Privacy

Who runs this site

This site is run by Max Song, an individual, not a company. I decide how the data described on this page is used. For any privacy question or request, email [email protected].

The short version

• There are no accounts, comments, ads or sales on this site.
• I don’t run any analytics, fingerprinting or error-tracking scripts.
• I don’t sell or share your personal information, and nothing here follows you across other websites.
• Cloudflare handles every request to the site, for delivery and security. Most of the data described below passes through it.
• Your browser keeps one cookie from this site, a few security cookies from Cloudflare, and some player settings that never leave your device.

Cloudflare

Every request to maxsong.me goes through Cloudflare, Inc., a US company that provides the site’s content delivery, firewall, bot protection and the secure tunnel to my server. To do that, Cloudflare processes your IP address, your browser and device details (the user agent), the address you ask for, the page that linked you here and your approximate location. Cloudflare runs a global network, so a request may be handled in a data center outside your country. It handles this data for me as a service provider and under its own privacy policy.

Cloudflare’s dashboard shows me traffic totals, such as the number of requests and the countries they come from, and for a limited time set by Cloudflare, samples of individual requests and security events, which include IP addresses.

Its bot protection runs a script on each page that checks your browser for signs of automation and reports interaction signals, such as clicks, key presses, pointer movement and whether the tab is visible, to tell people from bots. It keeps the result in the cf_clearance cookie listed below. This is used for security only.

Cloudflare also hides the email addresses on these pages from scrapers; a small script in your browser decodes them for display.

If a page fails to load, your browser may send a short error report (the address, the referring page, the type of error and how long it took) to Cloudflare’s network error logging service at a.nel.cloudflare.com. Reports are sent only for failures, and Cloudflare says it doesn’t store your IP address with them.

My server

Behind Cloudflare, the site is served from a small server I run in the United States. The web server only accepts connections through Cloudflare’s tunnel, and it doesn’t keep a log of visits. Its error log can include your IP address and browser details when a request fails; that log is rotated by size, and old entries are deleted after 90 days at most.

Music and the media pass

The audio, track list and analysis data behind the Sound page are protected from hotlinking by a small program that runs on Cloudflare’s network (a Cloudflare Worker). When a page loads, your browser asks it for a short-lived media pass, stored in the msw_ms cookie. The pass holds only an expiry time and a signature, so it can’t be used to tell visitors apart.

To slow down bulk downloading, the Worker counts audio requests per IP address in its working memory, in one-minute windows. The count is never written to storage, and it is lost whenever Cloudflare restarts the Worker.

Cloudflare may keep logs of requests to this Worker and to the agent sign-in service described below, which can include the address requested and your IP address, for up to 7 days.

Email

The contact form doesn’t send anything itself; it only opens a draft in your own email app. If you email me, the message, along with the name and address you send it from, is stored on a mail server I run myself. I use it only to read and reply, keep it for as long as it’s useful for our conversation, and delete it if you ask.

Agent access

Programs such as AI agents can ask for access to the music library through this site’s OAuth sign-in service, described in auth.md. When a program registers, it sends a name and the addresses to return to, and it may include a contact email. Cloudflare stores that registration for 90 days. Only I can approve a request, by signing in through Cloudflare Access, so only my own browser ever receives Access sign-in cookies. Access tokens are stored only as hashes and expire after an hour, refresh tokens after 30 days, and expired records are deleted daily.

Cookies and browser storage

Nothing below is used for advertising, analytics or following you across other sites, so this site doesn’t ask for cookie consent. Cloudflare decides the names and lifetimes of its own cookies, and they may change; it describes them on its cookie page.

• msw_msCookie · set by this site

  Purpose

  A short-lived media pass that lets your browser stream the site’s audio and stops other sites from hotlinking it. It holds only an expiry time and a signature, with nothing that identifies you.

  Lasts

  24 hours, renewed as you browse

• cf_clearanceCookie · set by Cloudflare

  Purpose

  Shows that your browser passed Cloudflare’s bot check, so you aren’t checked again on every page. It is sent to every maxsong.me address.

  Lasts

  Up to 1 year

• __cf_obCookie · set by Cloudflare

  Purpose

  Interaction signals collected by the bot check. It is only sent to Cloudflare’s check endpoint.

  Lasts

  Until you close your browser

• __cf_bmCookie · set by Cloudflare

  Purpose

  May be set by Cloudflare’s bot protection to tell people from bots.

  Lasts

  30 minutes without activity

• _cfPre_tabIdSession storage · set by Cloudflare

  Purpose

  A random ID for the current tab, sent along with the bot check’s signals.

  Lasts

  Until you close the tab

• msw.player.v1Local storage · set by this site

  Purpose

  Player settings: volume, mute, loop, the last track and where you stopped. Saved automatically as you browse, even if you haven’t used the player.

  Lasts

  Until you clear it

• msw.bgm.v1Local storage · set by this site

  Purpose

  Your answer to the background-music invitation and when you gave it, so you’re only asked once.

  Lasts

  Until you clear it

• sound-viewLocal storage · set by this site

  Purpose

  The layout you last used on the Sound page. Saved when that page opens.

  Lasts

  Until you clear it

• msw.dj.presets.v1Local storage · set by this site

  Purpose

  Effect presets you save in the DJ controls.

  Lasts

  Until you clear it

• msw.dj.transport.v1Local storage · set by this site

  Purpose

  The tempo, beat grid and cue points for each track you open in the DJ controls, including a beat grid the site detects on its own.

  Lasts

  Until you clear it

The local storage entries stay in your browser; this site never uploads them. You can remove everything listed here by clearing this site’s data in your browser settings. If you block cookies, music may not play and Cloudflare may ask you to complete a check.

Your requests

You can ask me what personal data I have about you, or ask me to correct or delete it, by emailing [email protected]. I’ll reply within 30 days. I can delete emails you’ve sent me and any agent registration you point me to. I can’t pick out and delete one visitor’s entries from Cloudflare’s logs or my server’s error log, but those expire on their own as described above.

Do Not Track and Global Privacy Control

This site doesn’t track visitors across other websites and doesn’t let other companies do that through it, so it treats every browser the same, whether or not it sends a Do Not Track or Global Privacy Control signal.

Children

This site is for a general audience and isn’t aimed at children under 13. I don’t knowingly collect personal information from children under 13; if you believe a child has sent me some, email [email protected] and I’ll delete it.

Security

Visitors can reach the site only over HTTPS, through Cloudflare, and pages are sent with strict security headers. The web server itself accepts connections only from Cloudflare’s tunnel on the same machine. No system is perfectly secure, so I can’t promise that nothing will ever go wrong.

Changes to this policy

When this policy changes, I’ll update the dates at the top of this page and list the change here.

• October 16, 2026: First version.