Legal · Privacy · demobae.com and demob.ae
Privacy
This policy explains what demobae collects, why, and what you can do about it. It covers the website at demobae.com and the app at demob.ae. We keep it short on purpose. If anything here is unclear, write to privacy@demobae.com.
Last updated October 9, 2026
- Who we are
- What demobae does
- What we collect on the website (demobae.com)
- What we collect in the app (demob.ae)
- YouTube
- What we do not do
- Who else sees data
- How long we keep it
- Your rights
- Children
- Changes
- Contact
Who we are
demobae is operated by [legal entity], registered in [country]. In this policy, “we” means that entity and “you” means the person reading it.
What demobae does
You follow producers on YouTube. demobae watches their channels, puts each new beat in your Signal feed, and lets you save beats to a Library and sort them into mixtapes. To do that we have to store what you follow, what you save, and what you listen to. That is the product. Everything below follows from it.
What we collect on the website (demobae.com)
The website is static. It has no accounts and no forms. It records two kinds of data.
Campaign attribution. When you arrive from a link with campaign parameters, we record the first-touch UTM source, medium, campaign, content and term, the referrer, the landing path, and any ad click identifiers present in the URL (gclid, gbraid, wbraid, fbclid, ttclid, msclkid, twclid, li_fat_id). We keep the first touch and the most recent qualifying touch. This lives in your browser’s localStorage and in one first-party cookie that expires after 180 days. When you click through to the app, these values are added to the link so the app can credit the campaign that brought you.
Product analytics. We use PostHog to count page views and clicks on the “Explore the catalog” buttons. Analytics state is kept in sessionStorage, so it clears when you close the tab. Autocapture, session recording, surveys and cross-subdomain cookies are turned off. We do not run advertising pixels.
What we collect in the app (demob.ae)
Account data. Your email address and a password, or your Google account if you sign in with Google. We store a session cookie so you stay signed in.
Product data. The producers you follow, the packs you add, your watchlist notes and groups, the beats you save, your mixtapes, and your listening log, which records which beats you played and when. This data exists so the product works and so you can find what you saved.
Producer data. Public information about YouTube channels and videos: channel names, handles, avatars, subscriber and view counts, upload titles, thumbnails and durations, and links found in channel descriptions. We derive tags from titles, such as the artists a “type beat” names, and badges from channel statistics. None of this is about you.
Technical data. Server logs with IP address, browser and timestamps, kept for security and debugging. Error reports and the same PostHog analytics described above, under the same settings.
YouTube
demobae uses YouTube API Services to detect uploads and to play beats. By using demobae you also agree to the YouTube Terms of Service at https://www.youtube.com/t/terms. Google’s privacy policy at https://policies.google.com/privacy applies to data Google collects when you play a video through the embedded player. demobae never asks for access to your YouTube account and never sees your YouTube subscriptions or history.
What we do not do
We do not sell your data. We do not share it with advertisers. We do not build profiles for anyone else. We do not send email to you except about your account, and we have no newsletter today.
Who else sees data
Hosting (Railway) runs our servers and databases. PostHog receives analytics events. Google receives sign-in requests if you use Google sign-in and playback requests from the embedded player. Each of these acts on our instructions and under its own security commitments. We share data when the law requires it, and that is all.
How long we keep it
Account and product data stay as long as your account exists. Delete the account and we delete them within 30 days, except for backups, which roll off within 90. Attribution expires after 180 days. Analytics session state clears when you close the tab. Server logs are kept for 30 days.
Your rights
You can see, export, correct or delete your data. Write to privacy@demobae.com from the address on your account and we will act within 30 days. If you are in the EU, UK or a jurisdiction with similar rules, you also have the right to object, to restrict processing, and to complain to your data protection authority.
Children
demobae is not for children under 16. We do not knowingly collect their data. If you think a child has an account, tell us and we will remove it.
Changes
If we change this policy in a way that matters, we will say so on this page and, for account holders, by email. The date at the top is the date of the current version.