Privacy policy

Using Maple Lattes without an account

You can rank songs, edit moods, favorite tour songs and track your physical-media collection without an account. Guest progress stays in this browser’s storage. Clearing browser data can remove it. The site also uses browser storage to remember settings and keep work available while a connection is interrupted.

The iPhone and iPad app keeps its own working cache in app storage. It is separate from browser storage and can hold changes while the app is offline. The Android app keeps a separate local ranking cache and a cached public song catalog in its app storage.

Agreeing on first launch

The first time you open the iPhone and iPad app, it shows a screen with links to the terms of use and this privacy policy and asks you to agree before you continue. Nothing else in the app is shown until you choose Continue. If you choose Not now, you remain on the agreement screen and cannot access the app’s features until you agree; both policies stay readable from that screen. A Maple Lattes link you followed opens when you choose Continue and is discarded if you choose Not now. Your agreement is recorded only on your device as the policy version and date; it is not sent to Maple Lattes, Cloudflare or any provider, and no request is made to YouTube or TikTok before you agree. The app asks again when no valid acceptance is stored or when an app update requires acceptance of a newer policy version.

Signing in

Clerk provides our sign-in service. You can use email, Apple or Google. Clerk handles your account details, including your email address, account identifier, sign-in activity and any name or profile image supplied by your chosen provider. Apple may supply a private relay email address if you choose Hide My Email.

In the iPhone and iPad app, you can also choose a photo in Account → Manage account. Only the photo you select is uploaded to Clerk, which processes and stores it as your account profile image. This is optional and is used to display your profile, not for advertising. You can replace it or choose Remove photo in the profile editor.

Google sign-in requests your basic profile and email address to identify your account. It does not give Maple Lattes access to your Gmail, contacts, Google Drive or private YouTube account. Signing in with Apple is separate from connecting Apple Music.

On the website, Clerk uses cookies and related browser storage to keep you signed in and protect your session. In the iPhone and iPad app, Clerk stores the sign-in credential in the iOS Keychain. The Android app uses Clerk’s hosted browser sign-in; Maple Lattes does not copy its session token into the Android ranking cache. Optional Clerk usage reporting is disabled in the iPhone, iPad and Android apps. The Android authentication SDK sends an installation identifier and client information to Clerk to manage and secure sign-in sessions, including when it initializes before sign-in. See Clerk’s privacy policy, Google’s privacy policy and Apple’s privacy policy.

Saving your progress

When you are signed in, Maple Lattes automatically saves your progress with Cloudflare, linked to your Clerk account identifier. The website and the iPhone and iPad app can sync that saved progress. The Android app syncs main and From the Vault ranking documents, listening version choices, mood documents and tour-song favorites. It includes:

• Main and bonus rankings, unfinished rounds, earlier answers and card settings, including an optional name you put on a card.
• Original and Taylor’s Version choices, personal mood tags, energy settings and mood playlist order.
• Tour song favorites, identifiers for recordings you bookmark, and records of playlists you saved through Maple Lattes, such as playlist names and identifiers.
• Your physical-media collection and wishlist, plus the collection filters you choose.
• Song selections, searches, tour filters, sort order and image format preferences.

We also store revision numbers and save times to help keep different devices from overwriting one another. Account progress is private to your account; Maple Lattes does not publish it as a public profile. On the website and the iPhone and iPad app, progress from before sign-in is added automatically to empty sections of your account. The physical-media collection syncs between signed-in website sessions and the iPhone and iPad app. Android keeps guest and signed-in ranking caches separate; guest progress is not automatically copied into an account. Existing account progress takes priority, and the device copy is retained. On a shared browser, guest progress claimed by one account is not imported into another account.

Changes are kept in the browser or the app’s on-device cache before they reach the server. The iPhone and iPad app keeps its owner-scoped account and merch-settings caches in Application Support. The Android app keeps owner-scoped caches for rankings, listening choices, moods, tour favorites, and your signed-in physical-media collection, wishlist, and selected collection filters. Check the saving status before switching devices: a pending or offline change has not yet reached your account. Browser-local copies and the app’s owner-scoped caches can remain after sign-out, so clear site data when leaving a shared browser. On a shared phone or tablet, clearing app storage or deleting the app can remove local progress copies, but does not close your account or remove the remote collection.

Apple Music and song previews

Apple Music supplies album artwork for rankings and song previews, and handles authorization when you connect your library. Song previews are short clips streamed from Apple when you press play; Maple Lattes does not download or store them. Loading artwork or a preview sends a request to Apple that includes your IP address and device information, under Apple’s privacy policy. In the iPhone and iPad app, My Collection uses illustrated format symbols rather than product photographs or album artwork.

When you connect Apple Music, the app checks your catalog region and access to library playlists. Saving a playlist sends your chosen playlist name and songs to Apple. The website reads back a new playlist to check its song order. The iPhone and iPad app creates the playlist but does not read it back. Your Apple Music authorization token is not included in saved ranking data. You can revoke Apple Music permission in your device Settings.

On Android, Connect Apple Music is a separate, optional action. The app encrypts the Music User Token in Android Keystore-backed device storage; it is not sent to the Maple Lattes account service. When you choose to save, Maple Lattes obtains its developer token in memory, then sends Apple the Music User Token, your requested playlist name and description, and the exact recordings you selected. Apple returns the playlist receipt and link. Android uses this authorization for the selected export and does not perform a general music-library read. Use Clear Apple Music in the save screen to remove the device token. Clearing it, signing out of Maple Lattes, or deleting your Maple account does not remove a playlist already created in Apple Music.

In the iPhone and iPad app, you can optionally load recently played Apple Music songs. The app filters that recent list for Taylor Swift on your device and holds the result in memory while the app is running. It does not add listening history to your Maple Lattes account or upload it to Maple Lattes or Cloudflare.

Maple Lattes Messages features show song and album names. They do not load song previews or provider players. Opening an Apple Music link takes you to Apple’s service, where Apple’s privacy policy applies.

Videos from YouTube and TikTok

Maple Lattes lists performances, music videos, interviews and other recordings that other people published on YouTube and TikTok. Maple Lattes’ publishing tools use YouTube API Services to obtain and refresh each YouTube video’s title, uploader, length, thumbnail address and availability, and check each TikTok link and creator name. The listed catalog details come from our published catalog. Thumbnails and embedded players can make direct requests to providers, as described below. Maple Lattes does not ask you to sign in to YouTube or TikTok, and we do not receive information about your YouTube or TikTok account.

In the iPhone and iPad app, video details are shown as text and a thumbnail, and the video opens in the YouTube or TikTok app or your browser when you tap it. The app does not contain a YouTube or TikTok player and does not play, host or store video. Thumbnails are loaded from YouTube’s image servers (i.ytimg.com) when a video list is shown, which sends YouTube your IP address and device information and the requested image. The app does not load TikTok images. Once a video opens in another app or your browser, that provider’s privacy policy applies to playback, cookies and advertising.

On the website, recordings may use YouTube or TikTok players. Loading a thumbnail or player sends requests to that provider, including your IP address, browser information, the requested video or image, and referrer information where provided. Thumbnails can load before you play a video. Providers control their players, may serve ads, and may use cookies or similar technologies under their own policies. Our use of YouTube’s privacy-enhanced player on the website does not mean no information is sent to YouTube.

On Android, an explicit Play recording tap can create a provider-controlled YouTube player in an in-app WebView. Autoplay is off, but YouTube receives basic data when that player loads and further data when playback begins. The embed uses a strict-origin-when-cross-origin referrer policy, so the Maple Lattes origin can be sent to YouTube. Maple Lattes does not add a JavaScript bridge or sign you in to YouTube. You can instead use Open externally. YouTube controls availability, playback, advertising and its processing, and may show ads in the provider player.

Keeping video details current. Maple Lattes refreshes YouTube video details through YouTube API Services and republishes its catalog regularly. When the iPhone or iPad app loads its catalog, it filters selected YouTube-provided details whose verification date is at least 30 days old, replacing affected information with a refresh-needed label or placeholder. Recording references and bookmarks remain. We save identifiers for recordings you bookmark; their displayed details come from the catalog and follow the same rule.

See Google’s privacy policy, the YouTube Terms of Service and TikTok’s privacy policy. Following a retailer or source link takes you to a service whose own privacy policy applies.

Shared images

Share images are made in your browser on the website or on your device in the app. Maple Lattes does not upload the image itself. When you share one, the app or service you select receives it. Card details may still be part of your saved progress.

Games, shared playlists and invitations

You can play How Well Do You Know Me? or make a shared playlist without a Maple Lattes account. On Android, invitations are shared through the device share sheet or opened from a link only after you review it. We store the names players choose, selected songs, submitted rankings and predictions, scores, and game times with Cloudflare. For shared playlists, we also store the playlist title, optional theme, each player’s song selections, votes, order, and approvals. Your opponent can see your answers after both of you submit that round or the shared playlist choices needed to finish it. These activities do not change your personal song rankings.

Rank Together is different: the selected songs, rankings and shared result travel in the message or share destination you choose. Maple Lattes does not store Rank Together rankings on its game server.

For How Well Do You Know Me? and shared playlists, a private player key stays in encrypted device storage; the server stores a hash of it. Invitations use a separate link that lets the first recipient who joins claim the other player’s seat. Share invitations only with the person you want to play with. We also keep short-lived security counters derived from IP addresses to limit repeated game and playlist creation and joining.

If you save a game to your account, we link your player seat to your account identifier. Account history shows game details and revealed scores. Games and shared playlists expire thirty days after creation and are then removed by scheduled cleanup, including game account-history links. Unfinished drafts can remain on your device. Clearing account data removes your game-history links. When you delete your account, we also erase your name and submitted answers from games explicitly linked to that account, revoke player access, and end those activities. The other participant’s independent data can remain until the activity expires. Unlinked guest activities are separate; deleting an account does not establish ownership of them. Messages, shared links and images you have already sent remain with their recipients.

You can report shared text or leave or block a private activity. Leaving or blocking ends that activity for both participants and prevents further interaction in it; it does not block a person across unrelated invitations. A report stores the activity identifier, reporting participant’s seat, selected reason, shared nicknames and any playlist title or theme, plus creation and review times. Reports do not contain player keys, invitation links or private answers. They expire after 30 days and are then removed by scheduled cleanup. Access is restricted to report review. Deleting a linked account removes its own reports and redacts its name from other reports about the linked game. Contact info@maplelattes.com about a report or safety concern.

Website analytics

We use Google Analytics on the website to understand which pages people visit and how they use Maple Lattes. Website analytics can load when a page opens, including when you are not signed in. It uses cookies and similar technologies to measure visits, interactions, and information about devices and browsers. Google Analytics is not used in the iPhone, iPad or Android app. The Android app has no advertising SDK or native Google Analytics SDK. Browser cookie controls may affect sign-in and saved progress. You can use Google’s opt-out browser add-on in supported browsers; this controls Google Analytics, not requests to other providers. See Google’s privacy policy and how Google uses information from sites that use its services.

You can allow or exclude Google Analytics for this browser. This choice applies to Maple Lattes website analytics; other provider requests have separate controls.

Optional merch notifications

If you turn on shop notifications on the website, we store your browser’s push subscription, your account identifier, selected alert categories and watched items with Cloudflare. The subscription includes a delivery address and encryption keys used by your browser’s push provider. It is private and is not included in ranking backups. Your alert choices are saved to your account, while permission is granted separately in each browser.

If you turn on shop notifications in the iPhone or iPad app, the app sends its Apple Push Notification service (APNs) device token, its APNs delivery environment, and its association with your account to Cloudflare, along with your alert settings and watched items. Cloudflare stores those details to send alerts, and Apple delivers the notification through APNs. The app keeps the current APNs token only in memory and asks iOS for it again when the app starts.

Android merch alerts require a signed-in account, your explicit in-app opt-in, and, on Android 13 or later, notification permission. Only after that opt-in does Maple Lattes enable Firebase Cloud Messaging and request a registration token. Firebase may use an installation identifier to provide the service. Maple Lattes sends the registration token to Cloudflare, where it is associated with your account and a hashed device registration ID, along with your selected alert settings and watched items. Cloudflare uses the token to ask Firebase Cloud Messaging to deliver a notification containing a merch title, body, category and Maple Lattes merch link. Firebase uses installation IDs to route delivery and retains an installation ID until the Firebase customer requests deletion; Firebase says deletion from live and backup systems can take up to 180 days. Firebase and Cloudflare process this information to provide the notification service. This is not Google Analytics or advertising.

Notifications can arrive while the site or app is closed. Your browser’s push provider processes encrypted notification delivery. On the website, turn notifications off from the Merch page, or clear your account data to remove all notification subscriptions and settings. In the app, manage alerts in Account → Notifications and manage device permission in system Settings. Turning Android alerts off, signing out, deleting an account, or Firebase reporting a token as unregistered requests removal of the Cloudflare device registration and stops future Maple Lattes sends once the request succeeds. Turning alerts off also disables Firebase Messaging and requests deletion of its current registration token. Deleting the notification registration token does not itself delete the Firebase installation identifier. Remote cleanup requires a working connection. Browser permission and account sign-in are separate; signing out does not itself revoke browser permission, so turn notifications off before leaving a shared device. Delivery records are kept briefly for duplicate suppression and removed after expiry.

Running Maple Lattes

Cloudflare hosts and protects Maple Lattes and provides website traffic and performance analytics. It can process technical information from website and app requests, such as IP addresses, request details, browser or device information and security signals. Google Fonts supplies the site’s typefaces, which requires your browser to request font files from Google. See Cloudflare’s privacy policy and Google Fonts’ privacy information.

We use account and progress data to provide sign-in, save your choices, resolve support requests and maintain the service. Maple Lattes does not sell your saved song choices or use them to target advertising.

We require all third parties with access to user data, including Clerk, Cloudflare, Firebase, Resend and Google, to provide the same or equal protection of that data as described in this Privacy Policy and required by Apple’s App Store Review Guidelines.

Clearing data and closing an account

While signed in on the website, open Account → Saved data → Clear account data. In the iPhone and iPad app, use Account → Clear account data. This clears the content saved to your account, all notification subscriptions and settings, and the affected local cache after the server confirms the request. It keeps your Clerk sign-in account. The service retains empty save records and revision information to prevent an older device from restoring cleared progress. The current Android app does not include Clear account data. Android sign-out ends the current session and preserves local guest and account-progress records. It also disables Android merch alerts and requests deletion of the Firebase token and Cloudflare device registration; remote cleanup can wait for a working connection. Guest progress, downloaded backups, playlists already created in Apple Music and copies on other devices are separate and may need to be cleared separately.

You can delete your sign-in account from the account menu on the website, use Account → Delete account in the iPhone and iPad app, or use Account → Delete account in the Android app. Android presents a confirmation before it requests deletion. When Clerk sends us the verified deletion notice, we remove your remote saved account progress, notification subscriptions, alert settings, queued notifications and account links to saved Messages games. Before removing those links, we erase your linked player name and answers, revoke player access, and end the linked activities. After deleting your account data, we retain your account identifier and deletion date for 30 days to prevent delayed requests from restoring it. We then automatically remove this temporary record during our daily cleanup. In the app, the affected on-device cache is replaced with a deletion marker for the same reason. A notification already being delivered may still arrive.

Deleting an account does not remove browser-local copies, downloaded or exported files, playlists already created in Apple Music, or Messages and images already sent to recipients. An activity linked to the deleted account is ended and its access is revoked. The other participant’s independent data may remain until the activity’s original thirty-day expiry. Guest activities that were never linked to the deleted account continue independently.

We retain saved progress until you clear it or request removal. Hosting, security logs and provider backups may remain according to the providers’ retention practices. For help accessing, correcting or removing your data, contact info@maplelattes.com. We may need to verify that you own the account before making a change.

Privacy choices and requests

Depending on your jurisdiction and applicable law, you may have rights to access, receive a copy of, correct, delete, restrict, or object to certain processing of your personal information, or to withdraw consent where consent is the basis for processing. You may also be able to complain to your local supervisory authority.

Contact info@maplelattes.com to make a request, including if you do not have an account. We may ask only for information needed to verify your identity. Do not send passwords or other account credentials.

Newsletter signup requests

When you sign up for Maple Lattes emails, we collect your email address, consent time and source page with Cloudflare. Your request remains unconfirmed. The newsletter hasn’t launched yet. We save your signup request and will ask you to confirm your email before sending newsletters.

The request form uses Cloudflare Turnstile and rate limits to reduce automated submissions. We do not store your IP address in the newsletter request record. Repeating a request updates the same unconfirmed record without revealing whether that address was already recorded.

Contacting support

When you submit the support form, we use your name, reply email address, selected platform and message to respond to your request. Cloudflare handles the form and passes validated messages to Resend for delivery to our support mailbox. Your message is not added to your Maple Lattes rankings or account progress.

The form uses Cloudflare Turnstile to check for automated submissions and rate limits to reduce spam. Cloudflare can process your IP address, browser information and security signals for these checks. Support messages and replies may remain in our support mailbox and the email providers’ records. Please do not include passwords or other account credentials. See Cloudflare’s privacy policy and Resend’s privacy policy.

Questions or changes

Contact Boxcue Technologies LLC at info@maplelattes.com. We will update this page when our data practices change, show the revision date above, and provide notice of material changes through the service or another appropriate channel when required.