Privacy Policy

1. Introduction

This Privacy Policy explains how Remixd (“Remixd,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information about you when you use our website, applications, and related services (collectively, the “Service”). Remixd is a community platform for sharing music and files that lets you build a customizable profile, import playlists from streaming services, share posts, lyric cards, and audio files, participate in forums, and connect with other listeners.

By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

2. Who Is Responsible for Your Data

Remixd is the data controller for the personal data processed through the Service. For privacy questions, requests, or complaints, contact us using the details in the Contact Us section below.

3. Information We Collect

We collect the following categories of information. We have tried to be exhaustive so you know exactly what is stored.

3.1 Information you provide directly

• Account data: email address, username, and (for email/password accounts) a securely hashed password. We never store your password in plain text.
• Profile data: display name, bio, pronouns, location, website link, profile and banner images, background images or video, and your chosen colors, fonts, layout style, custom CSS, vibe board, and profile song.
• Content you create: posts (text, images, polls, lyric cards, playlist drops, and “now playing” cards), comments, reactions, forum threads and replies (including any audio files you upload), and direct messages you send to other users.
• Social graph:the accounts you follow and that follow you, and your interactions with other users’ content.
• Communications with us: information you provide when you contact support or otherwise correspond with us.

3.2 Information from connected music & login services

• OAuth tokens: when you connect an account from another service (Google, Spotify, Apple Music, YouTube Music, Last.fm, Deezer, or SoundCloud), we store the access and refresh tokens needed to act on your behalf. These tokens are encrypted at rest.
• Provider profile identifiers: the provider’s user ID and username, the scopes you granted, and token expiry times.
• Music data: playlists, tracks, album artwork, preview URLs, synced lyrics, and the track you are currently playing, as made available by the connected service.

3.3 Information collected automatically

• Authentication & session data: session tokens and cookies that keep you logged in and secure your session.
• Technical & log data: information your browser or device sends automatically, such as IP address, device and browser type, and timestamps, used for security, abuse prevention, and to operate the Service.
• Usage data: the pages you view and the actions you take within the Service.

4. How We Use Your Information

We use your information to:

• Create and maintain your account and profile;
• Provide core features: feeds, posts, messaging, forums, file sharing, playlist import, lyrics, and music search;
• Authenticate you and connect your music and login services on your behalf;
• Deliver notifications about follows, reactions, comments, reposts, mentions, and messages;
• Personalize your experience and surface relevant people and content;
• Maintain the security and integrity of the Service, prevent fraud and abuse, and enforce our terms;
• Diagnose problems, debug, and improve the Service; and
• Comply with legal obligations.

5. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data under one or more of the following legal bases:

• Contract: processing necessary to provide the Service you signed up for;
• Consent: where you connect another service or otherwise opt in (you may withdraw consent at any time);
• Legitimate interests: operating, securing, and improving the Service, where not overridden by your rights; and
• Legal obligation: where processing is required to comply with the law.

6. How We Share Information

We do not sell your personal data. We share information only as described below.

• With other users: your profile, posts, comments, forum activity, shared files, and public interactions are visible to others according to the visibility settings you choose (public, followers only, or private). Direct messages are visible to the participants of the conversation.
• With connected services: when you link a music or login provider, we exchange data with that provider as needed to deliver the feature. Their handling of your data is governed by their own privacy policies.
• With service providers: we use trusted vendors that process data on our behalf, such as our database host (Neon), and, where configured, cloud object storage (Amazon Web Services) and caching infrastructure. These providers are bound by contractual confidentiality and security obligations.
• For legal reasons: we may disclose information if required by law, legal process, or to protect the rights, property, or safety of Remixd, our users, or the public.
• Business transfers: if Remixd is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

7. Connected Services

The Service integrates with the following third parties. We encourage you to review their privacy policies:

• Login & music providers: Google, Spotify, Apple Music, YouTube Music, Last.fm, Deezer, and SoundCloud.
• Music search: the Apple iTunes Search API, used as a default search source that does not require you to connect an account.
• Infrastructure: Neon (serverless PostgreSQL database) and, where enabled, Amazon Web Services (media storage) and Redis (caching).

8. Cookies and Similar Technologies

We use cookies and similar technologies that are strictly necessary to operate the Service, primarily to keep you signed in and to protect the security of your session. Because these cookies are essential to the functioning of the Service, disabling them in your browser may prevent you from logging in or using core features.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymize your personal data, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Some residual copies may persist in backups for a limited period before they are overwritten.

10. Data Security

We implement technical and organizational measures designed to protect your information, including hashing of passwords, encryption at rest of access and refresh tokens for connected services, encrypted connections (HTTPS), and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. International Data Transfers

We and our service providers may process and store your information in countries other than your own, including the United States. Where we transfer personal data internationally, we take steps to ensure an adequate level of protection consistent with applicable law.

12. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data;
• Restrict or object to certain processing, including direct marketing;
• Data portability: receive your data in a portable format;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with a data protection authority.

You can exercise many of these rights directly in your account settings, for example by editing your profile, managing connected services, or deleting content. For any request we cannot fulfill in the app, contact us using the details below. We will not discriminate against you for exercising your privacy rights.

12.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the “sale” or “sharing” of personal information. We do not sell your personal information.

13. Children's Privacy

The Service is not directed to children under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at damian@nullberry.dev.