Terms of use
and privacy.
Learn what happens to your data when you use mitune and what rights you have.
Last updated: November 5, 202601 / Terms of use
mitune lets you play music in Micup servers and manage it from a web panel. When using the bot or panel, you must comply with Micup rules, the terms of your content sources and applicable law.
- Only request content you have the right to access and use. Do not use the service for copyright infringement, harassment, spam, unauthorized data collection or bypassing security controls.
- You must have the required server permissions to invite and manage the bot. Music controls depend on current voice channel membership and channel permissions.
- Users in the same channel can affect the shared queue. Helper bots enable independent playback in different channels when they have been added to the server and have the appropriate permissions.
- Source availability, bot capacity and connection issues may affect playback. Uninterrupted service and playback of every link are not guaranteed.
- Use that compromises security or violates the rules may be restricted. These terms do not remove your statutory rights.
02 / Privacy and KVKK
This notice covers data processing by the bot, website and music panel. Data is collected electronically through Micup sign-in and bot connections, your music requests and use of the service.
Processing purposes are explained in the table below. Processing necessary to provide account and music services and account security is assessed under the applicable conditions in Article 5 of the Turkish Personal Data Protection Law (KVKK). Any separate processing requiring explicit consent must be explained and consent obtained before it begins; reading this page alone does not constitute explicit consent.
We do not use it to track users across servers, build advertising profiles or market listening preferences to third parties. Personal music history is linked to your account to show you your history.
03 / What data is processed, and why?
| Data | Scope | Purpose |
|---|---|---|
| Account and profile | Micup user ID, username, display name, avatar, mitune account ID and creation date. | Signing you in, recognizing your account and displaying your profile. |
| Server, member and channel information | IDs, names and icons of servers you can access; member IDs, bot/human distinctions, roles, channel permissions and current voice channel membership in servers with the bot. | Verifying server and channel access, joining the correct channel, selecting a helper bot and calculating listener/member counts. |
| Commands and music requests | Commands or search text sent to the bot and track links; requester, server, text/voice channel and message IDs; command results. | Fulfilling your request, displaying search results, replying to the correct message and preventing duplicate operations. |
| Queue, playlists and history | Track title, artist, source link, artwork and duration; requester ID; playlists, playback time, position, volume and repeat settings. | Managing music, saving playlists, returning to the previous track, recovering sessions and displaying listening history. |
| Session and device security | IP address, browser/device information, session creation and last use times, refresh token hashes and essential cookies. | Secure sign-in, listing your devices, refreshing sessions and preventing unauthorized access. |
| Technical records | Operation time, error type, service and connection status; related operation, server or channel IDs may appear in technical records. | Investigating errors and maintaining security and service operation. |
Message content
The bot processes message events it can access to recognize commands addressed to it. It does not create a chat archive for non-command conversations. Search text, track links and reply routing IDs extracted from commands may appear in operation records; we therefore do not claim that no message data is ever stored.
Member list and voice channel status
Membership, role and channel information is used to verify access, find the requester's voice channel, distinguish bot accounts from listeners and calculate counts correctly. Member information is updated in the bot connection's working memory. Persistent music records may contain requester and channel IDs.
Audio data
The bot downloads and converts the selected music source and broadcasts it to the voice channel. It does not offer a feature to record, transcribe or analyze users' microphone conversations. The source music cache is not a recording of users' conversations.
Sign-in and cookies
We do not receive your Micup password. OAuth access and refresh tokens are encrypted in API Redis to read your profile and update your server list; they are deleted when the device session is revoked. Sign-in and security use the mitune_at, mitune_rt and mitune_csrf cookies. We do not use advertising or cross-server tracking cookies.
Your language preference is saved in the mitune_locale cookie for one year and shared between mitune.net and the music panel.
04 / Retention periods
- Account, profile, server list and personal playlists
- Kept until the account is deleted. Account deletion removes this data and associated device sessions from the database.
- Listening history
- The bot keeps the last 100 records per user; the oldest record is removed when a new one arrives. There is no automatic calendar-based expiry. Deleting your web account does not automatically delete this bot history; you can request its deletion separately.
- Command and event records
- NATS operation/event streams and command results are retained for 24 hours under the current configuration. Not all persistent queue, recovery and bot state records expire automatically; any user IDs remaining in these records are also included in deletion requests.
- Sessions and short-lived caches
- By default, access cookies are valid for 15 minutes and refresh cookies for 30 days; a device session extended by refreshes lasts at most 90 days. These are access validity periods, not a guarantee that expired session rows are automatically deleted. Profiles are cached for 5 minutes and bot statistics for 5 seconds.
- Music cache
- Source music that has not been used for more than 30 days and is not actively in use is deleted by maintenance. This is not the deletion period for personal history or technical logs.
- Technical logs and backups
- Technical logs are not subject to automatic timed deletion; deletion requests for these records can be sent to the contact address below. Backups have no defined fixed automatic deletion period.
05 / Sharing and security
Micup is used for authentication and voice channel connections. Depending on your search or playback request, queries or source links may be sent to YouTube, Spotify, SoundCloud and related content providers. Their own privacy terms also apply.
Hosting, database, cache and object storage infrastructure is used to provide the service. Data is not sold or shared with third parties for advertising; lawful requests from authorized authorities are assessed separately.
Panel access is restricted through session, channel permission and server membership checks. Session refresh tokens are stored as hashes; bot credentials are never sent to the browser. HTTPS and access controls are part of the production setup.
06 / Your rights and deletion requests
Under Article 11 of the KVKK, you may ask whether your data is processed, request information, learn its processing purpose and recipients, correct inaccurate data, request deletion or destruction where the conditions are met, and exercise your other statutory rights.
You can delete your web account, playlists and device sessions in the music panel by clicking your avatar and going to My account → Delete account. For bot history and persistent command/session records, also write to the address below. Removing the bot from a server or signing out of the panel alone does not delete all records.
[email protected]Include your Micup user ID, the data you want deleted and an address where we can reply. We verify ownership of requests to avoid deleting someone else's data; we never ask for passwords or bot tokens. Do not send unnecessary identity documents.
Requests are handled as soon as possible and within 30 days at the latest; acceptance or a reasoned refusal is communicated in writing or electronically. Where deletion conditions are met, the relevant personal data is deleted, destroyed or anonymized. If a record must legally be retained, our reply explains its scope, reason and retention period.
For information about requests and complaints, see the Turkish Personal Data Protection Authority's guidance .
07 / Contact and changes
For privacy and usage questions about mitune, contact [email protected] .
This notice and its last updated date will be revised when the service or its data processing practices change. Significant changes will also be communicated separately.