you are paused, which video or song the room is on, its title, who made it (a channel or artists), and how long it is
on Spotify, the songs people add to the party’s Up next list: each song’s ID and album, its title and artists as the page shows them, the address of its cover on Spotify’s image server, and who added it
chat messages and reactions you send
clock-synchronisation pings, with the round-trip time and clock difference your extension measured, and how often your player had to jump to catch up with the party
your extension version, your install ID (see What your browser stores), the language and time zone your browser is set to, and how you joined (an invitation, a party link, the toolbar, the party room or a streaming page)
your browser's user-agent, as every web connection sends it, from which we keep only the kind of browser, its main version number and your operating system; for Brave, Edge and Opera, which describe themselves as Chrome there, the extension says which browser it is
whether you are in the party's call and have your camera on, that you copied the party's link, and from where, and your thumbs up or down for what the party plays
the IP address your connection comes from

The live party lives in the server's memory. A room is discarded a minute after the last person leaves, and the live party is gone if the process restarts. Separately, the relay saves the records described in the next section. Saved chat is never shown back to you or anyone else in Popmelon. The relay also holds a party’s latest messages in its memory, the last 50 and none older than 15 minutes, so that someone who joins or comes back sees what was just said; they go with the party, or when the process restarts. A Spotify party’s Up next list is held there too: it is never saved, and it goes with the party.

What we keep, and why

Parties. The party code; when the party started and ended, and why it ended; which service it used (YouTube, Netflix, Spotify, Prime Video, Twitch or another service Popmelon works with) or a shared screen; the most people in it at once; which earlier party it continued after a server restart; and a fingerprint of the host's private key (see Security). Why: to run and troubleshoot Popmelon and to count how it is used. Kept 12 months after the party ended.
Who was in a party. Each time you join: the display name you used (your Google name, or the name you chose for parties), whether you were host or guest, when you joined and left and why (you left, you disconnected, or the party ended), your extension version, how many times your player stopped to buffer, links to your account and your install record, and a fingerprint of the sign-in session you joined with. If you rename yourself in a party, the old and new names. Why: to troubleshoot parties and to know who took part when we investigate a problem or a report of abuse. Kept 12 months after the party ended.
Chat messages. The text of each message, when it was sent, and which party member sent it. Why: to investigate reports of abuse and security problems. The relay that saves chat cannot read it back, and we read saved chat only as described in Who can see it. Kept 30 days.
What was played. For each video or song a party plays: the service, its ID on that service and its link there, its title as shown on the page, who made it (a song's artists, a video's channel), whether it is a film, an episode of a series (with the series and its season and episode numbers), a video or a song, how long it is and how far into it the party got, which member started it, and when it started and stopped. Why: to troubleshoot synchronisation on particular services and titles, and for the watch history below. Kept 30 days, or 12 months while it is in someone's watch history. We never use it for advertising and never sell it.
Your watch history and watch time. What you watched or listened to in parties, linked to your account (or, if you never signed in, to your install record): each film, episode, video or song, with what we record about it above, how long you watched it, when, in how many parties, whether you chose it as host, how many reactions and chat messages you sent while it played (the number, not the words), how often your player had to jump to catch up with the party, your thumbs up or down for it if you gave one, and who else in the party watched it with you. And each time you join a party: the language your browser is set to; the time zone it is set to and the country that time zone is in (we never work out where you are from your IP address); the kind of browser (such as Chrome, Brave or Edge), its main version number and your operating system, never the full user-agent; how you joined (an invitation, a party link, the toolbar, the party room page, a streaming page, or reconnecting); how long something played for you, how long it was paused, loading or buffering, how long your player showed ads, and how long you were connected with nothing playing for you, such as before anything was chosen or after you closed the watch tab, in total and for each service; and how long you were in the party's call and how long your camera was on. We work this out on our server from what your extension sends the relay: the host's playback, your ads and buffering, your reactions and chat messages, the clock-synchronisation pings from your watch tab, and whether you are in the call. Why: to recommend what you might like to watch, in your language, to suggest public parties around what people and their friends watch, to find where synchronisation needs work, and to understand how Popmelon is used and growing. Recommendations are made automatically from watch histories; people at Popmelon look at a particular person's history only as described in Who can see it. Kept 12 months after the party ended, or until you ask us to delete it.
Your age group and gender, only if you give them. In the party room's “About you”, while signed in, you can choose an age group (from 13–17 up) and a gender, and agree, separately from this policy, to their use for your suggestions. We keep them with your account, with a record of that agreement, and use them to suggest what people like you enjoy and, in totals of at least ten people, to understand who uses Popmelon. Nobody else in a party sees them. Removing them there deletes them and their earlier values at once, and records that you took the agreement back. Kept until you remove them or delete your account.
Public details of titles. For a film, series, song or video a party played: its genres, year, cast or artists (or a video's channel), original language and length, from public catalogues: TMDB for films and series, Spotify for songs and YouTube for videos. We send them only the title's name (films and series) or its id on that service (songs and videos), never anything about who watched it. Why: to recommend what to watch. Kept while some record of the title is; YouTube's details for at most 30 days, as its terms require.
Activity log. A timestamped list of what happened in each party: the party starting, resuming after a server restart and ending, and why it ended; joining, with your role and extension version, and leaving, with the reason; that you renamed yourself, but not the names; host requests and changes; the host removing someone from the party, or muting someone in its call or letting them talk again, with which host did it, never why; play, pause, seek and waiting, with the playback position; switching to a different video or song, with the service but not which video or song; reactions, as the emoji sent; that a chat message was sent and how long it was, but not its text; screen sharing starting and stopping; a watch tab closing; copying the party's link, and from where; someone joining the party's call, and whether their camera was allowed, without saying who; accounts being created and signing in; joins refused because an extension was out of date, with its version; and, with nothing about who, Popmelon being installed or removed, with the extension version, the reason picked on the goodbye page, and what a party or group invitation page showed (see What your browser stores). Entries point to the party and membership records instead of repeating names. Why: to troubleshoot, to keep Popmelon secure, and to understand how it is used and growing. Kept 12 months.
Playback and connection samples. Every few seconds while you are in a party: your connection's round-trip time and clock difference to our server and, while you are the host, the playback position and whether it is paused. Why: to measure and improve how closely parties stay in sync. Kept 30 days.
IP addresses. The IP address a request came from when you sign in, join a party, or ask for a voice, video or screen-sharing connection, with which of those it was. Why: security and investigating abuse. We do not use it to work out where you are. Kept 30 days.
Install records. Your extension creates a random install ID on your computer. We store only a one-way code derived from it, which cannot be turned back into the ID, together with your extension version, when the install was first and last seen, and the account it signed in to, if any. Why: to recognise the same installation across parties, to find your records when you ask for them, and to show relevant update reminders. Kept 12 months after the install was last seen; an install you signed in on is kept with your account until the account is deleted.
Accounts. Everyone who starts or joins a party signs in with Google, so everyone in a party has one. A salted one-way hash of your Google account ID; an account ID and a voice-chat identity derived from that hash; your Google display name, the address of your Google profile photo and the email address Google has verified (see Signing in with Google); when you first signed in and when you were last seen; and a history of your previous names and photo addresses. Why: to let only signed-in people into parties, to show your verified name and photo to your party and to recognise you across parties. Kept until you ask us to delete your account.
Friend groups. If you make a group or join one: its name, who is in it, who owns it and when each person joined. The people in a group are shown to each other by the name and photo of their Google account. Why: so the people you watch with can find each other in Popmelon. Kept until you leave the group or delete your account. When the owner leaves, the person who has been in the group longest owns it, and a group with nobody left in it is deleted.
If you invite someone: your invite link, which group it is for, and when it stops working. Anyone who opens the link sees the group’s name, your name and Google photo, and how many people are in it, but not who they are, until they join. A link works for 7 days, or until the group’s owner resets every link to it; we keep it until you make a new one, leave the group or delete your account.
Sharing a party with a group. If you share the party you are in with a group, or start a hangout for it: which party and which groups, held in our server’s memory only, while the party lasts. The group’s members see that you are watching, what is playing and on which service, and how many are in the party. Nobody else in the party is named to them. When a shared party plays a title on the group’s watch list, we mark it as watched together.
Free to watch. If you say you are free to watch: until when (1, 2 or 4 hours) and which of your groups may see it, in our server’s memory only, until then.
Scheduled parties. If you plan a party for a group: when, what to watch (a link or a name), your note, who planned it, and who is going or can’t. Why: so the group can plan together. Kept 30 days after the party’s time or after it was cancelled. To suggest times, we count how many of the group’s members usually joined parties around each hour, from their party records (see your watch history, above); the group sees only those counts (“4 of 6 usually watch around then”), never who, and nobody who said no to recommendations is counted.
A group’s watch list. Titles members add from the Popmelon panel: the service, the title’s link and name, who added it, who wants it, and when it was watched together. Why: so the group can choose what to watch. Kept until someone removes it or the group goes; a title watched together goes 180 days after. When you leave the group, what you added stays, without your name, and your thumbs go.
A group’s chat. The messages members write in it: the words, who wrote them and when, and where each member stopped reading. Members read the last 30 days of it, from the time they joined; whoever leaves can no longer read it, and what they wrote stays, without their name. You can delete your own messages, and the group’s owner can delete any. Why: so the group can talk between parties. Kept 30 days.
People you have watched with. When you invite people to a group, we may suggest people who were signed in, in a party with you and watching the same title, from the party records: their name and photo, how many parties you watched together and when last, never what you watched. If you invite one of them, they see “[your name] invited you to [group]” in Popmelon. We keep the invitation (the group, who sent it, to whom, when, and whether it was answered) for 30 days. Nobody who said no to recommendations is suggested or gets suggestions, and you can turn off “Invitations from people I’ve watched with” in Settings; then nobody is shown you as a suggestion.
Sign-in sessions. For each session we issue: a fingerprint of the session token, never the token itself, with when it was issued and when it expires. Why: to investigate misuse of a session and to cancel sessions, for example when an account is deleted. Sessions last 7 days; each fingerprint is kept until 30 days after its session expires.
Problem reports. Only when you send one from “Report a problem”: what is wrong (one of a few categories), the service it is about, your words, and a screenshot if you add one, which shows whatever was on your screen, including people in your party. With “Include technical details”, which is on unless you turn it off: the extension's version, your browser and operating system (from the request, without keeping its user-agent string), the party you sent it from, and how your tab's synchronisation stood (your role, the connection, delay and drift, never names or what you watched). The report is linked to your account or, if you are signed out, to this browser's install record, and we keep our replies and your answers with it. Why: to fix the problem and to answer you. We track each report as a ticket in Jira (see Who else is involved) without your name, email address, account or install ID; a short reference number links the ticket to your report. Kept until 12 months after we close the report; a screenshot stays on our server only until it is added to the ticket.
Your agreement. Which version of this policy you agreed to, when, and whether you agreed when signing in or, after this policy changed, when starting or joining a party, kept with your account. Why: to know that you agreed, and to which version. Kept as long as your account.

How long we keep it

30 days: chat messages; what was played, unless it is in someone's watch history; IP addresses; playback and connection samples; a problem report's screenshot at most, which goes from our server as soon as its ticket has it.
12 months: the activity log; party records and who was in each party, including the names used, and each member's watch history and watch time, counted from when the party ended; install records not linked to an account, counted from when the install was last seen.
12 months after we close it: a problem report, with our replies and your answers, here and in its Jira ticket.
Until you ask us to delete your account: your account, its name and photo history, the record that you agreed to this policy, the install records of installs you signed in on, and the age group and gender you chose to give, until you remove them.
Until you leave a group or delete your account: the friend groups you are in, and who is in them; and your latest invite link to each, which works for 7 days. A group goes when its last member leaves.
For groups: a group’s chat messages and invitations, 30 days; a scheduled party, 30 days after its time or after it was cancelled; a title on a group’s watch list until someone removes it or the group goes, and a title watched together 180 days after; a shared party, and who is free to watch, in memory only, while they last.
30 days after a session expires: sign-in session fingerprints. Sessions last 7 days.
7 days: encrypted nightly backups of the database.
Roughly the last 40 MB: our web server's access logs (see Server logs).

Each period counts from when the record was made, unless it says otherwise, and deletion runs automatically every few hours, so a record can outlast its period by those few hours. Chat messages, IP addresses and samples are deleted a whole day at a time, so they can be up to 31 days old when they go; the activity log is deleted a whole month at a time, so its oldest entries can be up to 13 months old. Something deleted from the database can remain in a backup for up to 7 more days; we restore backups only to recover from a failure.

Why we are allowed to

Where the EU or UK General Data Protection Regulation applies, we rely on:

Providing the service you asked for (contract), to run the parties you start or join: relaying playback, chat, names and photos, and keeping your account and sessions, which parties require; to look into and answer a problem report you send us; and to keep the friend groups you make or join and show them to the people in them.
Our legitimate interests in keeping Popmelon working, secure and free of abuse, in understanding how it is used, and in recommending what to watch and suggesting public parties, for the records we keep beyond the live party: chat messages, what was played, watch history and watch time, the activity log, party and membership records, playback and connection samples, IP addresses and install records. These records are limited to what is listed here, deleted on the schedule above, never used for advertising and never sold, and you can object to them.
Your consent, separately from this policy, for the age group and gender you choose to give; you can take it back in the party room at any time.
Legal obligations, when the law requires us to keep or disclose something.

In Singapore, we collect, use and disclose personal data with your consent, which you give when you press “Agree and sign in with Google”, “Agree and sign in to start” or “Agree and sign in to join” in the extension (after a change to this policy, “Agree and start party” or “Agree and join party”), or where the Personal Data Protection Act otherwise permits it. You can withdraw consent by contacting us. Because records are kept for every party, Popmelon cannot run parties for you after you withdraw it.

Voice and video chat

Voice and camera, when you turn them on, travel through a media server that forwards live streams between participants. The access token your browser is issued explicitly denies recording permission, and no recording is configured. Streams are forwarded and discarded; the audio and video are never written down. We keep the IP address that asked to join voice (see What we keep), never what was said or shown.

Voice starts muted every time, and the camera starts off. Neither turns on without you pressing the button.

Signing in with Google

You sign in with Google to start or join a party; nobody takes part without signing in. Popmelon asks you to sign in on the Start or Join button itself.

When you sign in:

Signing in is also how you agree to our Terms and consent to the records this policy describes, if you have not already done so in that browser: the button says “Agree and sign in with Google”, “Agree and sign in to start” or “Agree and sign in to join”. You are not asked again when you start or join a party, unless this policy changes.
We ask Google only who you are. We do not request access to your Gmail, Drive, Contacts, Calendar or any other Google service, and we receive no token that could be used to act on your behalf. There is no refresh token anywhere in the design.
Google returns a signed identity token containing your Google account ID, name, profile photo address and email address. We check its signature, that it was issued for Popmelon, and that it is less than five minutes old — then we discard it. We keep your name, photo address and, if Google has verified it and you agreed to this policy when signing in, your email address with your account. We use the email address only to identify your account when you contact us, to answer requests about your data, and for service and security notices about your account; never for marketing, and it is never shown to other people in a party. An email address Google has not verified is not kept.
We issue you our own session token, which contains your display name, your Google profile picture URL, an opaque identifier and an account ID. The token itself is held in your browser; we keep only its fingerprint. When joining a party, your extension sends this token only to its issuing relay. We verify it to show your name and Google-hosted photo to your party. The token is never shared with other participants. Photos load directly from Google without a referrer; an unavailable photo shows initials instead.
That identifier is a one-way salted hash of your Google account ID. We never store the Google account ID itself, and the identifier cannot be reversed back to it or matched against your account on any other service.

Signing out deletes the session from your browser; you sign in again to start or join another party. Your account stays on our server until you ask us to delete it; see Your rights.

What your browser stores

Locally, on your machine, and readable only by the extension:

your display name and the relay address, so you do not retype them
your session token, while you are signed in
a random install ID, created the first time it is needed and removed when you uninstall Popmelon
which version of this policy you agreed to, so you are asked only once
your active party, private host-resume key and selected tab ID in extension session storage
a recent in-memory chat history for the open party room, discarded when you leave
published/downloaded extension version numbers and update-check timestamps, so checks can be throttled and updates do not interrupt a party
whether you have sent a problem report from this browser, whether our server takes reports, when you last looked at “Your reports” and whether we have answered since, so the toolbar icon can show a quiet dot when we answer; while one of your reports is open, the extension asks our server for your reports every half hour, with your install ID and, if you are signed in, your session; and, from opening a report form until you send it or close it, the facts about the tab and party it will send, in extension session storage
from 0.8.6, how long you have watched in parties on this browser, and when it last asked you to rate Popmelon or a title (and which title), so it asks at most once every 5 hours of watching and never again once you have rated Popmelon; in builds from 0.8.0 before that, whether the one-time request to rate Popmelon was due, shown or answered, with when; none of this leaves your browser
with friend groups: which groups you chose to share a new party with; whether to suggest sharing while you watch alone, and when it last asked, so it asks at most twice a day; whether desktop alerts are on, and which groups you turned off or muted and until when; how long you choose to be free to watch; which shared parties and invitations the popup has already shown you, so the toolbar icon’s dot goes; and, for ten minutes, which tab a group’s Watch now opened, so that page offers to start the party for that group; none of this leaves your browser

In your browser’s synced extension storage, for each Google account you sign in to Popmelon with: the name you chose to go by in parties and whether your Google photo shows. If your browser syncs extension data (Chrome does when you turn on sync), it copies them to your other browsers on the same sync account, under that browser’s own privacy policy; otherwise they stay on this computer. We never read them from there: the extension sends them to the relay when you join a party.

If you choose to install Popmelon from a party invitation, the invitation page saves that party’s code in your browser’s storage for popmelon.app, so you can be taken back to the party once the extension is added. It is used for that and, without the code itself, to count that you came back. It is removed when you come back within two hours or when the party has ended, and ignored after that. A group invitation does the same with its invite link’s code.

From version 0.8.0, installing Popmelon opens a welcome page on popmelon.app, and removing it opens a short goodbye page there, where saying why is optional. Both addresses carry only the extension version: no install ID, no account, nothing else. When one of these pages opens, and when you pick a reason, our server adds one to a count of installs, removals or that reason, with the extension version, and keeps nothing about who or which browser it came from. To count each one only once a day, it remembers a one-way fingerprint of your IP address, in memory only, until the end of that day (UTC).

When you open a party link, the invitation page tells our server what it showed you: that you have Popmelon, that you need to add it, that you are on a phone or tablet, that your browser can’t run it, or that the party has ended; and, if you add Popmelon from there, that you clicked to add it and came back with it. The message carries nothing else: no party code, no install ID, nothing about who you are. Our server only counts these, at most once a day from the same IP address, with the same in-memory fingerprint. A group’s invitation page does the same, and also says when you joined from it, or that its link had expired: never which group or link.

Desktop alerts (“Maya is watching The Long Way Home”, with Join and Mute) use Chrome’s notifications. Popmelon asks Chrome for that permission only when you turn alerts on, and gives it back when you turn them off. An alert names only the person who shared the party, and shows on your computer only.

No advertising or analytics cookies. No tracking pixels. No third-party analytics.

The extension sends its version and install ID when signing in, joining a party or starting voice, so we can show a relevant update reminder and recognise the installation, and, when joining a party, the language your browser is set to, for recommendations in your language, which browser it is and how you joined. Release metadata checks use the relay's health endpoint without sending watch history, chat, credentials or captured media. The browser checks and downloads extension packages through the Chrome Web Store.

Server logs

Our web server also keeps ordinary access logs for this site and the relay: IP address, timestamp, which URL was requested, and standard request details such as your browser type, as every web server does, to run the service and investigate abuse. Logs roll automatically and old ones are deleted; we keep roughly the last 40 MB and no more. They contain no chat content, no playback data and no audio.

If you pick a reason on the page that opens after you remove Popmelon, the reason is part of that page’s address, so it reaches these logs like any other visit. We only ever count how often each reason comes up, as described in What your browser stores; we never look at who picked which.

Who can see it

People in your party see the name you go by, your Google profile photo unless you turned it off, your chat messages and your reactions while the party is open; someone who joins also sees the messages from the 15 minutes before. When the host removes someone or mutes them in the call, everyone in the party sees a line saying so, never why. They cannot see anything we have saved.
People in your groups see your name, your Google profile photo and who else is in the group, while you are both in it, and what you do in it: the party you share with it and what is playing, that you are free to watch, the parties you plan and your answers, what you add to its watch list and want, and your messages in its chat. They do not see your watch history or anything else we keep about you.
People you have watched with may see your name and photo as a suggestion when they invite people to a group, with how many parties you watched together and when last, unless you turn off “Invitations from people I’ve watched with”.
Anyone you send an invite link to sees the group’s name, your name and Google profile photo, and how many people are in the group, while the link works.
Our administrators. Only Gradientflow staff who administer the Popmelon server can read the database. Today that is one person, our founder.
Separate logins for separate jobs. The relay's own database login can add party chat messages and IP addresses but cannot read them back, and reads session fingerprints only to honour cancelled sessions. For someone signed in, it reads the groups they are in, with the names and photos of the people in them, and nobody else’s, and what those groups keep: their chat, watch list, planned parties and invitations, for people in the group only. Internal reporting logins can read party, membership, install, account, play, activity and sample records, including names, photo addresses and titles, but not chat text, IP addresses, sign-in sessions or friend groups and what they keep. The separate login we use to answer access and deletion requests can read saved chat and friend groups.
Looking at saved records. We look at the saved records of a particular party or person, including saved chat, only to investigate a report of abuse or a security problem, when you ask us to (for example, to look into a problem you reported), or when the law requires it. Otherwise we use the records only in aggregate, such as counting parties, adding up watch time across many people, or measuring how closely parties stay in sync, and automatically, to make recommendations from watch histories. A title appears in our totals only once several people have watched it.
Legal requests. We disclose records to authorities only when the law requires it.
If Popmelon changes hands. If Popmelon is sold or merged, we will ask for your consent before your information is transferred.

Who else is involved

Google — only to confirm who you are when you sign in, which starting or joining a party requires. Google-hosted profile photos load directly from Google. The Chrome Web Store, also run by Google, delivers the extension and its updates.
Our hosting provider — Hostinger runs the server, in Malaysia, that the relay, the database, the voice and video media server and this site run on. It stores everything above on our behalf.
Cloudflare — keeps a copy of each encrypted nightly backup, so the database can be recovered if our server is lost. Backups are encrypted on our server before they are copied, Cloudflare cannot read them, and we hold the only key. Both copies are deleted after 7 days.
TMDB, Spotify and YouTube — public catalogues our server asks about the titles parties play (see What we keep). They receive a title's name or id from our server, never anything about you.
Atlassian — hosts Jira, where we track each problem report you send as a ticket: your words, the category and service, the technical details if you included them, the screenshot if you added one, its reference number and when it arrived, and your answers to our questions. Never your name, email address, account or install ID. Atlassian keeps it on our behalf, as long as we keep the report.

The voice and video media server is LiveKit, open-source software we run ourselves on our own server; no LiveKit company receives your audio, video or details. Our database also runs on our own server; no database company hosts it or receives any of it.

We plan to offer paid features. When we do, payments will be handled by a payment provider on its own checkout page, and we will update this policy before then. Today Popmelon collects no payment information.

Netflix, YouTube, Spotify, Prime Video, Twitch and the other services Popmelon works with are not partners of ours. Playback happens through their own players and your own accounts. Spotify parties share the current song ID and playback position, and the songs on the party’s Up next list, with party members through our relay, not the music itself. Up next shows each song’s cover from Spotify’s own image server. Popmelon does not read your Spotify password, cookies or access tokens.

Security

Connections between the extension and our server are encrypted (HTTPS and secure WebSockets).
The database runs in its own container on our server and cannot be reached from the internet.
Sign-in session tokens and host keys are stored only as SHA-256 fingerprints. A fingerprint can recognise a token, but cannot be used to sign in as you or take over your party.
Your Google account ID is never stored, only a salted one-way hash of it. Your install ID is stored only as a one-way derived code.
Each part of the system has its own database login with only the access it needs, as described in Who can see it.
Backups are encrypted on our server before they are copied off it, and the key that decrypts them is not stored with them.
Voice and video access tokens deny recording permission.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

Where your information is processed

Popmelon is run from Singapore, and our server is in Malaysia. Wherever you use Popmelon from, including the European Economic Area, the United Kingdom and the United States, your information is sent to and stored in Malaysia, and administered from Singapore. Encrypted copies of our nightly backups are also kept by Cloudflare, which may store them in other countries; they cannot be read without our key. The problem reports you send are also kept by Atlassian, in Jira, which may store them in other countries, without your name, email address or IDs. These countries may not have data protection laws equivalent to yours. Our hosting provider, Cloudflare and Atlassian process it for us under their data processing terms.

What we do not collect, and what we do not do

We never collect:

an email address other than the one Google has verified for the account you sign in with
payment card numbers or bank details
the content of a shared tab, window or screen, or any recording of it
recordings of voice or video calls
anything from your microphone or camera while they are off
your browsing outside the video or song a party is playing
your Google, Netflix, YouTube, Spotify, Prime Video, Twitch or other streaming service passwords, cookies or tokens
your precise location

And we do not:

sell or share your information, including for cross-context behavioural advertising
use your chat or what you watch for advertising
read saved chat except as described in Who can see it
record voice or video
track you across websites

Your rights

Wherever you live, you can ask us to:

see and copy what we hold about you, in a common machine-readable format
correct it — you can also choose the name you go by in parties, or hide your photo, in Popmelon’s settings or the party room, and your account name and photo update from Google the next time you sign in
delete it
object to or restrict how we use it, including the records we keep for our legitimate interests; for example, to stop recommendations made from your watch history, and delete that history
withdraw consent, where we rely on it

Email hello@popmelon.app from any address and include the ID that lets us find your records:

Your account: your Popmelon account ID, shown in the Popmelon toolbar popup under Your data, or write from the email address of your Google account and we will find your account by it.
Your browser: your install ID, shown in the same place, for records tied to that browser rather than to your account. It is random and exists only in your browser, which is how we know the records are yours. Keep it private, and copy it before you uninstall Popmelon: uninstalling deletes it, and without it we cannot find those records.
If your extension never sent an install ID (older versions sent it only when you joined voice), tell us the name you used, roughly when and, once that party has ended, its link. We will do what we can and explain if we cannot find or verify the records.

When you ask us to delete your records, we cancel and delete your sign-in sessions and delete your account, your install records, your chat messages, your playback and connection samples, the IP addresses linked to you, your problem reports with our replies and their tickets in Jira, and your name history; we take you out of your friend groups (a group you own passes to the person who has been in it longest, or is deleted if nobody else is in it); and we replace your name in past party records with “Deleted user”. The de-identified party, activity and what-was-played records that remain are deleted on the normal schedule. For 8 days we keep a note that sessions issued to a deleted account are void, so an old sign-in cannot bring it back. Backup copies are gone within 7 days. When you ask for a copy, we send your own records and your own chat messages, not other people's messages, together with what was played in the parties you were in and the friend groups you are in, with your role in each and when you joined.

We do not charge for requests. We reply within one month, and tell you if we need longer where the law allows. If you are not satisfied with our answer, reply to ask us to reconsider it; in the United States this is your appeal. You can also complain to a data protection authority: the Personal Data Protection Commission in Singapore, your local supervisory authority in the European Economic Area, or the Information Commissioner's Office in the United Kingdom.

If you live in the United States

Since 5 October 2026 we have collected these categories of personal information, from you, your extension and Google (when you sign in): identifiers (display names, account and install IDs, IP addresses, and profile photo addresses); internet or other electronic network activity (the activity log, what was played, and playback and connection samples); what you write to us in problem reports, and any screenshot you add, since 5 November 2026; and sensitive personal information, namely the contents of chat messages. We use them only for the purposes on this page, keep them for the periods above, and disclose them only to the providers in Who else is involved. We do not sell or share personal information, and we use sensitive personal information only to provide Popmelon and keep it secure. You have the rights described above, you may use an authorised agent, and we will not treat you differently for using them.

Children

Popmelon is not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child under 13 has used Popmelon, contact us with their install ID or account ID, and we will delete their records.

Chrome Web Store and Google data

Popmelon's use of information received through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements: we use it only to provide and improve watch and listen parties, we transfer it only as described on this page, we never use it for advertising or to decide creditworthiness, and people read it only as described in Who can see it. Popmelon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

If we change what we keep about you, why, or for how long, we update this page, its version and the date at the top, and the extension asks you to agree again, on the button you press to start or join your next party or to sign in, before the change applies to you. Other edits, such as how we count visits without knowing who you are, change only the date.

Contact

Questions about any of this, or requests about your information: hello@popmelon.app.