Who we are
LoveButton is operated by Dan Cseko, an individual in New York, USA, responsible for the personal information processed to provide the service. Contact support@bom.li about privacy, access, correction or deletion. The beta is for adults aged 18 or older. We do not knowingly collect information from children; contact us if a child has provided information so we can remove it.
Google user data we access and use
LoveButton uses YouTube API Services. Google supplies access and refresh tokens when you authorize a connection. We use these credentials to maintain your authorized connection without asking for approval for every action. We do not receive your Google password.
- YouTube channel ID and channel title: identify your account and display the destination for favorites. This can differ from the account playing music in your browser.
- Video IDs and your ratings: read whether you liked, disliked or have not rated the displayed video, show its heart state, and verify requested changes.
- Requested rating changes: send the displayed video ID and a like or removal request when you use the heart. Removing a like does not create a dislike or remove an existing dislike.
- Access and refresh tokens: stored encrypted on our server to make these requests for your authorized channel.
We request https://www.googleapis.com/auth/youtube.force-ssl because saving or removing a like requires write access through YouTube’s rating API. Read-only permission cannot make those changes. Google’s description includes broader capabilities; LoveButton does not use them to upload or delete videos, manage comments or captions, or access Gmail, Drive or Calendar.
Playback comes separately from your browser
After you consent during extension setup, the extension observes track title, artist, album when available, video ID, artwork URL, playback state, duration and progress on music.youtube.com. Tab and window activation select the most recently active playing music tab. It sends selected playback to LoveButton over HTTPS. It does not inspect your account menu or collect general browsing history. This sharing is separate from Google OAuth access.
The extension stores a revocable browser credential, sharing choices and a bounded playback/scrobble queue locally. It never receives Google tokens. Pause sharing stops new playback sharing; Disconnect removes pairing and queued plays. An offline browser can clear this data by removing the extension.
Other connected services and device data
Last.fm supplies your username, authorized session credential, recent listening and loved-track information. We use them to show music, read and save favorites, and submit now-playing information and qualified plays when scrobbling is enabled. YouTube Music scrobbling starts enabled when Last.fm is connected unless you previously opted out. Turn it off in Settings; your choice persists across reconnects.
Apple login supplies an account identifier and authorization credentials for sign-in. This is separate from permission to read the Music app. Companions share enabled Roon or Apple Music sources, device/source names, track metadata, artwork, playback state and supported favorite status. Operating-system permissions remain under your control. We do not upload audio files.
Essential secure cookies maintain sign-in and short-lived authorization transactions. Browser local storage selects your session; extensions and companions retain pairing information, preferences and delivery queues. Clearing site data or uninstalling the corresponding app/extension removes its local storage. Offline devices cannot be remotely erased until they reconnect. We store the legal document version and time you accepted it, including your adult acknowledgement, not your birth date.
Who receives information
- Google/YouTube and Last.fm: receive authorized account requests, requested favorites and, for Last.fm when enabled, listening submissions.
- Vercel and Upstash: provide hosting, operational infrastructure and server storage, processing data needed to provide the service.
- Song matching and sharing: when you request a song link, track metadata may be sent to Apple’s catalogue, Last.fm and MusicBrainz to identify the recording. MusicLink receives a matched catalogue identifier or ISRC to produce a share page. Google credentials and channel identity are not sent to these lookup services. Recipients of your copied link can see the song.
- Artwork and external links: loading third-party artwork or visiting another service exposes normal connection information, such as your IP address, to that provider under its policy.
- Diagnostics and analytics: Vercel processes operational requests and production page analytics. Application analytics strip URL queries/fragments and exclude authentication/API paths. Optional success events contain feature categories, not channel IDs or music history. Infrastructure access logs are separate from application logs.
We do not sell personal information or use Google user data for targeted advertising, data brokerage or generalized AI/model training. Operator access is limited to providing the service, support you request, security and legal obligations, subject to applicable restrictions. Disclosures required by law or necessary to address fraud or security incidents are limited accordingly.
LoveButton’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. See Google’s Privacy Policy.
How we protect sensitive data
LoveButton uses HTTPS for connections to its server, Google and server storage. Provider credentials are encrypted before server storage using AES-256-GCM authenticated encryption. Encryption keys and service credentials remain in server configuration. Google tokens are never included in the extension or browser-readable application responses.
Session cookies use Secure, HttpOnly and SameSite protections. Requests check session ownership and bind favorites to the selected account and channel. Google OAuth uses state and PKCE to protect authorization exchanges. Application logs use an allowlist of operational fields rather than raw provider responses or credentials. Infrastructure access is restricted to authorized operators. These safeguards reduce risk; no system guarantees absolute security.
How long information stays
We retain data for the features you authorize. Routine retention is shortened when you request deletion or revoke the relevant access.
| Information | Routine retention |
|---|---|
| Playback | YouTube server snapshots expire 45 seconds after their latest update. Companion snapshots and artwork expire after 90 seconds. |
| YouTube favorite operations | Seven days after their latest stored update. |
| Scrobble delivery records | 30 days after their latest stored update, preventing duplicates and reconciling uncertain delivery. |
| Google connection | While authorized and needed. Authorization is checked periodically; API metadata is refreshed or removed within 30 days. |
| Account and preferences | While you keep the account, until deletion. Sessions expire after 180 days without renewal. A credential becoming unusable is distinct from removal of stored data. |
| Local extension queue | Up to 1,000 plays in a 4 MiB tracker budget, plus up to 8 KiB bookkeeping. Delivery, disconnect or local removal clears applicable entries. These limits do not guarantee delivery. |
| Song-link cache | Successful resolved catalogue/share links expire after seven days; these are not a personal listening-history database. |
We delete Google data associated with an in-app revocation or verified deletion request as soon as possible and within seven calendar days. A failed revocation can temporarily retain an encrypted token solely to retry cancellation. Google Account revocations are detected through periodic checks, with associated Google data removed within 30 days. Ratings and scrobbles already delivered remain with their service.
Some older duplicate-prevention records can no longer be linked to an account. They contain only delivery status and digests, with no track titles, channel IDs or provider credentials, and expire within 30 days.
Infrastructure logs and any provider-managed recovery copies follow provider configuration, not playback timers. Access is restricted to operational/security purposes, and completed deletions must be reapplied before restoring data into active use. Limited security records may remain to prevent old Last.fm credentials from recovering deleted account data; they contain no music history or Google tokens.
Your choices and rights
Use Settings to stop scrobbling, disconnect browsers/providers, or delete your LoveButton account. You can independently revoke access in Google Account connections. Our deletion instructions explain the differences and provide help if you cannot sign in. Never send passwords, tokens or pairing codes.
Depending on applicable law, you may request access, correction, deletion or a copy of your personal information, object to or restrict processing, and withdraw consent. We verify ownership proportionately before acting. Contact support to exercise these rights or raise concerns; applicable rights to complain to a data-protection authority remain available.
LoveButton is operated from the United States; providers may process information outside your location. Where applicable, processing relies on providing the service you request, consent for optional connections/sharing, legitimate operational/security interests and legal obligations. Applicable safeguards are required for international transfers; we do not promise storage in any particular country.
We update the effective date when this policy changes. Material changes are explained in the app. New uses of Google data require renewed acceptance and any necessary authorization before they begin.