What Mehfil knows about you

Mehfil makes no money. There is no advertising to target, no analytics product to sell, and no investor expecting either — which is the real reason the list below is short, rather than any promise of virtue.

The site has no database of listening. Your library, your place in a song and everything cached live in your own browser, on your own device.

• Your library

  Saved playlists, your own lists and Mixes are written to your browser’s storage. There is no copy anywhere else unless you sign in — which also means clearing your browser data deletes them.

• Where you stopped

  The song and the exact second, so coming back picks up where you were instead of starting the list again.

• The cache

  Titles, artwork and lyrics for things you have already played, so a second listen is instant and works on a weak connection.

• Your settings

  Text size, whether you have seen the tour, the quality you chose. Small things, kept locally.

• Third-party services, for the music

  Mehfil hosts no music. Audio and video are played from third-party music and video services, and the video player is theirs, in its privacy-enhanced form where one exists. Those services still receive the request, your IP address and which song. There is no way to play their media without them knowing.

• Artwork and audio, straight from the source

  Cover art — and for some songs the audio itself — loads directly from the services behind the music — Spotify, Apple, Gaana, Deezer and the audio and video providers. Those requests come from your browser, so those companies see your IP address and what you loaded.

• Our server, for the boring parts

  Reading a playlist, finding a song by name and fetching lyrics all go through Mehfil first — so the services behind them see our server, not you. Our host keeps ordinary web-server logs, as every host does. Mehfil adds no logging of its own, and the per-IP rate limit is a counter held in memory that is never written down.

• Google Analytics, for events

  Counts and category names — that a playlist of 42 songs loaded, that an import from Spotify happened, that a player error had code 150. Never a song title, a search, or a link you pasted. Google’s own automatic events add device type, browser and country, plus an identifier stored in your browser.

The distinction worth understanding: the things Mehfil routes through its own server hide you from the service behind them, and the things your browser loads directly do not. Playing music from a third-party service means that service sees you. No player can honestly claim otherwise.

• Who you are

  Signing in with Google gives Mehfil your email address, your name and your profile picture. Signing up with an email gives it the address. Firebase handles the password and Mehfil never sees it.

• What syncs

  Your saved playlists, your listening totals, a name for each device you use, and your text-size setting. That is the whole list, and it is what makes your library appear on your other phone.

• Feedback you send

  The message, the rating, and your name and email if you are signed in — so a reply is possible. Sent deliberately, never in the background.

• A jam room

  While a room is open it holds the code, who is in it, and what is playing, so every phone can stay on the same second. It is deleted when the room closes.

Signing in is optional, and everything except syncing between devices works without it. Signed out, Mehfil has no idea who you are.

It does not sell anything about you, show advertising, share anything with data brokers, or follow you across other websites. There is no advertising SDK, no third-party tracker beyond the Google tools described above, and no fingerprinting.

It also does not read your Spotify, Apple Music or any other account. Mehfil has no permission on any of them and never asks you to sign in to one — it reads the public playlist you paste, and nothing else.

Everything above is a description of how Mehfil is built, written by the person who built it. No outside party has verified it. A privacy page is a promise, and you have no particular reason to take a stranger’s promise at face value — so here is how to check it yourself instead.

Watch what actually leaves. Open your browser’s developer tools, go to the Network tab, and use Mehfil normally. Every request it makes is listed there. That is a real audit, it takes two minutes, and it does not require trusting this page at all.

What you cannot do is read the code. Mehfil’s source is not public, so you cannot check any of this by reading it. Saying otherwise would ask for exactly the trust this section is trying not to need. The network tab is the stronger check in any case: it shows what actually leaves your device, which is what matters, rather than what some code claims it does.

If you check and find something on this page that is wrong, write to vermasaiyam9@gmail.com. A correction goes up rather than an argument.

Mehfil is run by Saiyam Verma, an individual in Meerut, India — not a company. Anything on this page, including a request to see or delete what is held about you, goes to that same address and is answered by a person.

1. 1

   Everything on this device

   Your browser’s "clear site data" for mehfilmusic.vercel.app removes the library, the caches and the resume point in one go. Nothing survives it locally.

2. 2

   Stop syncing

   Sign out. Nothing further is written to your account, and what is already on the device stays playable.

3. 3

   Delete the account itself

   There is no button for this yet — an honest gap rather than a hidden one. Email vermasaiyam9@gmail.com from the address you signed up with and it will be deleted by hand, along with everything stored under it.

The same, with two additions. Downloads are saved to the app’s own private storage on your phone, where no other app can read them and uninstalling removes them along with everything else.

And when the build has crash reporting switched on, a crash sends the error and where in the code it happened — with user identifiers explicitly turned off and performance tracing set to zero, so it carries no account, no song and no browsing.

The permissions it asks for are all about playing music: internet; a foreground service, so playback survives you leaving the app; notifications, which is what puts the controls on your lock screen; a wake lock while something is playing; and permission to install its own updates. It never asks for contacts, location, the microphone, the camera or your files.