Jammify is approaching 7,000 active users. With a growing user base, protecting personal data is our top priority. This is how we secure our platform.
We only collect what is strictly necessary: Name, Email, and Password. We strongly encourage OAuth (Google/GitHub) for Zero-Knowledge authentication. Manual passwords are mathematically encrypted via bcrypt (12 rounds) before storage. OTP and reset tokens strictly expire in 1 hour.
{
_id: ObjectId('69c693623064aee19e9cb951'),
name: 'johndoe',
email: 'johndoe@example.com',
password: '$2b$12$a1B2c3D4e5F6g7H8i9J0k.QwErTyUiOpAsDfGhJkLzXcVbNm12345',
isVerified: true,
role: 'user',
lastActive: ISODate('2026-09-07T14:44:57.954Z'),
createdAt: ISODate('2026-09-01T10:15:38.479Z')
}{
_id: ObjectId('6936881e04340f410532ce72'),
name: 'janedoe',
email: 'janedoe@example.com',
image: 'https://lh3.googleusercontent.com/a/fake-profile-pic-url',
googleId: '109615404571835863524',
isVerified: true,
role: 'user',
lastActive: ISODate('2026-09-07T13:51:59.472Z'),
createdAt: ISODate('2026-09-01T08:11:10.938Z')
}Before a page even loads, our edge middleware verifies JWT session cookies. If an unauthenticated user attempts to access a private route, the middleware instantly catches the request and redirects them.
To prevent automated bots and scrapers from harvesting user data, browser developer tools and inspect elements are explicitly disabled in the production environment.
Users have total control over their data visibility. If a playlist's isPublic flag is set to false, our backend strictly verifies the session ID. Unauthorized access instantly throws a 403 Forbidden error.
Direct, unauthorized API calls are dropped immediately with a 401 Unauthorized status. We enforce strict CORS/CSRF domain protection—even with a stolen token, APIs will fail to execute if the request does not originate from jammify-music.vercel.app.
Sensitive routes like /music/admin are isolated via strict Role-Based Access Control. Standard users are aggressively blocked with an 'Access Restricted' response.
We never request Google OAuth permissions. Your channel subscriptions are managed locally in the Jammify database. However, utilizing the official YouTube iFrame allows your browser session to securely provide native features—like Live Chat—without Jammify touching your Google account.
Our /netflix route provides an all-in-one streaming aggregator without requiring users to hand over their sensitive OTT credentials. Jammify streams content directly on the backend, bypassing the need for Netflix or Amazon Prime passwords.
Users retain full sovereignty over their data. Triggering Account Deletion from the settings page permanently purges the user profile, listening histories, and custom playlists from the database. We do not hoard data.