Popmelon privacy policy

The short version

Voice, video and shared screens are forwarded live and never recorded.
Chat messages, what your party played, IP addresses, and playback and connection samples are kept for 30 days.
Your watch history — what you watch and listen to in parties, with links to it, for how long, how you reacted and who with — is kept for 12 months. We use it to recommend what to watch and to suggest public parties, never for advertising.
Party records, the names used in them, how long each member watched, and the activity log are kept for 12 months.
Your age group and gender only if you choose to give them, with a separate agreement you can take back at any time. We never use your IP address to work out where you are.
You sign in with Google to start or join a party. Your account — your name, photo and the email address Google has verified — is kept until you ask us to delete it.
You agree once, in the extension, when you first sign in. We ask again only if this policy changes.
No advertising and no analytics trackers. We do not sell or share your information.
You can ask for a copy of your records, or for them to be deleted. See Your rights.

What changed

Until 5 October 2026, Popmelon held parties only in the server's memory and kept no record of them after they ended. From that date we keep the records described below, so that we can fix synchronisation and connection problems, investigate abuse and security problems, recognise the same person or installation across parties, and understand how Popmelon is used. No party records exist from before that date.

On 23 October 2026 we added your watch history (see What we keep): what you watch and listen to in parties, with links to it, how long you watched, waited or were connected with nothing playing, how many reactions and messages you sent during each title, how often your player had to catch up with the party, who you watched with, your browser's language, which browser and operating system you use, the time zone your browser is set to and the country it is in (never worked out from your IP address), how you joined each party, how long you were in the party's call and on camera, when you copied a party's link, and your thumbs up or down for what you watched. If you choose to, you can also give your age group and gender, with a separate agreement. We use all this to recommend what to watch, to suggest public parties, and to understand how Popmelon is used and growing. We work it out on our server from what the relay receives, and keep it only for people who agreed to this version of the policy. We also count installs and removals of Popmelon, and the reasons people give, without knowing who they are, and look up what public film and music catalogues say about the titles parties play, without sending them anything about you.

Who we are

Popmelon is run by GRADIENTFLOW AI PTE. LTD. (“Gradientflow”, “we”), a company registered in Singapore. We decide what Popmelon collects and why, so we are responsible for it under data protection law. You can reach us, and our Data Protection Officer, our founder, at prudhvi.daruvuri@gmail.com.

Watch together

In Watch together mode, Popmelon does not stream, relay, record, cache or proxy the movie. Everyone in a party is playing their own copy from their own account. What we synchronise is a position in time — the same information as someone saying “go to 41 minutes” out loud. We do keep a record of which video or song a party played; see What we keep.

Screen Share in the party room opens your browser's picker. Only the host can approve a tab, window or whole screen to send to party participants; audio is included only when supported and selected. Sharing an entire screen can expose other windows and notifications, so choose the narrowest source you need. The toolbar's separate Share this tab + audio action broadcasts only one tab (including subsequent navigation). Neither path captures your microphone or camera. Use Stop sharing to end capture. Sharing is not silently restarted after an extension restart, and protected content may not be capturable.

The browser asks you to choose a source every time you use Screen Share. The toolbar's optional tab-capture permission is requested only for that shortcut. Declining either does not disable synchronized playback or chat. Revoking tab-capture permission stops an active toolbar tab broadcast.

What is shared is forwarded live and never recorded or stored. We keep a record that sharing started and stopped, and the IP addresses of the people who connected to send or watch it, but nothing that was shown or heard.

What passes through the relay

While you are in a party, our relay handles:

the party code, your display name, and the colour assigned to you; when signed in, your Google-hosted profile photo is shown to people in your party room
host requests and approvals, so only the current host can pass control to another member
playback position, whether you are paused, which video or song the room is on, its title, who made it (a channel or artists), and how long it is
chat messages and reactions you send
clock-synchronisation pings, with the round-trip time and clock difference your extension measured, and how often your player had to jump to catch up with the party
your extension version, your install ID (see What your browser stores), the language and time zone your browser is set to, and how you joined (an invitation, a party link, the toolbar, the party room or a streaming page)
your browser's user-agent, as every web connection sends it, from which we keep only the kind of browser, its main version number and your operating system; for Brave, Edge and Opera, which describe themselves as Chrome there, the extension says which browser it is
whether you are in the party's call and have your camera on, that you copied the party's link, and from where, and your thumbs up or down for what the party plays
the IP address your connection comes from

The live party lives in the server's memory. A room is discarded a minute after the last person leaves, and the live party is gone if the process restarts. Separately, the relay saves the records described in the next section. Saved chat is never shown back to you or anyone else in Popmelon: when you join a party you see only messages sent while you are there.

What we keep, and why

Parties. The party code; when the party started and ended, and why it ended; which service it used (YouTube, Netflix, Spotify, Prime Video, Twitch or another service Popmelon works with) or a shared screen; the most people in it at once; which earlier party it continued after a server restart; and a fingerprint of the host's private key (see Security). Why: to run and troubleshoot Popmelon and to count how it is used. Kept 12 months after the party ended.
Who was in a party. Each time you join: the display name you used, whether you were host or guest, when you joined and left and why (you left, you disconnected, or the party ended), your extension version, how many times your player stopped to buffer, links to your account and your install record, and a fingerprint of the sign-in session you joined with. If you rename yourself in a party, the old and new names. Why: to troubleshoot parties and to know who took part when we investigate a problem or a report of abuse. Kept 12 months after the party ended.
Chat messages. The text of each message, when it was sent, and which party member sent it. Why: to investigate reports of abuse and security problems. The relay that saves chat cannot read it back, and we read saved chat only as described in Who can see it. Kept 30 days.
What was played. For each video or song a party plays: the service, its ID on that service and its link there, its title as shown on the page, who made it (a song's artists, a video's channel), whether it is a film, an episode of a series (with the series and its season and episode numbers), a video or a song, how long it is and how far into it the party got, which member started it, and when it started and stopped. Why: to troubleshoot synchronisation on particular services and titles, and for the watch history below. Kept 30 days, or 12 months while it is in someone's watch history. We never use it for advertising and never sell it.
Your watch history and watch time. What you watched or listened to in parties, linked to your account (or, if you never signed in, to your install record): each film, episode, video or song, with what we record about it above, how long you watched it, when, in how many parties, whether you chose it as host, how many reactions and chat messages you sent while it played (the number, not the words), how often your player had to jump to catch up with the party, your thumbs up or down for it if you gave one, and who else in the party watched it with you. And each time you join a party: the language your browser is set to; the time zone it is set to and the country that time zone is in (we never work out where you are from your IP address); the kind of browser (such as Chrome, Brave or Edge), its main version number and your operating system, never the full user-agent; how you joined (an invitation, a party link, the toolbar, the party room page, a streaming page, or reconnecting); how long something played for you, how long it was paused, loading or buffering, how long your player showed ads, and how long you were connected with nothing playing for you, such as before anything was chosen or after you closed the watch tab, in total and for each service; and how long you were in the party's call and how long your camera was on. We work this out on our server from what your extension sends the relay: the host's playback, your ads and buffering, your reactions and chat messages, the clock-synchronisation pings from your watch tab, and whether you are in the call. Why: to recommend what you might like to watch, in your language, to suggest public parties around what people and their friends watch, to find where synchronisation needs work, and to understand how Popmelon is used and growing. Recommendations are made automatically from watch histories; people at Popmelon look at a particular person's history only as described in Who can see it. Kept 12 months after the party ended, or until you ask us to delete it.
Your age group and gender, only if you give them. In the party room's “About you”, while signed in, you can choose an age group (from 13–17 up) and a gender, and agree, separately from this policy, to their use for your suggestions. We keep them with your account, with a record of that agreement, and use them to suggest what people like you enjoy and, in totals of at least ten people, to understand who uses Popmelon. Nobody else in a party sees them. Removing them there deletes them and their earlier values at once, and records that you took the agreement back. Kept until you remove them or delete your account.
Public details of titles. For a film, series, song or video a party played: its genres, year, cast or artists (or a video's channel), original language and length, from public catalogues: TMDB for films and series, Spotify for songs and YouTube for videos. We send them only the title's name (films and series) or its id on that service (songs and videos), never anything about who watched it. Why: to recommend what to watch. Kept while some record of the title is; YouTube's details for at most 30 days, as its terms require.
Activity log. A timestamped list of what happened in each party: the party starting, resuming after a server restart and ending, and why it ended; joining, with your role and extension version, and leaving, with the reason; that you renamed yourself, but not the names; host requests and changes; play, pause, seek and waiting, with the playback position; switching to a different video or song, with the service but not which video or song; reactions, as the emoji sent; that a chat message was sent and how long it was, but not its text; screen sharing starting and stopping; a watch tab closing; copying the party's link, and from where; someone joining the party's call, and whether their camera was allowed, without saying who; accounts being created and signing in; joins refused because an extension was out of date, with its version; and, with nothing about who, Popmelon being installed or removed, with the extension version, and the reason picked on the goodbye page (see What your browser stores). Entries point to the party and membership records instead of repeating names. Why: to troubleshoot, to keep Popmelon secure, and to understand how it is used and growing. Kept 12 months.
Playback and connection samples. Every few seconds while you are in a party: your connection's round-trip time and clock difference to our server and, while you are the host, the playback position and whether it is paused. Why: to measure and improve how closely parties stay in sync. Kept 30 days.
IP addresses. The IP address a request came from when you sign in, join a party, or ask for a voice, video or screen-sharing connection, with which of those it was. Why: security and investigating abuse. We do not use it to work out where you are. Kept 30 days.
Install records. Your extension creates a random install ID on your computer. We store only a one-way code derived from it, which cannot be turned back into the ID, together with your extension version, when the install was first and last seen, and the account it signed in to, if any. Why: to recognise the same installation across parties, to find your records when you ask for them, and to show relevant update reminders. Kept 12 months after the install was last seen; an install you signed in on is kept with your account until the account is deleted.
Accounts. Everyone who starts or joins a party signs in with Google, so everyone in a party has one. A salted one-way hash of your Google account ID; an account ID and a voice-chat identity derived from that hash; your Google display name, the address of your Google profile photo and the email address Google has verified (see Signing in with Google); when you first signed in and when you were last seen; and a history of your previous names and photo addresses. Why: to let only signed-in people into parties, to show your verified name and photo to your party and to recognise you across parties. Kept until you ask us to delete your account.
Sign-in sessions. For each session we issue: a fingerprint of the session token, never the token itself, with when it was issued and when it expires. Why: to investigate misuse of a session and to cancel sessions, for example when an account is deleted. Sessions last 7 days; each fingerprint is kept until 30 days after its session expires.
Your agreement. Which version of this policy you agreed to, when, and whether you agreed when signing in or, after this policy changed, when starting or joining a party, kept with your account. Why: to know that you agreed, and to which version. Kept as long as your account.

How long we keep it

30 days: chat messages; what was played, unless it is in someone's watch history; IP addresses; playback and connection samples.
12 months: the activity log; party records and who was in each party, including the names used, and each member's watch history and watch time, counted from when the party ended; install records not linked to an account, counted from when the install was last seen.
Until you ask us to delete your account: your account, its name and photo history, the record that you agreed to this policy, the install records of installs you signed in on, and the age group and gender you chose to give, until you remove them.
30 days after a session expires: sign-in session fingerprints. Sessions last 7 days.
7 days: encrypted nightly backups of the database.
Roughly the last 40 MB: our web server's access logs (see Server logs).

Each period counts from when the record was made, unless it says otherwise, and deletion runs automatically every few hours, so a record can outlast its period by those few hours. Chat messages, IP addresses and samples are deleted a whole day at a time, so they can be up to 31 days old when they go; the activity log is deleted a whole month at a time, so its oldest entries can be up to 13 months old. Something deleted from the database can remain in a backup for up to 7 more days; we restore backups only to recover from a failure.

Why we are allowed to

Where the EU or UK General Data Protection Regulation applies, we rely on:

Providing the service you asked for (contract), to run the parties you start or join: relaying playback, chat, names and photos, and keeping your account and sessions, which parties require.
Our legitimate interests in keeping Popmelon working, secure and free of abuse, in understanding how it is used, and in recommending what to watch and suggesting public parties, for the records we keep beyond the live party: chat messages, what was played, watch history and watch time, the activity log, party and membership records, playback and connection samples, IP addresses and install records. These records are limited to what is listed here, deleted on the schedule above, never used for advertising and never sold, and you can object to them.
Your consent, separately from this policy, for the age group and gender you choose to give; you can take it back in the party room at any time.
Legal obligations, when the law requires us to keep or disclose something.

In Singapore, we collect, use and disclose personal data with your consent, which you give when you press “Agree and sign in with Google”, “Agree and sign in to start” or “Agree and sign in to join” in the extension (after a change to this policy, “Agree and start party” or “Agree and join party”), or where the Personal Data Protection Act otherwise permits it. You can withdraw consent by contacting us. Because records are kept for every party, Popmelon cannot run parties for you after you withdraw it.

Voice and video chat

Voice and camera, when you turn them on, travel through a media server that forwards live streams between participants. The access token your browser is issued explicitly denies recording permission, and no recording is configured. Streams are forwarded and discarded; the audio and video are never written down. We keep the IP address that asked to join voice (see What we keep), never what was said or shown.

Voice starts muted every time, and the camera starts off. Neither turns on without you pressing the button.

Signing in with Google

You sign in with Google to start or join a party; nobody takes part without signing in. Popmelon asks you to sign in on the Start or Join button itself.

When you sign in:

Signing in is also how you agree to our Terms and consent to the records this policy describes, if you have not already done so in that browser: the button says “Agree and sign in with Google”, “Agree and sign in to start” or “Agree and sign in to join”. You are not asked again when you start or join a party, unless this policy changes.
We ask Google only who you are. We do not request access to your Gmail, Drive, Contacts, Calendar or any other Google service, and we receive no token that could be used to act on your behalf. There is no refresh token anywhere in the design.
Google returns a signed identity token containing your Google account ID, name, profile photo address and email address. We check its signature, that it was issued for Popmelon, and that it is less than five minutes old — then we discard it. We keep your name, photo address and, if Google has verified it and you agreed to this policy when signing in, your email address with your account. We use the email address only to identify your account when you contact us, to answer requests about your data, and for service and security notices about your account; never for marketing, and it is never shown to other people in a party. An email address Google has not verified is not kept.
We issue you our own session token, which contains your display name, your Google profile picture URL, an opaque identifier and an account ID. The token itself is held in your browser; we keep only its fingerprint. When joining a party, your extension sends this token only to its issuing relay. We verify it to show your name and Google-hosted photo to your party. The token is never shared with other participants. Photos load directly from Google without a referrer; an unavailable photo shows initials instead.
That identifier is a one-way salted hash of your Google account ID. We never store the Google account ID itself, and the identifier cannot be reversed back to it or matched against your account on any other service.

Signing out deletes the session from your browser; you sign in again to start or join another party. Your account stays on our server until you ask us to delete it; see Your rights.

What your browser stores

Locally, on your machine, and readable only by the extension:

your display name and the relay address, so you do not retype them
your session token, while you are signed in
a random install ID, created the first time it is needed and removed when you uninstall Popmelon
which version of this policy you agreed to, so you are asked only once
your active party, private host-resume key and selected tab ID in extension session storage
a recent in-memory chat history for the open party room, discarded when you leave
published/downloaded extension version numbers and update-check timestamps, so checks can be throttled and updates do not interrupt a party
from 0.8.6, how long you have watched in parties on this browser, and when it last asked you to rate Popmelon or a title (and which title), so it asks at most once every 5 hours of watching and never again once you have rated Popmelon; in builds from 0.8.0 before that, whether the one-time request to rate Popmelon was due, shown or answered, with when; none of this leaves your browser

If you choose to install Popmelon from a party invitation, the invitation page saves that party’s code in your browser’s storage for popmelon.app for up to two hours, so you can be taken back to the party once the extension is added. Nothing is sent, and the code is removed once you join.

From version 0.8.0, installing Popmelon opens a welcome page on popmelon.app, and removing it opens a short goodbye page there, where saying why is optional. Both addresses carry only the extension version: no install ID, no account, nothing else. When one of these pages opens, and when you pick a reason, our server adds one to a count of installs, removals or that reason, with the extension version, and keeps nothing about who or which browser it came from. To count a reload only once, it remembers a one-way fingerprint of your IP address, in memory only, for ten minutes.

No advertising or analytics cookies. No tracking pixels. No third-party analytics.

The extension sends its version and install ID when signing in, joining a party or starting voice, so we can show a relevant update reminder and recognise the installation, and, when joining a party, the language your browser is set to, for recommendations in your language, which browser it is and how you joined. Release metadata checks use the relay's health endpoint without sending watch history, chat, credentials or captured media. The browser checks and downloads extension packages through the Chrome Web Store.

Server logs

Our web server also keeps ordinary access logs for this site and the relay: IP address, timestamp, which URL was requested, and standard request details such as your browser type, as every web server does, to run the service and investigate abuse. Logs roll automatically and old ones are deleted; we keep roughly the last 40 MB and no more. They contain no chat content, no playback data and no audio.

If you pick a reason on the page that opens after you remove Popmelon, the reason is part of that page’s address, so it reaches these logs like any other visit. We only ever count how often each reason comes up, as described in What your browser stores; we never look at who picked which.

Who can see it

People in your party see your name, your Google profile photo, your chat messages and your reactions while the party is open. They cannot see anything we have saved.
Our administrators. Only Gradientflow staff who administer the Popmelon server can read the database. Today that is one person, our founder.
Separate logins for separate jobs. The relay's own database login can add chat messages and IP addresses but cannot read them back, and reads session fingerprints only to honour cancelled sessions. Internal reporting logins can read party, membership, install, account, play, activity and sample records, including names, photo addresses and titles, but not chat text, IP addresses or sign-in sessions. The separate login we use to answer access and deletion requests can read saved chat.
Looking at saved records. We look at the saved records of a particular party or person, including saved chat, only to investigate a report of abuse or a security problem, when you ask us to (for example, to look into a problem you reported), or when the law requires it. Otherwise we use the records only in aggregate, such as counting parties, adding up watch time across many people, or measuring how closely parties stay in sync, and automatically, to make recommendations from watch histories. A title appears in our totals only once several people have watched it.
Legal requests. We disclose records to authorities only when the law requires it.
If Popmelon changes hands. If Popmelon is sold or merged, we will ask for your consent before your information is transferred.

Who else is involved

Google — only to confirm who you are when you sign in, which starting or joining a party requires. Google-hosted profile photos load directly from Google. The Chrome Web Store, also run by Google, delivers the extension and its updates.
Our hosting provider — Hostinger runs the server, in Malaysia, that the relay, the database, the voice and video media server and this site run on. It stores everything above on our behalf.
Cloudflare — keeps a copy of each encrypted nightly backup, so the database can be recovered if our server is lost. Backups are encrypted on our server before they are copied, Cloudflare cannot read them, and we hold the only key. Both copies are deleted after 7 days.
TMDB, Spotify and YouTube — public catalogues our server asks about the titles parties play (see What we keep). They receive a title's name or id from our server, never anything about you.

The voice and video media server is LiveKit, open-source software we run ourselves on our own server; no LiveKit company receives your audio, video or details. Our database also runs on our own server; no database company hosts it or receives any of it.

We plan to offer paid features. When we do, payments will be handled by a payment provider on its own checkout page, and we will update this policy before then. Today Popmelon collects no payment information.

Netflix, YouTube, Spotify, Prime Video, Twitch and the other services Popmelon works with are not partners of ours. Playback happens through their own players and your own accounts. Spotify parties share the current song ID and playback position with party members through our relay, not the music itself. Popmelon does not read your Spotify password, cookies or access tokens.

Security

Connections between the extension and our server are encrypted (HTTPS and secure WebSockets).
The database runs in its own container on our server and cannot be reached from the internet.
Sign-in session tokens and host keys are stored only as SHA-256 fingerprints. A fingerprint can recognise a token, but cannot be used to sign in as you or take over your party.
Your Google account ID is never stored, only a salted one-way hash of it. Your install ID is stored only as a one-way derived code.
Each part of the system has its own database login with only the access it needs, as described in Who can see it.
Backups are encrypted on our server before they are copied off it, and the key that decrypts them is not stored with them.
Voice and video access tokens deny recording permission.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

Where your information is processed

Popmelon is run from Singapore, and our server is in Malaysia. Wherever you use Popmelon from, including the European Economic Area, the United Kingdom and the United States, your information is sent to and stored in Malaysia, and administered from Singapore. Encrypted copies of our nightly backups are also kept by Cloudflare, which may store them in other countries; they cannot be read without our key. These countries may not have data protection laws equivalent to yours. Our hosting provider and Cloudflare process it for us under their data processing terms.

What we do not collect, and what we do not do

We never collect:

an email address other than the one Google has verified for the account you sign in with
payment card numbers or bank details
the content of a shared tab, window or screen, or any recording of it
recordings of voice or video calls
anything from your microphone or camera while they are off
your browsing outside the video or song a party is playing
your Google, Netflix, YouTube, Spotify, Prime Video, Twitch or other streaming service passwords, cookies or tokens
your precise location

And we do not:

sell or share your information, including for cross-context behavioural advertising
use your chat or what you watch for advertising
read saved chat except as described in Who can see it
record voice or video
track you across websites

Your rights

Wherever you live, you can ask us to:

see and copy what we hold about you, in a common machine-readable format
correct it — you can also rename yourself in any party, and your account name and photo update from Google the next time you sign in
delete it
object to or restrict how we use it, including the records we keep for our legitimate interests; for example, to stop recommendations made from your watch history, and delete that history
withdraw consent, where we rely on it

Email prudhvi.daruvuri@gmail.com from any address and include the ID that lets us find your records:

Your account: your Popmelon account ID, shown in the Popmelon toolbar popup under Your data, or write from the email address of your Google account and we will find your account by it.
Your browser: your install ID, shown in the same place, for records tied to that browser rather than to your account. It is random and exists only in your browser, which is how we know the records are yours. Keep it private, and copy it before you uninstall Popmelon: uninstalling deletes it, and without it we cannot find those records.
If your extension never sent an install ID (older versions sent it only when you joined voice), tell us the name you used, roughly when and, once that party has ended, its link. We will do what we can and explain if we cannot find or verify the records.

When you ask us to delete your records, we cancel and delete your sign-in sessions and delete your account, your install records, your chat messages, your playback and connection samples, the IP addresses linked to you, and your name history, and we replace your name in past party records with “Deleted user”. The de-identified party, activity and what-was-played records that remain are deleted on the normal schedule. For 8 days we keep a note that sessions issued to a deleted account are void, so an old sign-in cannot bring it back. Backup copies are gone within 7 days. When you ask for a copy, we send your own records and your own chat messages, not other people's messages, together with what was played in the parties you were in.

We do not charge for requests. We reply within one month, and tell you if we need longer where the law allows. If you are not satisfied with our answer, reply to ask us to reconsider it; in the United States this is your appeal. You can also complain to a data protection authority: the Personal Data Protection Commission in Singapore, your local supervisory authority in the European Economic Area, or the Information Commissioner's Office in the United Kingdom.

If you live in the United States

Since 5 October 2026 we have collected these categories of personal information, from you, your extension and Google (when you sign in): identifiers (display names, account and install IDs, IP addresses, and profile photo addresses); internet or other electronic network activity (the activity log, what was played, and playback and connection samples); and sensitive personal information, namely the contents of chat messages. We use them only for the purposes on this page, keep them for the periods above, and disclose them only to the providers in Who else is involved. We do not sell or share personal information, and we use sensitive personal information only to provide Popmelon and keep it secure. You have the rights described above, you may use an authorised agent, and we will not treat you differently for using them.

Children

Popmelon is not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child under 13 has used Popmelon, contact us with their install ID or account ID, and we will delete their records.

Chrome Web Store and Google data

Popmelon's use of information received through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements: we use it only to provide and improve watch and listen parties, we transfer it only as described on this page, we never use it for advertising or to decide creditworthiness, and people read it only as described in Who can see it. Popmelon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

If we change what we keep, why, or for how long, we update this page, its version and the date at the top, and the extension asks you to agree again, on the button you press to start or join your next party or to sign in, before the change applies to you.

Contact

Questions about any of this, or requests about your information: prudhvi.daruvuri@gmail.com.