Privacy and Security
PFML is a private site for the players in our Music League. It is run by a league member, not a company, and it has no ads.
Security check
Full review: October 24, 2026 Daily check passed- New security problems: we went through the security problems announced in the last 30 days for everything PFML is built on: Supabase, GitHub, the sign-in library, and the browsers you use. One mattered: on October 14, Supabase announced a serious flaw in its file storage that could let a stranger replace stored files. Supabase has fixed it on PFML's project, and we checked every stored league file against our own copy: they all match. None of the others affect PFML.
- Tested from the outside: we tried to get into the site the way a stranger would, without signing in. Every part of the league's data, every members-only feature and the stored files all said no. Nothing could be read or changed.
- A locked sign-in library: the code that handles signing in is fixed to one exact version and checked against its fingerprint. If anyone tampered with the copy online, your browser would refuse to run it.
- Checked our own code: anything members type, like replies and comments, is shown as plain text, so it can't run as code in someone else's browser.
- Checked every day: each morning, an automatic check looks for newly announced problems in Supabase, the sign-in library and the tools that publish the site, makes sure the Supabase services PFML runs on have every fix, and repeats the test from the outside. The time above is when it last passed. If something needs a person to look at it, the time stays put until they have.
What you can do
- Keep your phone and browser up to date.
- Only open invite links that come from the league organizer.
- Sign out (the menu under your initials) on a shared computer.
When you sign in with Google
Signing in shares three things from your Google account: your name, your email address, and Google's ID for your account. PFML uses them only to recognise you and to link you to your player in the league, which happens once, through a personal invite link.
PFML doesn't ask for, and can't see, anything else in your Google account: no Gmail, contacts, Drive, calendar or YouTube. Sign-in is handled by Supabase, the service that stores PFML's accounts and data.
What you add on the site
Votes, reactions and replies you leave on comments are stored with your account and shown to other members, with your player name.
A track you submit on the Submit page is stored without your name or the time you sent it. Which track is yours is kept apart, where nothing on the site can read it, the league organizer included; only you see it, on your own Submit page. Once the round closes, every member can see the list of tracks, and the league organizer turns it into a Spotify playlist and a YouTube playlist on their own accounts. They aren't listed publicly, members open them from the Submit page, and they hold the songs only.
In a round voted on the site, you can add a note with your track. It's stored with the track, not your name. Members see it once voting closes, with your name, like the track itself. If you switch on “Show it to voters while they vote”, members also see it with the track while they vote, without your name. Until then the database doesn't let anyone else read it.
Announcements the league's commissioners post are stored with who posted them, shown to members on Home for a week, and sent to the phones of members who have notifications on.
In a season played on the site, voting happens here too. Your ballot, the points and any comments you give, is stored with your account, and nobody sees it, the league organizer and commissioners included, while voting is open; other members see only that you've voted. Once that round's voting closes, every member sees the results: who submitted each track, and every voter's points and comments, as Music League showed them. Until then, who submitted which track stays as private as in any other round. Commissioners are members the league organizer picks to run the rounds: they can open and change rounds and seasons, and see nothing more than any other member.
While you vote, your points and comments also save as you go, as a draft, so they follow you between your phone and your computer. The draft is stored with your account, only you can read it, and it never counts: only the ballot you submit does.
In the voters' lounge, a message you send is stored with your account, so the site can keep you the same instrument name all round and hold you to one message a day. Nothing on the site shows who wrote what, the league organizer included: members see only the instrument name, while voting is open and after it closes, when the lounge stays readable under the results. The league organizer can remove a message without learning who wrote it.
When a round hides its prompt from its Spectators, a Spectator's guess at it, and at who wrote it, is stored with their account. Once voting closes, every member sees the guesses with names, like the votes. To score how close each guess came, the site sends the round's prompt and the words of the guesses, without anyone's name, to Claude, Anthropic's AI model, through Anthropic's API. A commissioner can change a score.
Notifications
Notifications are off until you turn them on, from the bell at the top of the page, on each phone or browser you want them on. When you do, PFML keeps, with your account, the address your phone's push service gives it for that device (Apple's, Google's or Mozilla's, depending on the phone and browser). It uses that address only to tell you that a new round has opened, a round's playlist is ready, someone has replied or reacted to one of your comments, or the commissioners have posted an announcement, and the push service carries the message to your phone. A reply notification shows the start of the reply and who wrote it, as your inbox does, so it can appear on your lock screen. PFML keeps which kinds you've switched off, a record of which reminders it has sent you, and how far it has told you about replies and reactions, so none comes twice. Turning notifications off on a device deletes its address, and removing your account deletes all of it. PFML doesn't send email.
League data
Standings, submitted tracks, votes and comments come from the league's own Music League exports, and, for a season played on the site, from the site itself once each round's voting has closed. They're shown to signed-in members of the league.
What PFML doesn't do
- No advertising, and no analytics or tracking scripts.
- Nothing is sold or shared with anyone outside the league.
- No Spotify, YouTube or SoundCloud account is involved. Links to songs are ordinary links to those sites.
Services the site loads from
Like most websites, PFML loads some pieces from other services, which see a normal web request from your browser (including your IP address): GitHub Pages hosts the site, Google Fonts serves the fonts, jsDelivr serves the sign-in library, Supabase handles sign-in and data, and Spotify's image servers serve the album art on round pages. On the Submit page and the repeat checker, a search goes through PFML's Supabase to Spotify or YouTube, and the results' artwork comes from their image servers. The site remembers YouTube searches for a week to save its daily allowance, but never who searched. When you paste a link, your browser asks that service for the track's title and channel, to check it against past rounds. A track plays in Spotify's, YouTube's or SoundCloud's own player, which loads from that service when you paste a link or open a track (YouTube's is its privacy-enhanced player). Pressing Play the round loads each service's player code from that service, and the player remembers in your browser whether you chose YouTube or Spotify copies.
Stored in your browser
Your browser keeps your sign-in session so you stay signed in. While you sign in, it also holds the address of the page you were on, so you land back there, and, if you came from an invite link, that link's code until your account is linked. Signing out clears the session. It also remembers a few choices, on that phone or computer only: dark mode if you turn it on, the newest feature you've seen (so Home can say New), whether you've tapped Get the app, and whether the round player plays YouTube or Spotify copies. In the installed app, it notes that the opening screen has been shown, until you close the app. If you turn on notifications, the browser keeps a small background script from PFML that shows them; it stores nothing and doesn't touch the pages you visit.
Removing your account
Ask the league organizer and your account will be deleted, along with the votes, reactions and replies you added. Tracks you submitted stay in their round's list, with nothing left linking them to you. Your Music League results stay in the league's history, since they come from Music League's own export.
Last updated October 29, 2026.