Privacy Policy

This Privacy Policy is provided by MMC Media LLC, doing business as Psalmix ("we," "us," or "our").

Effective Date: June 12, 2026

This policy covers the Psalmix website (psalmix.com), our blog (blog.psalmix.com), and the Psalmix mobile applications for iOS and Android.

What changed on July 25, 2026: we added the option of advertising cookies on our website, so we can measure whether our ads work. They are off by default and load only if you opt in — accepting analytics does not accept advertising. They never run inside the app, and we never share your listening history with advertisers. Previously this policy said we used no advertising cookies at all; sections 4, 8 and 12 now describe exactly what we do and how to opt out.

What changed on July 29, 2026: for people who opted in to advertising and arrived by clicking one of our ads, we now report account signups (including via Google or Apple), checkout starts, trial starts and payments to Meta from our own servers as well as from the pixel. This is how we find out which ads bring people who actually subscribe, rather than only which ads bring clicks — a payment is confirmed by our payment provider after you have left the page, and a Google or Apple signup finishes somewhere the pixel is never loaded. What is sent is the ad click identifier, a one-way hashed email address, and, for payments, the amount paid; never your listening history, and never anything if you did not opt in. Section 4 describes it in full.

What changed on August 26, 2026: advertising cookies now default differently depending on where you're visiting from, instead of defaulting to off everywhere. If you're in the EU, the UK, or anywhere we can't determine, nothing changes — advertising cookies stay off unless you opt in, exactly as before. If you're visiting from most of the United States, advertising cookies are now on by default, because U.S. law — unlike the EU's — permits this as long as opting out is easy, which it always is: one click in Privacy Settings or the footer's "Cookie Settings," or nothing at all if your browser sends a Global Privacy Control signal, which we honor with no exception either way. Colorado and Connecticut keep the opt-in-required default because their state laws require it regardless of the general U.S. rule. This one choice still governs both the pixel and the server-side conversion reports described in Section 4 — wherever advertising is on, both run; wherever it is off, neither does.

What changed on August 31, 2026: analytics cookies now use the same region-based default as advertising cookies, instead of always requiring an opt-in. If you're in the EU, the UK, Colorado, Connecticut, or anywhere we can't determine, nothing changes — analytics cookies stay off unless you opt in, exactly as before. If you're visiting from most of the United States, analytics cookies are now on by default too, under the same opt-out model already described above for advertising, and you can turn them off at any time in Privacy Settings, via "Cookie Settings" in the footer, or by sending a Global Privacy Control signal, which we honor with no exception. This is still a choice separate from advertising — you can turn either off without touching the other — it simply now uses the identical jurisdiction rule. Sections 8 and 12 describe exactly what analytics collects and how to opt out.

What changed on August 9, 2026: on our public marketing and signup pages — and only if you opt in to analytics cookies — we now record how the page is used so we can replay it and see where people get stuck. A recording shows mouse movement, clicks and scrolling; all text on the page is masked in your own browser before the recording is sent — both what you type and what the page shows back to you — so we receive a moving wireframe, never readable words. Recording never runs on the pages where you listen, browse your library, or manage your account, and it is never used for advertising. Recordings are stored in the United States and deleted after 30 days. Sections 1, 4, 8, 9, 11, 12 and 13 describe it in full — Section 4 is where PostHog is named as our processor — and "Essential only" in the cookie banner declines it outright.

What changed on August 10, 2026: if you opt in to analytics cookies, we now count a short, fixed list of named steps — being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, starting playback for the first time, and the steps of the signup form itself, such as moving between fields, a validation message, or choosing to sign up with Google or Apple. Some of these run before you have an account — the steps of the signup form, and being shown a price or pressing play on our public marketing pages — while starting checkout and seeing a subscription confirmed can only happen once you are signed in. Nothing is counted on a shared song link you open without an account. They carry nothing about what you listen to: no song, playlist, artist or station is ever attached, and the address of any page inside the app is replaced with a placeholder before it is sent. Where something goes wrong we record a fixed category — for example "that email is already registered" — never the error text itself. We also deliberately do not join the two halves: when you sign in, what you did beforehand is not linked to your account, and the session recording of your visit before signing up cannot be looked up from it. Session recording is unchanged and still never runs on the pages where you listen, browse your library, or manage your account. We also stopped naming Mixpanel as a provider — it was listed but never actually received anything, and leaving it in a list of who gets your data would have been misleading. Section 8 describes all of this in full.

What changed on August 13, 2026: on the same public marketing and signup pages, and under the same analytics opt-in, we now also add up where on a page people click and how far down they scroll, so we can see which parts of a page get used and which get missed. This is the same mouse activity a session recording already captured, counted as positions on the page rather than watched back one visit at a time — it adds no new kind of information about you, and it is not tied to your account. It carries no text: a click is recorded as a position, never as what you clicked on. Like recording, it runs only on those public pages — never on the pages where you listen, browse your library, or manage your account — and choosing "Essential only" declines it outright. Section 8 describes it in full.

What changed on October 6, 2026: advertising now waits for your yes everywhere. The Meta pixel and the conversion reports our servers send to Meta stay off until you choose "Allow" or "Accept all" in the cookie banner, or turn advertising on in Cookie Settings or Privacy Settings — including across most of the United States, where they used to start on. This reverses the August 26, 2026 change. If advertising was on for you only because of that old default, we no longer treat it as a yes. Session recording waits for your yes too. Analytics cookies keep the region-based default from the August 31 entry, but across most of the United States that default now covers only page views and named events; the session recording and heatmaps from the August 9 and August 13 entries start only once you actually say yes. Our kids’ learning pages — the times tables songs page and its printables — never load the Meta pixel or session recording, even after you say yes, and an account created on one of them is never reported to Meta. This policy now also covers our blog (blog.psalmix.com). The blog has its own cookie banner that follows the same rules as psalmix.com, and a Global Privacy Control signal is honored there just as it is here. The blog uses Google Analytics 4 in Google Consent Mode with its advertising features switched off; it sets its cookies only under the analytics choice, with the same region-based default. Under the advertising choice, and only after you accept, it uses the Meta pixel, which reports page views and runs only on certain posts about the app and clean music — never on posts about faith or worship or on kids’ learning posts. Your choices on the blog are stored separately from your choices on psalmix.com — change them with "Cookie Settings" in the blog's footer. On both sites, the footer's "Do Not Sell or Share My Personal Information" link opens Cookie Settings. Sections 4, 5, 8 and 12 and our Cookie Policy describe it in full.

What changed on October 7, 2026: on psalmix.com, advertising measurement now starts on in some U.S. states, with a notice and a one-tap way to turn it off. This partly reverses the October 6 change. If the location our network provider reports for your visit is a U.S. state other than California, Colorado, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania or Washington, the Meta pixel and the conversion reports our servers send to Meta start on, and the cookie banner says so, names Meta, and offers "Turn off Meta" (or "Essential only", if you haven't answered about analytics cookies yet), which turns it off with one tap and remembers that in that browser for at least a year, unless both that browser's cookies and its other stored data for psalmix.com are cleared. In those 14 states, outside the United States, and whenever the reported location doesn't include a U.S. state, nothing changes: advertising waits for your yes. A Global Privacy Control signal still turns it off, and a choice you have already made, yes or no, always beats the default. The default is never saved as a yes. Our kids’ learning pages now switch Meta off for the whole browser: once a browser opens one, Meta stays off on psalmix.com in that browser for a year after its last visit to one — even if you said yes before — and the cookie banner and settings explain why instead of offering to turn it on. Times tables signups are still never reported to Meta. Our blog's own cookie banner is unchanged: there, advertising still waits for your yes. Sections 4, 5, 8 and 12 and our Cookie Policy describe it in full.

1. Information We Collect

2. How We Use Your Information

• To provide and improve our music streaming service
• To verify your age at signup and enforce our minimum age requirement
• To generate personalized recommendations
• To track achievements and progress
• To process subscriptions and manage billing
• To send transactional emails and, if you opt in, push notifications
• To deliver over-the-air updates to the mobile app
• To ensure content remains family-appropriate
• To prevent fraud and abuse

Refund Policy: For our refund policy, see Section 5 of our Terms of Service. Mobile in-app purchases are subject to Apple App Store or Google Play refund policies.

Listening Activity as Sensitive Data

Because our catalogue includes worship and gospel music alongside every other genre, your listening history may reflect religious preferences or beliefs. We treat this as sensitive personal information. We do not sell your listening history. We do not share it with advertisers or advertising networks. It is used only to improve your personal recommendations and service experience.

3. AI-Generated Content

4. Service Providers & Information Sharing

We do not sell, trade, or rent your personal information to third parties. We share information only with the service providers listed below, and only for the purposes described. One of them — Meta, for advertising measurement — receives nothing at all unless advertising is on for you: you opted in, or, on psalmix.com, it started on by default where you are (Section 8) and you have not turned it off.

Web Service Providers

• Creem (web payment processing): Processes web subscription checkouts. Receives the information needed to bill you (name, email, payment instrument). We do not store full card numbers. See creem.io/privacy.
• PostHog (product analytics & session replay): Helps us see how visitors move through Psalmix, so we can find where people get stuck. PostHog loads only after you opt in to analytics cookies. It does two separate things, with different limits. Session replay runs only on our public marketing and signup pages, only once you have actually said yes to analytics (the U.S. default alone never starts it), and never on our kids’ learning pages or on the pages where you listen, browse your library, or manage your account. Product analytics — counting visits to those public pages while you are signed out, plus a short list of named events such as completing signup, viewing a price, starting checkout, and starting playback, which run both on those public pages and inside the app once you are signed in. Those events record that something happened, never what you listened to: no song, playlist, artist, or station is ever included, and the address of any page inside the app is replaced with a placeholder before anything is sent. When you sign in we start a new, unlinked identity, so the events and the recording from before you had an account are not joined to it. It acts as our data processor under a Data Processing Agreement — it processes this information only on our instructions, and does not use it for its own purposes or for advertising. Recordings are hosted in the United States and deleted after 30 days. All text on the page — what you type and what the page displays back to you — is masked in your browser before anything is sent, so PostHog never receives readable content. Withdraw consent anytime in Settings → Privacy. See posthog.com/privacy.
• Google Tag Manager: Manages our analytics scripts using Google Consent Mode. No analytics scripts are loaded until you give consent through our cookie banner. See policies.google.com/privacy.
• Google Analytics 4 (our blog): On blog.psalmix.com, Google Analytics 4 tells us which pages are viewed, the type of device used, and your approximate location, derived from your IP address. The Google tag runs on every blog page in Google Consent Mode with its advertising features switched off: it sets its cookies only once analytics is on for you (by your choice, or by the regional default in Section 12), so nothing is stored on your device before you consent wherever consent is required, and it is never used for advertising. See policies.google.com/privacy.
• Vercel: Hosts our website and processes standard server logs (such as IP address and request data) needed to serve and secure the site. See vercel.com/legal/privacy-policy.
• Meta / Facebook (advertising measurement): If — and only if — you opt in to advertising cookies (or, on psalmix.com, advertising started on by default where you are, as Section 8 describes), the Meta pixel loads on our public marketing pages (never on our kids’ learning pages, such as the times tables songs page, and never in a browser that has opened one of them in the past year) and on certain posts on our blog (blog.psalmix.com) about the app and clean music, and tells us whether an ad led to a visit, a signup, a gift purchase (the confirmation page you land on after paying reports that a gift was bought and the amount paid; neither your email nor your recipient’s is sent), someone playing one of the free 15-second station previews that run on those public pages, or someone listening to a set of those previews all the way through. Meta receives your IP address, browser information, and the marketing or blog page you viewed. For the preview events we send only the fact that a preview started, and separately that one ran to its end — never which station, genre or song — so neither can indicate a musical or religious preference. On our blog, the pixel sends page views only, and only on certain posts about the app and clean music; it does not run on blog posts about faith or worship or on kids’ learning posts, so Meta does not learn a religious interest from what you read there. It does not receive your listening history, playlists, or any song data, and it never loads inside the app itself — the signed-in pages where you play the full catalogue, browse your library, or manage your account. Under California law this counts as "sharing" for cross-context behavioral advertising. Withdraw consent anytime in Settings → Privacy. See facebook.com/privacy/policy.
  
  Server-side conversion reporting. Under the same choice — your opt-in, or the psalmix.com default described in Section 8 — only for people who reached us by clicking one of our ads, and never for an account created on one of our kids’ learning pages or in a browser that has opened one of them in the past year, we also report account signups (including via Google or Apple), checkout starts, trial starts and payments to Meta directly from our servers. We store that ad's click identifier on your account when you sign up, and when one of those events happens we send Meta that identifier, a one-way hashed (scrambled and unreadable) version of your email address, and, for payments, the amount paid. We do this because the events that matter do not happen in a web page: a payment is confirmed by our payment provider after you have left the site, and a Google or Apple signup completes on a part of our site the pixel is never loaded on. What we do not send: your email address in readable form, your IP address, your device or browser information, and — without exception — anything about what you listen to. If advertising was never on for you, nothing is reported from our servers. If you withdraw on psalmix.com, the click identifier stored in your browser there is deleted immediately, and our servers stop reporting for your account as soon as the withdrawal is connected to it — immediate when you make the change while signed in.

Mobile App Service Providers

• Apple App Store / Apple Sign-In: If you sign in with Apple, Apple shares a unique identifier and (if you choose) your name and email with us. In-app purchases on iOS are processed by Apple under its own privacy policy.
• Google Play / Google Sign-In: If you sign in with Google, Google shares a unique identifier and basic profile information with us. In-app purchases on Android are processed by Google under its own privacy policy.
• RevenueCat: Verifies App Store and Google Play purchase receipts and manages subscription state. RevenueCat receives the receipt and a pseudonymous user identifier — not your payment card. See revenuecat.com/privacy.
• Expo: Used to deliver push notifications and over-the-air updates to the mobile app. Expo receives push tokens (when you opt into notifications) and basic device information needed to deliver updates. See expo.dev/privacy.

Shared Infrastructure (Web and Mobile)

• Supabase: Hosts our application database, authentication, and file storage. Substantially all personal information described in this policy is stored on Supabase's infrastructure on our behalf. See supabase.com/privacy.
• Cloudflare R2: Stores audio files and images we serve to you.
• Resend: We use Resend on our backend to deliver authentication emails (such as one-time verification codes), account notifications, and other transactional emails to both web and mobile users. Resend processes recipient email addresses and message content on our behalf. See resend.com/legal/privacy-policy.

Other Disclosures

• Legal Requirements: When required by law or to protect our rights.
• Business Transfers: In connection with a merger or acquisition (with notice to users).
• With Your Consent: When you explicitly agree to share information.

5. Age Requirements & COPPA Compliance

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Authentication and database access secured through Supabase, with row-level security policies enforcing per-user access
• Regular security audits and monitoring
• Limited access to personal information on a need-to-know basis
• Regular software updates and security patches

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal information
• Correct: Update or correct inaccurate information
• Delete: Request deletion of your personal information
• Portability: Export your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications and disable push notifications
• Restrict: Limit how we use your information

To exercise other privacy rights or for assistance with account deletion, contact us at [email protected]

8. Cookies and Tracking

On the web we use three kinds of cookies, and you control two of them independently through our cookie banner:

• Essential cookies — to keep you logged in, secure your session, and remember your preferences. These are required for the site to work and are always on.
• Analytics cookies — PostHog, managed via Google Tag Manager with Consent Mode. Whether they start on or off depends on where you're visiting from — see Section 12 for exactly which. PostHog counts visits to our public pages while you are signed out, and a short list of named events describing how far you get through signup and checkout — some on our public pages before you have an account, the rest once you are signed in — and, only once you have actually said yes to analytics, records how our public marketing pages are used. Both are described below. On our blog (blog.psalmix.com), analytics cookies are Google Analytics 4, which uses Google Consent Mode and follows the same regional default.
• Advertising cookies — used to measure whether our advertising works, so we can tell which ads brought people to Psalmix and stop paying for the ones that don't. This means the Meta (Facebook) advertising pixel, on psalmix.com and on our blog (blog.psalmix.com), and the conversion reports our servers send to Meta for people who arrived from one of our ads. One choice governs both. It starts off — nothing runs until you choose "Allow" or "Accept all" in the cookie banner, or turn advertising on in Cookie Settings or Privacy Settings — except on psalmix.com in the U.S. states described just below, where it starts on with a notice. Analytics and advertising are two separate choices — granting or declining one never changes the other.

Accepting analytics does not accept advertising — they are separate choices, and you can change either at any time in Privacy Settings. For full details and controls, see our Cookie Policy.

Session recording, and its limits. If you say yes to analytics cookies — "Allow" or "Accept all" in the cookie banner, or saving Cookie Settings with analytics on, or switching analytics on in Privacy Settings — PostHog records how our public marketing and signup pages are used and lets us replay it — mouse movement, clicks, scrolling, and moving between pages — so we can see where people get stuck before they ever create an account. Across most of the United States analytics cookies start on by default, but that default alone never starts a recording. Recording never runs on our kids’ learning pages, such as the times tables songs page and its printables, even after you say yes. This is web only; there is no session recording in the mobile app.

Heatmaps, and why they are the same promise. Under the same yes and on exactly the same public pages, we also add up where people click and how far they scroll, across everyone, into a heatmap. A recording answers "what did this one visit do"; a heatmap answers "which part of this page does everyone use" — the same mouse activity, counted rather than watched. A click is stored as a position on the page, never as what sits at that position, so no button label, link text, or any other words are collected. It is not attached to your account even when you are signed in, because it does not run on the pages you see while signed in. Every limit below applies to it unchanged: it never runs on the pages where you listen, browse your library, or manage your account, and if you are on a page whose web address carries anything beyond a campaign tag, nothing is collected there at all.

Named events, and what they are not. Understanding where people give up did not stop being useful the moment you created an account, so if you opt in to analytics cookies we also record a short list of named events: completing signup, being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, starting playback for the first time, and the steps of our free times-tables page (viewing it, pressing play, signing up there, a first song finishing, and tapping its spelling-preview, trial, share, app-store, sampler, chart, certificate or video-consent buttons). Because the two halves of a visit are deliberately kept apart, pressing play while signed out and again after signing in counts once on each side rather than once overall. Once you are signed in these are tied to your account, so we can tell one person's journey from another's. All of them are recorded by your browser as you go — none of them are sent from our servers, and none of them is a record of a payment. What you actually paid, and when, lives with our payment provider and in your account, described in Section 4.

Some of them run before you have an account. The signup form is the single place where knowing what went wrong matters most, and everyone filling it in is by definition not signed in yet — so the steps of that form are recorded too: opening the page, moving between fields, a validation message such as "that email is already registered", choosing Google or Apple instead, and submitting. These are not tied to any account, because at that point there is not one. Where a step fails we record a fixed category, never the error message itself, and never the address you typed — if we suggest a correction to an obvious typo, only the domain (for example "gmail.com") is counted.

Two practical notes, so this is not overstated. If you sign up with Google or Apple, our server leaves a five-minute first-party cookie called psx_signup_completed on the way back, holding only which provider you used, so your browser can count the signup — the account is created on our server, where the analytics code does not run. It carries no identifier, and if you have not opted in it is discarded without sending anything. Separately, withdrawing consent takes effect immediately in the tab you withdraw it in and on every page load after that; a different tab you already had open may keep its recorder running until you reload or navigate it.

We do not join the two halves, on purpose. The moment you sign in, we start a fresh, unlinked identity in PostHog. What you did before you had an account — including the masked recording of you filling in the signup form — is not attached to your account and cannot be looked up from it. This costs us something real: we cannot follow one person from first visit through to payment as a single path. We would rather lose that measurement than turn a recording made of a stranger into a recording of you.

They are not a record of what you listen to. No song, playlist, artist, or station identifier is ever attached to one of these events — "playback started" says that you pressed play, never what you pressed play on. The web address of any page inside the app is replaced with a placeholder before anything is sent, so the page you were on cannot reveal it either. We hold this line deliberately: our catalogue includes worship and gospel music, and a listening history could suggest something about your religious beliefs. That is information we have chosen not to collect at all rather than promise to handle carefully. Session recording still never runs on these pages.

What a recording can never contain — and these are hard limits, not intentions:

• Readable text of any kind. Every piece of text on the page is replaced with a placeholder in your own browser before the recording is sent — not only what you type into a form, but any text the page displays back to you, such as an email address shown on a confirmation screen. A recording is a moving wireframe: layout, cursor, clicks and scrolling, with blocks where the words were. The words themselves never leave your device, so neither we nor PostHog can recover them.
• Anything you do in the app. Recording runs only on our public marketing and signup pages — the ones anyone can read without an account, like this one. It never runs on the pages where you listen, browse your library, or manage your account, so a recording contains no listening history, no playlists, and no song data.
• A recording is never used for advertising, and is never sent to an advertising network. PostHog is our processor, not an advertiser.

Recordings are stored in the United States and deleted after 30 days. Recording starts only once you say yes, so "Essential only" or "No thanks" in the cookie banner means it never starts; to stop it later, turn analytics off in Privacy Settings or in "Cookie Settings" in the footer.

Whether analytics cookies start on or off also depends on where you're visiting from. In the EU, the UK, Colorado, Connecticut, or anywhere we can't determine, analytics cookies are off until you opt in, exactly as before. Visiting from most of the United States, analytics cookies are on by default and you can opt out at any time using any of the methods described below. That default covers page views and named events; session recording and heatmaps still wait for your yes. Advertising cookies do not share this default — since October 6, 2026 they are off everywhere until you say yes (see "Sharing for advertising" in Section 12). Analytics remains a separate choice: you can turn analytics off without touching advertising, or the reverse.

Where advertising starts on, on psalmix.com. If the location our network provider reports for your visit is a U.S. state other than California, Colorado, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania or Washington, advertising measurement starts on: the Meta pixel loads on the pages described in Section 4, and the conversion reports our servers send to Meta can run. The cookie banner tells you so, names Meta, says it measures Psalmix’s ads, and offers "Turn off Meta", which turns it off with one tap, deletes the ad click identifier stored in that browser, and keeps it off there for at least a year, unless both that browser's cookies and its other stored data for psalmix.com are cleared. (If you haven't answered about analytics cookies yet, the banner offers "Essential only" instead, which turns off both.) Switching advertising off in Cookie Settings or Privacy Settings does the same. In those 14 states, outside the United States, and whenever the reported location doesn't include a U.S. state, advertising starts off and waits for your yes. It also starts off if your browser sends a Global Privacy Control signal, if you have already said no, or if the browser has opened one of our kids’ learning pages in the past year (Section 5). The default is never saved as a yes: we decide it again for each browser session, and our servers check the location again when you create an account before linking an ad click to it. Our blog (blog.psalmix.com) does not use this default; there, advertising waits for your yes.

Two limits we place on advertising, deliberately. Advertising cookies run only on our public marketing pages — the ones anyone can read without an account, including the short station previews that play on them, but never our kids’ learning pages — and certain posts on our blog about the app and clean music, and never inside the app, on the signed-in pages where you play the full catalogue, browse your library, or manage your account. And we never send what you listen to, or any song or playlist information, to an advertising network. On psalmix.com, advertising measurement can see that a visit, a preview play, a preview heard through to the end, a tap on a sign-up, invoice or pay-by-card button, a submitted invoice request, a signup, a checkout start, a trial or a payment happened; it cannot see what music was involved. That second limit holds for the conversion reports our servers send as well as for the pixel — there is no field in them that could carry a song, artist, playlist or genre. On our blog, the pixel sees which post you read, and a post can be about a kind of music — which is why the pixel runs only on certain posts about the app and clean music, and never on posts about faith or worship or on kids’ learning posts.

We honor Global Privacy Control (GPC) browser signals. When a GPC signal is detected, analytics cookies are disabled unless you have explicitly opted in — and advertising cookies are disabled outright, even if you previously opted in, because under California law a GPC signal is itself a valid opt-out of sharing.

We do not use third-party analytics or advertising trackers in the mobile app. If this changes, we will update this policy and provide an in-app consent mechanism.

9. International Transfers

Psalmix is operated from the United States and is intended primarily for users in the United States. If you use Psalmix from another country, your information will be transferred to and processed in the United States, where our service providers (such as Supabase, Cloudflare and RevenueCat) operate. Our analytics processor, PostHog, processes this information in the United States. Where our service providers' data processing agreements include Standard Contractual Clauses (SCCs) or equivalent safeguards for EU and UK personal data, we rely on those safeguards.

Session recordings from our public marketing pages are stored in the United States by PostHog, our analytics processor, wherever in the world you happen to be reading from.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide 30 days' advance notice by email and by posting the updated policy on our website and in the mobile app. Continued use after that period constitutes acceptance. When you create an account, we record your acceptance of these terms and the date accepted.

11. European Union & United Kingdom Privacy Rights (GDPR)

12. California Privacy Rights (CCPA/CPRA)

13. Data Retention

We retain your information only as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained until account deletion, then permanently removed within 30 days
• Push notification tokens: Retained while valid; removed when you disable notifications, uninstall the app, or delete your account
• Consent records: Retained for 7 years for legal compliance
• Payment and subscription records: Retained for 7 years for tax and legal requirements
• Listening history: Retained until account deletion
• Session recordings (public marketing pages, analytics opt-in only): Retained for 30 days, then automatically deleted
• Named analytics events (analytics opt-in only): Kept for no longer than 12 months, after which our analytics provider deletes them on the retention setting we have configured with them. Twelve months is what a signup-and-checkout funnel needs in order to be compared against the same season a year earlier; we have no use for them beyond that. Events recorded before you had an account are not linked to any account and are not retrievable by you or by us as "your" data. Events recorded while you are signed in are keyed to your account, and are deleted along with your account — see below
• Audit logs: Retained for 90 days
• AI support chat logs: Retained for up to 90 days, then automatically deleted

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: