Privacy Policy
Last updated: 29 October 2026
1. Data controller
Vasili Cekaskin, Westtangente 71, 40880 Ratingen, Deutschland, is the data controller responsible for the processing of personal data described in this policy. Contact: vasili@cekask.in.
2. Data we collect
- Account data — email address, username, avatar
- Content you upload — songs, lyrics, cover art, comments, reactions
- Usage data — plays, likes, peer relationships
- Billing data — plan and subscription status (payments processed by Apple App Store, Google Play, and RevenueCat)
- Device/technical data — IP address, device type, app version
3. How we use your data
To provide and operate the service, authenticate accounts, process subscriptions, send service-related notifications, and improve reliability and features. Uploaded audio is transcribed and analysed for automatic lyrics, tags, and mood (see section 5). We use only first-party usage analytics and do not embed third-party advertising or tracking networks.
4. Legal basis
Processing is based on performance of a contract (Art. 6(1)(b) GDPR — providing the service you signed up for), legitimate interest (Art. 6(1)(f) GDPR — security, abuse prevention), and consent where required (Art. 6(1)(a) GDPR — first-party usage analytics and optional communications).
5. Data sharing & processors
We share data only with service providers necessary to operate trackdemos, under data processing agreements. We do not sell personal data. Processors:
- Supabase — authentication, database hosting, transactional email
- Amazon Web Services (S3 & CloudFront) — audio and file storage/delivery
- OpenAI — transcription and automatic tagging/mood of uploaded audio
- RevenueCat, Apple App Store, Google Play — subscription billing
6. Data retention
We retain account and content data for as long as your account is active. When you delete your account, your account and content are deleted immediately; residual copies in encrypted backups are purged within 30 days. Billing and tax records are retained only where and for as long as required by law (up to 10 years under §§ 147 AO, 257 HGB).
7. Your rights
Under the GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You may also lodge a complaint with a supervisory authority. Contact vasili@cekask.in to exercise these rights.
8. Cookies & local storage
We use cookies and local storage strictly to keep you signed in and to remember your preferences (e.g. language and theme) — these are essential and always on. Our own first-party usage analytics run only with your consent (opt-in) and stay off until you accept; you can give or withdraw this consent at any time below. We do not use third-party advertising or cross-site tracking cookies, and analytics events carry no persistent identifier beyond the one below that records your choice.
| Name | Purpose | Duration | Consent? |
|---|---|---|---|
| sb-* (cookie) | Keeps you signed in (Supabase auth session) | Session / until logout | No — essential |
| td-locale (cookie) | Remembers your chosen language | 1 year | No — essential |
| theme (local storage) | Remembers your chosen appearance/theme | Until cleared | No — essential |
| ad-banner-dismissed-on (local storage) | Remembers you dismissed today's plan-limit notice | 1 day | No — essential |
| td-analytics (local storage) | Records your analytics choice itself (value, date, policy version) | Until cleared or 12 months, whichever is sooner | No — this is the consent record |
| First-party usage analytics | Counts app opens/feature use in our own database — no third party, no cross-site tracking | N/A — no additional cookie beyond td-analytics above | Yes — opt-in, off by default |
9. Contact
Questions about this policy: vasili@cekask.in