mymy
Sign Up

Privacy

Last updated 27 October 2026

This policy covers mymytune.com. It says what the site collects, who else handles that data, how long it is kept, and how to have it removed.

Who runs this site

mymy is a personal site run by an individual in the Republic of Korea, who is also responsible for the personal data described here. Privacy requests and questions: ohyus1197@gmail.com.

Reading without an account

You can read everything without signing in. The magazine and the forum set no analytics or tracking cookies of their own; ads, where they are shown, come with Google's cookies (see Advertising). Our host, Vercel, records standard request logs (IP address, browser, the page requested) to run the site and stop abuse, and keeps them for a limited period under its own policy. We do not keep a separate copy.

We count visits with Vercel Web Analytics, which sets no cookie and does not store your IP address: it records the page, the site that sent you, and your country, browser, operating system and type of device, and we see only totals. On a piece it also counts, the same way, when a video on the page is played, when a reader gets halfway through the text and to its end, and when one of the related pieces below it is opened. These counts tell us whether a piece is read, not who read it.

If you close the strip that offers to install mymy, your browser's local storage keeps the date (mymy:install-dismissed) for 30 days so the strip does not come back. If you open a password-reset link, a temporary note (mymy:recovery) stays in session storage until you save the new password, choose Back to sign in, sign in or out, or close the tab. When you open a forum post, a note (mymy:viewed: followed by the post number) stays in session storage until you close the tab, so the post's view count goes up once per visit. After you delete your account, a note (mymy:deleted) stays in session storage until the sign-in box has said the account was deleted. While you are away at Google to sign in, a note (mymy:oauth) waits in session storage until you come back, and if you confirm an account deletion with Google, your choice about deleting your posts and your account's internal ID (mymy:delete-erase) wait the same way. None of these notes is sent to us, and only that last one names your account, until you come back from Google or close the tab.

Opening a forum post adds one to its public view count. We do not record who viewed it. The count is approximate: when several people open the same post within about two seconds, only one view is counted.

Opening a piece adds one to a private count of how many times that piece was read that day, which only the editor sees. We record the piece and the date, and nothing else: no IP address, no browser, nothing that could be joined back to you. Your browser keeps a note (viewed: followed by the piece and the date) so the same piece is counted at most once a day from one browser, and that note is never sent to us. Known robots are not counted.

If you add mymy to your home screen, we count that the same way: the day, the kind of device (iPhone or iPad, Android, computer) and whether it was installed, opened for the first time, or used that day, and nothing else. Your device keeps two notes (mymy:app-first and mymy:app-open, the last day it was counted) so it is counted once, and once a day; they are never sent to us.

If you create an account

  • Your email address.
  • Your password, stored only as a one-way hash by our account provider. Nobody at mymy can read it. An account made with Google has no password unless you set one with “Forgot your password?”.
  • When the account was created, confirmed, and last signed in.
  • The IP address and browser used when you sign in, kept by our account provider in its security logs.

If you continue with Google, Google tells our account provider your email address, your name, the address of your Google profile picture and your Google account ID, and that you signed in. They are kept with your account. mymy uses the email address, never shows the name, and uses the picture only if you choose: when you make your username (the box is ticked, and you can untick it) or later under Profile, your browser fetches it and it becomes your profile photo, a copy made the way described under Images. Google learns that you signed in to mymy, under Google's own privacy policy.

To keep you signed in, your browser keeps a sign-in token in a cookie (its name starts with sb- and ends with -auth-token), which the site reads on every page, the music player included. Signing out removes it from that browser.

If you take part in the community

To post, comment or vote you choose a username. From then on we store:

  • Your username, an optional short bio, the date you joined, and your karma (the total of the votes on your posts and comments).
  • A country flag. When you choose a username, our host tells us which country your connection comes from and we save that country code, not the IP address. You can change it or remove it under Profile at any time.
  • The posts, comments and links you write, the images and the music or video file you put on a post, and when you wrote or edited them.
  • Your profile photo, if you add one.
  • The songs you add: the YouTube video, or the audio file or short video you upload, with its cover, its length and (for an audio file) a waveform your browser measured from it; the title and artist, how it was made (AI, AI-assisted or Human, and the tool), that you confirmed your right to share it, and when you added it; and their plays and likes.
  • When you listen to a member's song for 30 seconds (or for half of it, when it is shorter than a minute): a private record of which song and when. It is used only to count plays fairly (one an hour for each listener and song, none for your own songs) and is never shown to anyone else.
  • Your votes, and the posts you save.
  • Whom you follow and who follows you, and since when.
  • The people you block and the posts you hide.
  • Notifications telling you someone followed you, replied to you or added a playlist you shared, and whether you have read them, and which kinds you chose to receive.
  • When a moderator removes your post, comment or song or suspends your account: which rule it broke, kept with the post, comment or song and in a notification to you.
  • Your messages: the conversations you are in, the messages you send and receive and when, whether you accepted, declined or have not answered a message request, when you last read each conversation, when you deleted one on your side, and who can start a conversation with you.
  • When you unsend a message: its text, kept privately for 30 days so that a report about it can still be checked. Older texts are cleared whenever anyone sends or unsends a message, and a text goes at once with its message (when the conversation is deleted for good or the sender's account is deleted).
  • Reports you send about posts, comments, songs, accounts or messages: the reason, your note, and your account.
  • When you follow someone, add a shared playlist, add a song, start a conversation, send a message or upload a profile photo: a private note of the time, used only to apply those limits, which look back one day. Notes older than a day are cleared whenever anyone does one of these, and all of yours at once if your account is deleted.
  • When you delete a post or comment: a private note of which account deleted it and when it was first posted. It is used only to apply the posting limits, which look back one day, and is never shown. Notes older than a day are cleared whenever anyone posts or deletes, and all of yours at once if your account is deleted.

What is public and what is not

  • Public, to anyone, signed in or not: your username, profile photo, flag, bio, join date and karma, and whether your account is a moderator or suspended; whom you follow and who follows you; your posts, comments, links and images, and the playlists you share in posts; the songs you add, with their plays and likes; the scores of posts and comments, and the view counts of posts.
  • Only you: which way you voted on what, your saved posts, your notifications and your choice of them, the people you block and the posts you hide, and the record of the members' songs you played. Nobody is told that you blocked them or removed them from your followers.
  • Only you and the other member: your messages. The other side sees when you have read a conversation only after you accept it, and is never told that you declined a request. If the other member reports a message, the moderators read that message and the four before it in the conversation, including unsent ones (from the text kept for 30 days).
  • Only you and the moderators: the reports you send, and what was decided on them. Moderators can see which account sent each report.
  • A post, comment or song a moderator removes is hidden from everyone except its author and the moderators. The comments under a removed post are hidden the same way.

Images

Before a photo in JPEG, PNG or WebP format is uploaded, your browser redraws it, which removes the hidden details it may carry (EXIF), such as where and when it was taken and with which camera. Large photos are also scaled down, to at most 2560 pixels on the longer side. GIF files are uploaded exactly as they are, with anything hidden in them.

Images are stored with Supabase Storage in a private folder. Pages show them through signed links, issued for an hour at a time. When a moderator removes a post, only the author and the moderators can still see its images: the files are copied to new addresses and the old files are deleted, so a link someone opened earlier stops loading from our storage, usually within a minute. A copy already saved in a visitor's own browser is not affected. When you delete a post, its image files are deleted. When you delete your account, every image you uploaded is deleted.

A profile photo is made in your browser before it is uploaded: a square of 320 by 320 pixels from the middle of the picture, redrawn, so the hidden details are removed the same way. It is stored with Supabase Storage under a public address, because it is shown to anyone. When you change or remove it, the old file is deleted. A moderator may take a photo down; you are then told why in your notifications, and its file is deleted. When you delete your account, your photo is deleted.

Song and video files

An audio file you upload is read in your browser first, for its length and a waveform; the file itself is sent as it is, with any details stored in it (such as ID3 tags with a title, an artist or a picture). A video you upload is read in your browser for its length and shape, and the map coordinates a phone records into a video are blanked out there before it is sent; any other details stored in it (such as the phone's model or when it was recorded) go with it as they are. Either file is stored with Supabase Storage in a private folder. Anyone on mymy plays it, signed in or not, through links our server issues for an hour at a time; other websites cannot play it from mymy. Its cover (a picture you add, made square in your browser the way a profile photo is) is stored under a public address. When you delete a song, its file and cover are deleted, within two hours at the latest, and so, after an hour, is a file from a song you did not finish adding. When a moderator takes a song down, its file and cover are moved to new addresses, so links opened earlier stop working, usually within a minute. After that only the moderators can play the file; the file and the cover are kept for them until your account is deleted. When you delete your account, all your song files and covers are deleted. The download of your data includes the address of each of your song and video files (not those taken down), which gives you the file while you are signed in.

Music and video files on posts

A music or video file you put on a post is read in your browser for its length (and a video's size, or a music file's waveform: up to 200 loudness points, kept with the post to draw it), and the map coordinates a phone records into a video are blanked out there before it is sent; any other details stored in the file go with it as they are. It is stored with Supabase Storage in a private folder and stays on its post: it is not added to your songs. Anyone on mymy plays it, signed in or not, through links our server issues for an hour at a time; other websites cannot play it from mymy. When you delete the post, its file is deleted within two hours at the latest, and so, after an hour, is a file from a post you did not finish. When a moderator removes the post, its file is moved to a new address, so links opened earlier stop working; it is then kept for the moderators and for you until the post or your account is deleted. When you delete your account, your post files are deleted. The download of your data includes the address of each of your post files, which gives you the file while you are signed in.

Deleting what you wrote

When you delete a post, it is gone: its page no longer exists, and its title, text, link, images and file are erased. Comments under it are no longer shown; the people who wrote them can still delete them. When you delete a comment, its text is erased and it is no longer shown; if others replied to it, it shows as [deleted], with no author, so the replies keep their place. This cannot be undone. Deleting a post also deletes its image files from storage. If a file is ever left behind, write to ohyus1197@gmail.com and we remove it.

Emails we send

We email you only to confirm a new account, to reset a password you asked to reset, and to tell you when your password has been changed. No newsletters, no marketing.

The app, and alerts about new pieces

mymy can be added to your phone's Home Screen. It is the same website, not a download from an app store, and adding it stores nothing about you: we only count installs and daily use, as described under Reading without an account. The site registers a small background script (a service worker) so the app can be installed and can receive alerts; it stores no copy of the pages you read.

If you turn alerts on, your browser creates a subscription: an address at its own push service (Google, Apple, Microsoft or Mozilla, depending on the browser) and two keys that let only us send to it. We store those three strings and the date, and nothing else. There is no account, no email and no name attached, so we cannot tell whose phone a subscription belongs to, and we use it only to announce a newly published piece. Turning alerts off in the app, or in your phone's settings, removes it; we also delete the record as soon as the push service tells us it is gone.

Images from YouTube

Where a story or a review shows the official video's thumbnail, our host fetches it from YouTube and resizes it, so viewing it tells YouTube nothing about you. Tapping the video on a piece starts it in YouTube's player (youtube-nocookie.com): from then on YouTube receives your IP address and browser details under Google's privacy policy.

The music player

The music player uses your mymy account; there is no second sign-up. Without an account you can search, listen and look around, and nothing is kept about you. Signed in, the player keeps with your account, and shows only to you: the playlists you make and the songs in them, the queue you were playing (so it follows you to another device), and a record of what you played, with when, for how long, and whether you finished or skipped it. Deleting your account deletes all of it.

If you share a playlist in a forum post, its name and its songs, as they were when you shared it, become part of that post and are public like the post; your library itself stays yours alone. When someone adds a playlist you shared to their own library, the post shows how many people did, and you are told who (you can turn that off under Notifications on your account page). Their copy is theirs: it stays in their library if you delete the post or your account.

What anyone searches for in the player is kept, with its results, as a shared cache that makes the next search faster and that only our server reads; it holds the words and the results, nothing about who searched. The player also remembers, in your browser, your language (a cookie that also tells our server which language to show) and your country, which picks the charts you see.

Songs play in YouTube's own player (youtube.com): once you press play, YouTube receives your IP address and browser details and may set its own cookies, under Google's privacy policy. To show a song's title, your browser asks noembed.com for that video's public details, which tells that service your IP address.

Listening data in our reports

Some data reports use listening records from SoriPlay, a music player run by the same operator, collected under SoriPlay's own privacy policy, and may use this player's records the same way: only figures aggregated across many listeners, never anything that identifies a person.

Advertising

mymy shows ads from Google AdSense on its stories, new-release pieces and wiki pages, never on the music player. Where an ad is shown, Google and the other ad companies it works with (third-party vendors) use cookies to choose ads from your earlier visits to this site and to other websites. Google's advertising cookies let Google and its partners show you ads based on those visits. How Google uses this information.

You can turn off personalised ads from Google in its Ads Settings, and other companies' cookies for personalised ads at aboutads.info. You can also block or delete cookies in your browser.

If you visit from the European Economic Area, the United Kingdom or Switzerland, Google's consent message asks before any of this, and you can consent, decline or choose purpose by purpose. Declined, you still see ads, chosen without a profile of you. To change your choice later, use the privacy and cookie settings link Google shows at the bottom of any story, new-release or wiki page. If you visit from a US state with its own privacy law, Google shows a “Do Not Sell or Share My Personal Information” link at the bottom of those pages instead, which opts you out. Pages without ads load nothing from Google AdSense.

Who processes your data

  • Vercel: hosting and request logs.
  • Supabase: account records, community posts, comments, votes, saves, follows, blocks, hidden posts, notifications and their settings, messages, and reports, uploaded images and profile photos, alert subscriptions, the songs members add and the records that count their plays, and the music player's playlists, queue and play history.
  • Google: sign-in with Google if you choose it, delivery of account emails, YouTube thumbnails, YouTube's player for the songs you play, and the ads on mymy's pages where they are shown (Google AdSense).
  • noembed.com: the public titles of the songs the player shows.
  • Google, Apple, Microsoft or Mozilla: your browser's own push service, which carries an alert to your phone if you turn alerts on.

These companies may process data outside your country, so data can be transferred and stored abroad.

How long we keep things

Account records are kept until the account is deleted. Request logs are kept by Vercel, and sign-in security logs by Supabase, under their own retention policies.

Posts, comments and songs stay until you or a moderator deletes them. Removed posts, comments and songs are kept, hidden, so moderators can review or restore them. The records of your plays of members' songs are kept with your account. Reports are kept to keep track of moderation decisions.

Messages stay until you delete the conversation on your side, which hides everything before that moment from you. Once both of you have deleted it, or you have and the other member’s account is deleted, the messages neither of you can read any more are deleted for good. A message reported to the moderators, and the four before it, wait until the report is dealt with, so that they can read them (unless the account that sent it is deleted, which takes its messages with it).

You can delete your account yourself on your account page, after typing your password again (or confirming with Google, if your account has no password). Your username, bio, karma, votes, saved posts, notifications and their settings, whom you follow and who follows you, the people you blocked, the posts you hid, your profile photo, every image you uploaded, every message you sent, the songs you added (with their likes and comments) and the records of your plays are deleted at once. Your conversations stay on the other member’s side, without your messages, with you shown as a deleted member. If you tick “Also delete all my posts and comments”, every post and comment you wrote is deleted too, in the same way as deleting them one by one (see above). If you do not tick it, your posts and comments stay on the site with no author, shown as [deleted], and your posts lose their images. Reports you sent stay, no longer linked to you. The private notes about deleted posts are erased with the account. Moderator accounts are deleted on request.

Your rights

  • Get a copy of what we hold about you: Download your data on your account page gives you one file (JSON) at once, or ask us for it.
  • Ask us to correct anything wrong.
  • Delete your account yourself on your account page. See above for what happens to your posts and comments. If you cannot do it there, for example because it is a moderator account, write from the address on the account and we delete it without undue delay.

Requests go to ohyus1197@gmail.com.

Children

Accounts are for people aged 16 and over, and we do not knowingly collect data from anyone younger. If you believe a younger person has signed up, write to ohyus1197@gmail.com and we will delete the account.

Changes

If this policy changes in a way that affects what we collect, we update the date at the top and say what changed.

27 October 2026: ads now show on stories, new-release pieces and wiki pages; added the consent message for visitors from Europe and the opt-out link for visitors from US states with their own privacy law.

26 October 2026: added Advertising, as mymy may now show ads from Google AdSense, and Google AdSense to the list of who processes your data.