Privacy policy

This policy explains how we process your personal data when you use the Melomany app and this website. By creating an account, you authorise that processing as described here.

Controller

The controller is Heronima S.A.S., a Colombian company with tax ID (NIT) 902.116.536-7, registered in Bogotá, Colombia.

Contact for any privacy matter: [email protected].

We process your data under Colombia’s Law 1581 of 2012 and Decree 1377 of 2013 and, if you live in the European Economic Area, under the General Data Protection Regulation (GDPR).

What data we process and why

• Account: your email address, your password (handled by our sign-in provider; we never see it) and, if you sign in with your phone, your number. They create your account, identify you and keep it secure. We send your account’s emails to that address: to verify it, to reset your password and, if you change it, to confirm the new one, with a notice to the old one. Basis: performing the contract you accept when you sign up (GDPR article 6.1.b).
• Profile: your username, your name and, if you set one or your sign-in provider supplies it, your photo. Optionally, your bio, your gender and your preferred platform. They let other members recognise you. The optional fields rest on your consent, which you can withdraw by editing them or choosing “prefer not to say”.
• Group activity: the groups you create or join, your role in them, battles, the tracks you pick, your votes and notes, the rules you report, group chat messages, your reactions and which messages you’ve read. This is the service itself. Basis: performing the contract.
• Invitations: if you invite someone, we keep the email address you enter so that person sees the invitation in the app. Only invite people who expect it. Basis: our legitimate interest, and yours, in letting you invite your friends (GDPR article 6.1.f).
• Music searches: what you type when searching for a track. We send it to the music services with nothing that identifies you.
• Technical data: each request to our server is logged with the address requested, the time, the result and how long it took. It keeps the service running, detects abuse and fixes errors. Basis: our legitimate interest in a secure, stable service.

We process no sensitive data, use no analytics, advertising or tracking, and don’t sell your data.

What others see:

• Anyone signed in can see your username, name and photo.
• Members of your groups see your tracks, your messages and which messages you’ve read. When a battle ends, they also see each vote’s points and notes, with the voter’s name.
• A group’s managers see the email addresses of pending invitations.

Processors and international transfers

To run the service we use these providers, which process data only on our instructions:

• Google (Firebase and Google Cloud): sign-in, the server, change notifications and technical logs, in the United States (us-east1).
• Neon: the database holding your account and activity, hosted on Amazon Web Services in the United States (us-east-1).
• Resend: sends your account’s emails, in the United States (us-east-1), with open and click tracking off. It receives your email address, your username and each email’s link; the email-change notice, which Firebase writes, may also include the name your sign-in provider supplies.
• Anthropic: its AI reviews your photo and the texts others read before they see them. It receives your photo as a copy of up to 1024 px, re-encoded without metadata; your name; groups’ names and descriptions; battles’ topics and rules; and your votes’ notes. It also checks whether a track meets a battle’s rules, from the track’s catalogue data. We never tell it whose photo or text it is, and it never receives chat, usernames or who picks each track. Others never see photos or texts it rejects; Anthropic keeps what it receives in the United States, under its own terms.
• Cloudflare: serves this website.

The music services (Apple, Spotify, YouTube, TIDAL and Deezer) receive only searches and track data, never your identity. When you play a preview or see a cover, your device downloads it directly from Apple, which receives your IP address. If you open a track on a platform, that platform’s policy applies.

Your data is transferred to the United States and to Colombia, and Anthropic may process it in other countries. For people in the European Economic Area, those transfers rely on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. Transfers from Colombia comply with article 26 of Law 1581 of 2012.

How long we keep data

• Your account and activity data, for as long as you have an account.
• If you ask us to delete it, we delete or anonymise your data within 30 days, as Deleting your account explains.
• Technical logs, 30 days.
• Backups roll over within 30 days, and deleted data goes with them.

We may keep longer what a law requires us to keep, and only for that purpose.

Your rights

You can access, update and correct your data; ask us to delete it; object to its processing or ask us to restrict it; receive it in a portable format; and withdraw your consent or authorisation at any time.

To exercise them, write to [email protected] from your account’s email address. We answer queries within 10 business days and complaints within 15, and always within the month the GDPR sets.

If you disagree with our answer, you can turn to Colombia’s Superintendence of Industry and Commerce. If you live in the European Economic Area, you can also complain to your country’s data protection authority; in Spain, the Spanish Data Protection Agency.

Deleting your account

To delete your account, write to [email protected] from your account’s email address with the subject “Delete my account”. You don’t need the app installed. We’ll confirm the request and complete it within 30 days.

• We delete your sign-in account, with your email address, password and phone number.
• We delete your username, name, photo, bio, gender and preferred platform.
• The tracks, votes, notes and messages you shared stay in your groups’ history under an anonymous member’s name, so other people’s battles stay intact.

Children

Melomany is for people aged 16 and over. If your country’s law sets a higher age for consenting to data processing, such as 18 in Colombia, you need the authorisation of a parent or legal guardian. If we learn we’re processing a minor’s data without that authorisation, we delete it. If you’re a parent or guardian and think this is the case, write to us.

Cookies and this website

This website uses no cookies or analytics. Cloudflare serves it and processes your IP address to deliver and protect it. On your device, the app stores only your sign-in session and the theme you choose.

Changes to this policy

If we change this policy, we’ll update the date above. If the change is significant, we’ll tell you in the app before it applies.