Privacy
Last updated 3 November 2026
- We keep what is needed to run your account, your sessions and your follows, and nothing to sell.
- No advertising, no analytics, no tracking cookies. The typeface and scripts come from this server, not from anybody else’s.
- A session is recorded for the DJs who played it to download. We look at a recording ourselves only to investigate a report or a suspected breach of our terms. Every session is recorded and its recording is there to download for 3 days after the session ends. Then it is deleted and cannot be recovered.
- Everything we keep is stored on servers in Germany, in the European Union.
- Chats between DJs and group chats are kept encrypted on the server, not end to end. Don’t use chat for anything confidential or private.
- You can ask for a copy of your data or delete your account in account preferences at any time.
Who is responsible
Back2Back is run by one person in the United Kingdom, free of charge and not as a company. In data-protection law that person is the “controller” of the personal data on it: the one who decides how it is used and who answers for it. You can reach them at help@back2back.music.
What we keep and why
| What | Why | For how long |
|---|---|---|
| Your email address | To sign you in, to confirm the address is yours and to send the emails described below. If you change it, we will send your new address a verifcation code that you must input to complete the change; only then does it replace the old one and the old address is notified of the change. | Until your account is deleted. |
| Your name, handle and profile picture | So other people can tell who you are. All three are public: your picture is shown beside your name wherever it appears, including beside your comments. | Until you change them or your account is deleted. |
| Your time zone | The time zone you choose when you create your account, or later in Account preferences, such as Europe/Paris, so that emails about sessions, and the times of sessions, are in the time zone of your choice. It stays as you set it wherever you sign in from. | Until it changes or your account is deleted. |
| Your password | Only as a one-way hash (Argon2). We cannot read it and nor can anybody who obtained the database. | Until changed or deleted. |
| Two-step sign-in, if you turn it on | The key your authenticator app shares with us, kept encrypted, so that a copy of the database holds nothing that can make a code; your recovery codes, only as one-way hashes; and when the last code was used, so that no code works twice. We email you when it is turned on or off and when a recovery code is used. | Until you turn it off or your account is deleted. A recovery code is deleted the moment it is used. |
| Sessions you create or play in | Their names, who played, whether they were public and when. It is how invitations, the list of live sessions and your recordings work, and how the DJs you have played with are listed first when you invite somebody. You can take a set you played off your own public page; it stays on the other DJs’. | Until your account is deleted. A session you played with another DJ is theirs as well, so it stays in their history after that — without your account associated with it. |
| Recordings of your sessions | The audio of the set, as the audience heard it, for the DJs who played to download. If you delete your account, you can no longer download them; the other DJs still can until they expire. | Every session is recorded and its recording is there to download for 3 days after the session ends, for the session’s DJs. Then it is deleted and cannot be recovered. A copy we download to investigate is deleted as soon as the investigation no longer needs it. |
| Sessions recorded for debugging | Only for testers we have asked, while their account has debugging turned on: a debugging session started from the app’s Debugging menu — with a test record playing instead of their decks or with their physical decks. Nothing else: a public or private session is never recorded for debugging, whoever plays it. While debugging, each DJ’s app records its log and audio sent and received on their computer. When the session is over each tester’s app sends them to the server and deletes them from that computer. With the operator in the session, the operator’s app collects them together with this server’s own recordings of the session and deletes every file of it from the server. With two testers and no operator, this server zips them up with its own recordings, deletes the session’s files and emails the operator a link to the zip, which is deleted 15 minutes after it is downloaded or a day after it was made, if nobody downloads it. Either way, a debugging session is in neither DJ’s recordings or public profile sessions and nobody else has access to it. | On this server until the operator has them and never longer than 24 hours after they are made (the zip: until it is downloaded, then 15 minutes) |
| Listeners invited to a private session | The handle or email address a DJ invites to listen to their private session, so that they can be emailed its link, and an invited account sees the invitation in its notifications until it clears it, and so the session’s page answers an invited account when it is signed in. The link itself opens the session to whoever has it, with or without an account. | Until the session’s DJs take the invitation back, or the account that made it is deleted. |
| Friends, invitations and who you follow | To show your friends list, deliver invitations, and email you about DJs you follow. Who follows you, who you follow and your friends are listed on your public page for anybody signed in to see — but never to a DJ you have blocked or who has blocked you, and nobody across a block from the reader is in those lists. | Until you remove them or your account is deleted. |
| Sessions you schedule | To list them publicly and remind the people who follow you. One that was agreed and then cancelled stays on its DJs’ public pages as cancelled, with who cancelled it and when, unless it is put back on — or one of its DJs takes it off their own page, which takes it off theirs alone. Taking one that is still to come off your page cancels it. | Until your account is deleted. |
| Thumbs up | Which public sessions you have given a thumbs up, so that it counts once and you can take it back. Only how many a session has is shown, never who gave them. | Until you take it back or your account is deleted; for a session over more than a month, deleted then. |
| Who listened to a session | So that each listener counts once in how many listened to a session — what its page and Live now’s Top this week show — your account if you are signed in, or else a one-way code this server makes from your connection’s address for that session alone, which cannot be turned back into your address and is never shown. Where listeners are: your browser also says its time zone (such as Europe/Paris) as you start listening, and it is added to a count of that session’s listeners in each time zone, so that we can see roughly which countries listen. It is never kept with who you are. | Until the session ends, when who listened is deleted and only how many is kept: in all, how many were signed in, and how many in each time zone. |
| Comments | Shown publicly on the session’s page, with your name and picture, where listeners can scroll back through them while the session runs. A session keeps its most recent 500 at most. | Until the session ends, when every comment on it is deleted. Nothing keeps a transcript. |
| DJs-wanted posters | A poster you put up says what you play, a few words of your own, when you are usually free, whether you are after a public set or a private practice, how long you have been playing, and your time zone, which your browser or the app fills in so that a poster can show the time where you are. A picture, if you add one: it is made smaller on your device before it is sent, and this server keeps only the banner your poster shows — the middle of it, at most 800 by 450 pixels — never the file you chose; your profile picture is shown on the poster with it. Anybody signed in can read the posters, and the posters you have up, and the ones that have come down that you have not deleted, are on your public page for anybody. A DJ who is interested in your poster writes to you about it, and a copy of the poster as it was, without its picture, goes into that chat (see Chats). You are told in your notifications when a poster of yours is about to come down; nothing about posters is emailed. | On the board until you take it down, or 14 days after you put it up, whichever comes first. It then stays on your public page as it was, with its picture, until you delete it; we keep your 30 most recent and delete older ones, with their pictures. If we remove a poster that breaks our terms, it is deleted with its picture and every copy of it in a chat. Otherwise the copy in each chat it started stays with that chat. |
| Chats | What you write to other DJs — in Chats, in group chats, and during a session you play together, which is the same chat as yours with that DJ — and the DJs-wanted posters that started them. Only the people in a chat can see it; somebody added to a group sees it from when they were added. A first message goes straight to a DJ who follows you, is your friend or already chats with you; to anybody else it is a message request, and you can write no more until they accept it. They can accept it, delete it or block you, and you are not told if they delete it. Asking somebody into a group works the same way: they join or say no, and nobody is told if they say no. Two DJs in a session together can write to each other without a request. You can edit what you wrote for 15 minutes — only the newest words are kept — and unsend it at any time, which deletes it for everybody. Messages, the posters in them and what the links in them showed are kept encrypted on this server, with a key that is not kept with the database, so they cannot be read from a copy of the database on its own. They are not end-to-end encrypted: this server opens them to show them to the people in the chat, so whoever runs it could read them. What they say is never written to a log, and nor is who you chat with. Not encrypted in the database: who is in a chat and when each message was written, how far each of you has read, and the reactions given (which of the six, and by whom). “Seen”: the DJs you chat with see when you have read their messages, unless you turn that off in Account preferences or the app’s Settings (it stops only them seeing yours). Links: when a message has a link, this server opens it once to make its preview — so the site sees this server, not you — and keeps what it showed, and its picture, encrypted with the message. You are told of new messages on the website and in the app; nothing about chats is emailed. | Only while somebody in it still has it. Delete chat takes the whole chat off your side, posters too, and out of your list — the others keep theirs, and if anybody writes again you see only what is new. Leaving a group takes your copy with you; somebody removed from a group keeps what they had, read-only, until they delete it. A message, with its reactions and its link’s preview, is deleted from the server as soon as nobody has it any more, and once everybody in a chat has deleted it or left, nothing of it is kept — not even that you chatted. If you delete your account, the DJs you wrote to keep their side, with your messages shown as from “User”, until they delete it, and you leave every group. A backup of the database holds chats as they were then, encrypted. |
| Who you have blocked | So that nothing passes between you and a DJ you have blocked, either way: no invitations, friend requests, follows, messages or comments; and while they are signed in, they do not see your posters (you can still see theirs). When you block somebody, any friendship, follow, invitation or proposal between you ends at once; a set you had agreed to play together is cancelled (you are told first), as if you had cancelled it; and your chat closes — you both keep it, read-only, and either of you may delete your side. A block takes nobody out of a group chat: if you are both in one, you both stay in it and see each other’s messages there, and you can leave it; neither of you can add the other to a group. While they are signed in, the DJ you block cannot see who you are: your page shows them only “User”, with no picture and nothing else on it; your chat with them names you only as “User”; and they do not find you in search, among anybody’s friends or on the DJs-wanted board. What is public stays public: signed out, anybody can see your public page, and your name still shows on the sessions you play and on your comments. A set of yours the block cancelled is in their notifications as every cancellation is, saying who called it off. If you are in a session together at the time, you leave it at once and cannot rejoin it; if its set has started it carries on for them, alone, and if not it closes. They are not notified, though they will find they cannot reach you; only you see your list of blocks, in Account preferences. | Until you unblock them or either of you deletes your account. Unblocking opens your chat again, lets them see your profile and posters again, and offers to put back on any cancelled set that has not started; friendships and follows do not come back. |
| Whether your app is open | So your confirmed friends and the DJs you have played a session with, and nobody else, can see that you are online and free to play. | Held in memory only; forgotten within seconds of you closing the app. |
| Emails we have queued for you | The notifications about DJs you follow, and whether each was sent. | 7 days after it was dealt with. |
| Your IP address | Any server sees the address of whoever connects to it. We use it to limit abuse (for example, how fast listening links can be requested) and it appears in the server’s logs. Listening connects your browser to this server’s audio relay, which sees your address too. | Logs are kept for as long as the operator keeps them, and not used to identify listeners. |
We do not ask for your real name, date of birth or address, and we would rather you did not put them anywhere on Back2Back.
What other people can see
- Anybody: your name, handle and profile picture, your public page (how many follow you, how many you follow, how many friends you have, the public session you are playing, what you have scheduled, every agreed session of yours that was cancelled — with who cancelled it and how close to its time — and the DJs-wanted posters you have up and those that have come down that you have not deleted, with their pictures), the public sessions you play in, and your comments while the session is running.
- Anybody signed in: your DJs-wanted posters that are up, on the DJs-wanted board, and who follows you, who you follow and your friends, on your public page — except a DJ you have blocked, or who has blocked you.
- The DJs you chat with: your chats with them — a group’s, everybody in it — and nobody else’s.
- Your confirmed friends, and the DJs you have played a session with: whether your app is open and whether you are already in a session.
- The other DJs in a session: your audio, the recording of that session, and your chat with them.
- Anybody with a private session’s link — the listeners you invite, and whoever you or they pass it to: that session — its name, its DJs, its sound and its comments — and nothing else of yours.
- Those of us who run Back2Back, only to investigate: the recording of a session, public or private, when it has been reported to us or we have reason to think it breaks our terms. We may download it and listen to it to decide what to do, which can include deleting it or reviewing an account. It is never used for anything else, each download is written to our admin log, and our copy is deleted as soon as the investigation no longer needs it.
- Nobody: your email address, your password, who you have blocked, and your private sessions beyond those with their link and the investigations described above. Your chats are for the people in them alone — though this server, which keeps them encrypted, holds the key, so whoever runs it could read them: don’t use chat for anything confidential or private.
On your own device
No cookies. When you sign in on the website, your sign-in is kept in your browser’s local storage so that you stay signed in; signing out removes it. It is only ever sent to this server. The app keeps your sign-in, your audio settings and its logs on your own computer. During a session the app also keeps, in its own data folder, the tracks it has read from your USB and any track handed to you by the other DJ.
Emails
We email you a code to confirm your address. If you follow a DJ, we email you when they schedule a session or put a cancelled one back on, fifteen minutes before it starts, and when they go live in a session they did not schedule; if a session is cancelled, you see that in your notifications rather than by email. If you are one of a scheduled session's DJs, we remind you a day and fifteen minutes before it. Every one of those emails says why you got it and how to stop it: unfollow the DJ and they stop. We also email you about your account itself, which you can’t turn off: when you reach a new tier through your followers, when we give you a tier, two days before a tier given for a while ends, when your email address, two-step sign-in or account’s standing changes. We do not send advertising, and we do not give your address to anybody.
Who else handles your data
We do not sell personal data or share it for advertising. It is handled by the companies that any server depends on: whoever hosts this server, the email provider that delivers our emails, and, if the app download is hosted elsewhere, the service that hosts it (which sees your IP address when you download). Ask us if you want to know who they currently are. If the law requires us to hand data to the authorities, we will.
Where it is stored: the server, and everything Back2Back keeps about you on it — your account, recordings, comments and chats — is in Germany, in the European Union. UK data-protection law treats the European Economic Area as protecting personal data adequately, so it can be kept there without anything more.
Some of those companies handle data outside the United Kingdom. When they do, we rely on the safeguards UK data-protection law provides for an international transfer: an adequacy decision for the country concerned, or the UK’s international data transfer agreement or addendum in our contract with the company.
Your rights
Under UK and EU data-protection law you can ask us for a copy of the data we hold about you; to correct it; to delete it; to stop or limit what we do with it; and to give it to you in a form you can take elsewhere. You can change your name, picture and password yourself, unfollow and unfriend people yourself, and withdraw anything you agreed to at any time. To do any of the rest, or to have your account deleted, contact help@back2back.music. We will answer within a month.
The legal bases we rely on are: carrying out our agreement with you (your account, your sessions, the emails you ask for by following somebody); our legitimate interest in keeping the service secure and free of abuse (rate limits, logs, moderation); and your consent where we ask for it.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to your data-protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk).
Changes
If what we collect or do changes, this page will change with it, and the date at the top will say when. If it is a change that matters, we will tell you before it applies.