privacy

last updated 10 October 2026

who we are

lobby.blue is run by the owner of lobby.blue, who is responsible for the personal data described here. Questions and requests: contact@lobby.blue.

what we collect

• Your username and a hash of your password. We never store the password itself.
• At signup only: your IP address and a rough description of your browser (its type, version, operating system and language), stored in scrambled form. We use these to help stop abuse. They're never sold, shared, or used for tracking, and they're deleted after 90 days (unless the account is banned).
• Chat messages and queued tracks are kept for 30 days and then deleted.
• Tracks added to a room's playlist stay until the room's owner or mods remove them, or the room is deleted. We record who added each one.
• Your own playlists (their names and tracks), which only you can see. They stay until you delete them or your account.
• A daily visitor count: just a number for each day. It can't tell who visited.
• A recovery email if you choose to add one in account settings.
• Two-factor login, if you turn it on. Your authenticator key and recovery codes are stored securely, and deleted when you turn it off or delete your account.
• A status message if one is set by you. It's public, so people in rooms you're in or where you've chatted can see it when they hover over your name.
• People you ignore or block, so the site can hide them from you. Only you can see your lists; nobody is told they've been ignored or blocked.
• Track suggestions for house rooms, with any note you add, deleted after 90 days.
• Reports. If something is reported, we keep the report, a copy of what was reported, and the few minutes of chat before it, so moderators can see what happened. Reports are deleted 180 days after a moderator deals with them.
• A record of moderation actions (like mutes and bans), kept for as long as the site runs so they can be checked.

your IP address

Like any website, our server sees your IP address with each request. Apart from the signup record above, we use it briefly, to limit how fast one network can sign up, log in or connect, and keep that for a day at most. Our logs don't record IP addresses.

cookies

Three cookies, all needed for the site to function. One keeps you logged in, one stops other sites from sending forms as you, and one for actions such as saving. No analytics or advertising cookies. Your browser also stores a few small things for lobby on your device, like your volume setting. They aren't used to track you.

other services

• YouTube. lobby uses YouTube API Services: we look up public details of videos people add, and music plays in YouTube's embedded player, so YouTube sees your connection while you listen. See the Google Privacy Policy.
• Cloudflare delivers the site and protects it from attacks, so your requests pass through its network. See the Cloudflare Privacy Policy.
• Our hosting and backup providers keep our data in the United States. The backup copy kept off-site is encrypted, so that provider can't read it, and backups are deleted after 14 days.
• Email, if you add a recovery email: confirmation and password reset messages go out through our email provider.

bans

To enforce a ban, we may keep information from the banned account's signup, such as its IP address, for as long as the ban needs it, and delete it after that.

your data

You can delete your account at any time from account settings. That removes your login, your signup IP and browser details, any email, your two-factor details, your ignore and block lists, your own playlists, and tracks you queued that haven't played. Rooms you own get passed to their oldest mod, or to an admin if there isn't one. Past chat messages stay, under an anonymous name, so conversations don't end up with holes. You can also ask for a copy of your data: write to contact@lobby.blue.

When the law requires us to keep something: if an account or room is involved in a serious matter, such as content we have to report to law enforcement, we may keep the data about it longer than the times above, including after the account is deleted, for as long as the law requires or an investigation needs. We share it only with authorities, under proper legal process.

lobby is for people 18 and older, and we don't knowingly keep data about anyone younger. If we learn an account belongs to someone under 18, we delete it.

We don't sell personal data. We share it only with the services above, so they can do their part in running lobby, or with authorities under proper legal process. There's no advertising or analytics on lobby.