Privacy
Last updated 17 September 2026.
Short version: Kuthu runs on your own computer and we do not receive your data. There is no Kuthu account, no login, no telemetry and no server of ours between you and the music. Your library, your party and your guests' requests never leave your machine. The exceptions are all on this website rather than in the app — chiefly that registering for the download means telling us a name and an email address — and they are listed below.
Who we are
Kuthu is operated by [LEGAL ENTITY NAME], [TRADING ADDRESS]. For any question about this policy or your data, write to [CONTACT EMAIL].
The app
The Kuthu application stores everything on the computer it runs on, in a
data folder next to the program. None of it is transmitted to us,
because there is nowhere for it to be transmitted to.
| What | Where it lives | Leaves your machine? |
|---|---|---|
| Your song collection and tuning | data/library.json |
No |
| Tonight's running order | data/setlist.json |
No |
| Guest names and their requests | data/party.json |
No |
| Your YouTube API key | data/config.json |
Only to Google, when the app searches |
| Counts of parties and songs played | data/stats.json |
No — and it records no song titles |
Guests at your party
When a guest scans the QR code they type a display name. That name, their
requests and their votes are held on your computer for the duration of
the party so their picks can be shown on the screen. There is no account, no
email address, no phone number and no tracking. Deleting
data/party.json removes it. As the person running the party you
are the one in control of that information, not us.
What the app talks to
- YouTube and Google — to search for videos and to play them. Their handling of that is governed by Google's privacy policy, not ours, and playing a video from Kuthu is the same as playing it in a browser.
- Nothing else. The app makes no other network calls.
This website
- No cookies are set. Nothing is stored in your browser by this site — no cookies, no local storage, no identifier of any kind. There is no cookie banner because there is nothing to ask you about.
- We use Cloudflare Web Analytics, which counts page views
and page-load speed. It is cookieless: it creates no visitor ID, no session
ID and no browser fingerprint, and it cannot follow you to any other site.
It reports the page you looked at, where you arrived from, your browser
type, how fast the page loaded, and a country worked out from your IP
address — the address itself is not stored. To do this your browser
fetches a small script from
static.cloudflareinsights.com, which is a Cloudflare address. - No other company sees your visit. Cloudflare hosts this site, so they already handle every request to it; the analytics tell them nothing they would not see anyway. There are no third-party fonts, no advertising networks, no trackers and no other CDNs — everything else the site needs is served from this domain.
- Server logs. Our hosting provider, Cloudflare, keeps short-lived request logs including IP addresses, for security and to keep the site running. That is a legitimate interest under GDPR Article 6(1)(f).
- If you register for the download, we keep your name and email address, the date you registered, and the country Cloudflare works out from your connection. We send one six-digit code to check the address is real, and later we will email you when there is a build. That is all we use it for. It is never sold, never shared, and every message carries an unsubscribe link.
- We record each download — which build, and when. This is so we know who has our software, which matters for telling you about a security fix.
- We do not store your IP address anywhere in that record. Stopping abuse means recognising a repeat visitor, not being able to name one, so what is stored is a one-way hash keyed with a secret only our server holds. It cannot be turned back into an address.
- How long. Registrations are kept while you want to hear from us. Download records are kept for two years, which is long enough to reach affected people about a problem with a build. The one-time codes are destroyed the moment they are used or five minutes after they are sent, whichever comes first.
- Getting it deleted. Email us and we remove your name, email and download history. We do not ask why, and there is nothing to unsubscribe from afterwards because there is nothing left.
- The legal basis, if you need the GDPR wording: consent for the release emails (Article 6(1)(a)), which you withdraw by asking us to stop; legitimate interests for the download records and the abuse hashing (Article 6(1)(f)), being our interest in knowing who has our software and in the service not being abused.
- If you buy a licence, the payment is handled by our reseller [MERCHANT OF RECORD], who receives your payment and billing details directly. We see your email address and what you bought. We never see your card number.
Your rights
If you are in the UK, the EU, or another region with comparable law, you have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to our processing it, and to receive a copy. Write to [CONTACT EMAIL] and we will answer within 30 days.
In practice the answer is usually short, because the only personal data we are likely to hold is an email address you gave us and a purchase record. Nothing from inside the app ever reaches us.
You also have the right to complain to your data protection authority — in the UK the Information Commissioner's Office, and in the EU your national supervisory authority.
Children
Kuthu is not directed at children and we do not knowingly collect data from anyone under 16. A child who scans a guest QR code at a family party types a name into a page on the host's own computer; that never reaches us.
Changes
If this policy changes materially we will update the date at the top and note the change on this page. We will not quietly start collecting something this page says we do not.