Privacy Policy

The policy in one minute

• We're Songbestie, run by Mina Nasralla in Berlin, Germany, and we're responsible for your data. You can reach us at support@songbestie.com.
• You sign in with Apple or Google. We get your e-mail address (or Apple's private relay address) and an account ID from them. We never see a password.
• Your music taste is public on purpose. Your username, display name, photo, bio, Top 10, honourable mentions, Descriptions, Stuck-on songs and posts can be seen by anyone on Songbestie.
• Some things are private. Your Self notes and your birthday are only for you. Messages and private clubs are only for the people in them.
• We compare Top 10 lists to show taste matches and Twins, and we compare friends' Stuck-on history for Crossed paths. We don't use your messages, Self notes or birthday for any of that.
• We don't sell your data, we don't show ads, and we don't share your data for advertising. There are no analytics or tracking tools in Songbestie.
• Your data is stored in the United States by our hosting provider, Supabase.
• You're in control. You can download your data, correct it, delete things, delete your account in the app, and object to some uses of your data.
• Songbestie is for people aged 13 and over.
• If we change this policy in a way that matters, we'll tell you in the app first.

1. Who we are

1.1 Who is responsible. Songbestie is run by Mina Nasralla, an individual based in Berlin, Germany ("we", "us"). We are the "controller" of your personal data. That means we decide why and how it's used, and we're responsible for protecting it. Our postal address is in the Legal notice at songbestie.com/legal-notice.

1.2 How to reach us about privacy. Write to support@songbestie.com, or use Settings → Help & legal → Contact us in the app. We answer in English and German.

1.3 Representatives. We're established in the European Union, so we don't need a representative in the EU. We haven't appointed a representative in the United Kingdom.

1.4 Data protection officer. We haven't appointed a data protection officer, because the law doesn't require one for a service of our size and kind. Write to support@songbestie.com with any privacy question.

2. What this policy covers

This policy explains how we handle personal data when you use the Songbestie apps for iPhone and Android, our website at songbestie.com, and when you contact us. "Personal data" means information about you as an identifiable person.

It doesn't cover other companies' services that Songbestie links to or works with, such as Apple Music, the App Store, Google Play, or YouTube. Those companies have their own privacy policies (see section 8.3).

3. Who sees what

Songbestie is built around sharing music taste, so a lot of it is public. Here's the overview. Section 4 has the details.

Anything public can be seen and copied by others, for example with a screenshot, and we can't control what happens to it after that.

4. What we collect, feature by feature

For each feature, we explain what we collect, why, our legal basis under European data protection law (the GDPR and the UK GDPR), and how long we keep it. Section 5 puts the legal bases together in one table, and section 10 does the same for how long we keep things.

4.1 Creating your account and signing in

What we collect. When you sign in with Apple or Google, we receive an account identifier from them and the e-mail address linked to your Apple or Google account. With Apple, you can choose to hide your e-mail address, and then we receive a private relay address that Apple forwards to you. Apple and Google may also send your name, and Google may send the address of your Google profile picture; Songbestie doesn't use them for your profile. We also record which version of our Terms you accepted and when, and the date your account was created.

The sign-in page. When you choose Google or Apple, the app opens their sign-in page. On the way, it may pass through our website, songbestie.com, which only forwards you to the sign-in page and keeps nothing.

Apple's sign-in token. When you sign in with Apple on an iPhone, Apple gives the app a one-time code. Our server exchanges it with Apple for a token. We keep that token on our server, where no one using Songbestie can read it, and we use it for one thing only: when you delete your account, we ask Apple to remove the link between your Apple ID and Songbestie. It's deleted with your account.

Before you sign up. You can start building your Top 10 before you create an account. Until you create an account, that draft stays on your phone and isn't sent to us.

Why. To create your account, let you sign in safely, keep your account yours, and show that you accepted our Terms.

Legal basis. Performance of our contract with you (the Terms). For the record of your acceptance, our legitimate interest in being able to show what you agreed to.

How long. For as long as you have an account. If you start signing in but never finish creating your account (you never choose a username), we keep what we received until you finish, or until you ask us to delete it.

4.2 Your profile

What we collect. Your username, display name, profile photo and bio, whichever of these you add.

Why. So people can recognise you, find you and follow you.

Legal basis. Contract.

Who sees it. Anyone using Songbestie. Photos are stored as public files: anyone who has a photo's web address can open it.

How long. Until you change it or delete your account. Your username can't be changed once chosen. After you delete your account, we keep the username itself (and nothing else about you) so it's never given to someone else. That's in our legitimate interest in preventing impersonation.

4.3 Your Top 10, honourable mentions and the changes log

What we collect. The songs in your Top 10 and their ranks, your honourable mentions (ranked or not), and a log of the changes you make, such as which song you added, moved or removed and when. From that log, Songbestie can show the songs that were once in your Top 10 and the day each one first came in. For each song, we store details such as its title, artist, album and Apple's identifier, and for a song you add by hand, the title and artist you typed.

Why. Your Top 10 is the heart of Songbestie. We use it to show your profile, to work out taste matches and Twins (section 4.6), to show song and album statistics, and to show your changes log.

Legal basis. Contract. For matching, Twins and statistics, our legitimate interests (see section 4.6).

Who sees it. Your Top 10 and honourable mentions are public. Your changes log is only for you.

How long. Until you delete it or your account. The changes log is designed as a lasting memory, so we don't erase old entries on our own. If you delete your account, it's deleted too.

4.4 Descriptions and Self notes

What we collect. The public Description you write for a song, and the private Self note you write for it.

Why. Descriptions let you tell people what a song means to you. Self notes are your private diary of your songs.

Legal basis. Contract.

Who sees it. Descriptions are public. Self notes are only for you. We don't use them for matching, suggestions, statistics or anything else. Our moderators don't read them unless the law requires it.

How long. Until you delete them or your account.

4.5 Stuck on and your Stuck-on history

What we collect. The songs you mark as stuck on (up to ten at a time, each for seven days unless you renew it), when you added, renewed or removed each one, and your time zone, so each song lands in the right month of your history.

Why. To show what you're stuck on now and by month, to tell people who have that song in their Top 10, and for Crossed paths (section 4.7).

Legal basis. Contract. For telling other people and for Crossed paths, our legitimate interests.

Who sees it. Anyone: both the songs you're stuck on now and your history.

How long. Until you delete them or your account.

4.6 Twins and taste match

What we do. We compare your Top 10 with other people's Top 10 lists. The more songs you share, and the closer their ranks, the higher your taste match. The people with the highest matches are your Twins, and we may tell two people when they become each other's closest match. We also use taste matches to order lists of people, such as followers, following, friends and search results. This is a form of profiling: we're using your list to work out how similar your taste is to other people's.

What it uses. Only the songs in Top 10 lists and their ranks. It doesn't use your messages, Self notes, birthday, location or anything else about who you are. Matches are worked out when they're shown, and we don't store them.

Why. Finding people with the same taste is what Songbestie is for.

Legal basis. Our legitimate interests in providing the core feature people join Songbestie for. We've weighed this against your interests: the matching uses only lists you've chosen to make public, it reveals only a percentage and a ranking, and it has no legal or similarly significant effect on you. You can object to it (section 6).

Who sees it. The person looking at your profile sees your match with them. Your Twins appear in your Twins list, and you appear in the Twins lists of people whose taste is closest to yours, unless you switch off "Show me in Twins" in Settings → Privacy & notifications → Privacy.

4.7 Crossed paths

What we do. When you and someone become friends on Songbestie, we compare your Stuck-on history with theirs. If you were both stuck on the same song at the same time, we save that as a notification for both of you.

What it uses. Only the two friends' Stuck-on histories, and only the shared song and roughly when are kept.

Why. It's a small, warm surprise about a shared moment in your music lives.

Legal basis. Our legitimate interests in offering this feature. It looks only at two people who have both chosen to be friends, it reveals only a song you both had and roughly when, and it reveals nothing to anyone else.

If you'd rather not. Write to support@songbestie.com, and we'll delete your Crossed paths results.

How long. For as long as both accounts exist.

4.8 Following, friends and requests

What we collect. Who you follow, who follows you, your friends, and friend requests you've sent, received, accepted or declined.

Why. To build your Home, your friends list and your notifications, and to decide who can message you without a request.

Legal basis. Contract.

Who sees it. Followers, following and friends lists are public, except to people you've blocked. Pending requests are seen only by the two people involved.

How long. Until you change them or delete your account.

4.9 Posts, comments, likes, saves and songs you send

What we collect. Posts you write (words and songs), the club you post them to, comments, replies, likes, the posts and songs you save, and songs you send to people, including who sent them and who received them.

Why. To publish and show your posts and comments, count likes, keep your saves, and show you what was sent to you and by whom. Home shows posts from the last 60 days: first from people you follow, then from clubs you've joined, then from everyone else, newest first in each group. It isn't ordered by taste, and it leaves out people you've muted and posts you marked as not for you.

Legal basis. Contract.

Who sees it. Posts and comments are public. Your saves are only for you. Songs sent in messages are seen only by the people in the conversation.

How long. Until you delete them or your account. If you hide the comments on your post, they're hidden, not deleted.

4.10 Song clubs and album clubs

What we collect. The clubs you join and post in, your up and down votes on an album's songs, your guesses (for example, guessing the fans' #1 in a new album's first week), and the posts you mark as not interesting to you.

Why. To run the clubs, rank an album's songs honestly from everyone's votes, and show results and statistics.

Legal basis. Contract.

Who sees it. Club posts are public. Votes are counted with everyone else's, and only the totals are shown. Your own votes are shown only to you.

How long. Until you remove them or delete your account. When your account is deleted, your votes are removed from the totals. The ranking frozen at the end of an album's release week keeps its totals, which no longer link to anyone.

4.11 Private clubs

What we collect. The club's name and photo, who created it, its admins and members, the order members joined in, and everything sent in it.

Why. To run the group chat for its members.

Legal basis. Contract.

Who sees it. Only the members. Members can see who else is a member, and who the admins are.

How long. Messages: see section 4.12. If you leave a private club, the messages you sent stay in the club for the other members. If the last admin leaves, the member who has been in the club longest becomes admin. If you delete your account, see section 10.2.

4.12 Messages

What we collect. The messages and songs you send and receive in one-to-one chats and private clubs, message requests, when messages were sent, whether a message was edited, whether it was deleted, when someone marks a song as listened, and the date and words set on any song locked with Open when….

Why. To deliver your messages and keep your conversations.

Legal basis. Contract.

How messages work.

• By default, only your friends can message you. Anyone else can send a message request, holding one message and one song, until you accept. You can change both in Settings → Privacy & notifications → Privacy.
• You can edit a message within 15 minutes of sending it. People in the chat see that it was edited. We keep only the latest version.
• You can delete a message for everyone within two days of sending it. Its words and song are removed from our live systems, and the chat shows "This message was deleted" in its place.
• You can delete a chat or a message for yourself. It disappears for you, and the other people keep their copy.
• Listened marks are seen by the person who sent the song.
• A song locked with Open when… is stored with its message and shown to the recipient on the date chosen.

Encryption. Messages are encrypted while travelling to and from our servers, and our hosting provider stores them encrypted. They aren't end-to-end encrypted. That means we could technically access them.

When we look at messages. We don't read messages as a matter of routine. We may see them:

• when someone reports a person for inappropriate messages: the last five messages that person sent them in their one-to-one chat are attached to the report so a moderator can review them;
• when the law requires it, for example a valid order from a court or authority;
• when needed to protect someone's life or safety.

How long. Until they're deleted for everyone as described above, or until the conversation ends with no members left. If you delete your account, see section 10.2.

4.13 Your birthday

What we collect. If you choose to add it in Settings → Birthday: the day and month of your birthday. We never ask for or store the year.

Why. So Songbestie can gather the songs people send you on your birthday, grouped by year.

Legal basis. Your consent, which you give by adding your birthday. You can withdraw it at any time by removing your birthday in Settings.

Who sees it. Only you. We don't show it to anyone, and it's never used for matching, ads or to guess your age.

How long. Until you remove it or delete your account. Birthday songs you received stay with your messages.

4.14 Notifications and your phone

What we collect.

• A push token: a code from Apple or Google that lets us send notifications to your phone, with the kind of phone (iPhone or Android) and when it was added and last seen. We keep at most 20 per account.
• Your notification choices: which kinds you've switched on or off, the chats and clubs you've muted (for a while or always), and the people you've muted, whose posts and Stuck-on songs then leave your Home.
• Your notification history: the notifications we've shown you in Songbestie and whether you've read them.
• Your time zone, taken from your phone, so your Stuck-on months match your calendar.

We don't store your phone's model, operating system version or language.

Why. To send the notifications you want, show your notification history, and make sure Songbestie works on your phone.

Legal basis. Push notifications on your phone: your consent, given through your phone's permission prompt. You can withdraw it at any time in your phone's settings or in Settings → Privacy & notifications → Notifications. The notification history in Songbestie and your time zone: contract.

How long. Push tokens until you sign out, or until Apple or Google tell us the token no longer works. Notification history and choices for as long as you have your account.

4.15 Searching for music and playing previews

How it works. When you search for a song, the app sends what you typed and your phone's country to our server, which asks Apple Music's catalogue and sends back the results. Our server keeps results in memory for about ten minutes, so repeated searches are quick, and counts requests per IP address to stop abuse. We don't save your searches in our database. If our server can't answer, your phone asks Apple's iTunes Search service directly, and Apple then receives your phone's IP address and what you typed, as Apple's own privacy policy describes. Covers and 30-second previews load directly from Apple's servers, so Apple receives your phone's IP address when they load.

What we collect. When you add a song to a list, post or message, we store that song's details (section 4.3). Our servers also fetch Apple's song details and charts on their own, for example to fill in a new album, without sending any information about you.

Opening Apple Music or YouTube. When you tap the Apple Music badge, or open a YouTube search for a song added by hand, your phone opens Apple Music or YouTube. From there, Apple's or Google's privacy policy applies. We don't send them anything about you.

Legal basis. Contract.

4.16 Reports, blocks and moderation

What we collect.

• Reports: who reported what, the reason chosen, and, for a report of inappropriate messages, the last five messages the reported person sent in their one-to-one chat with the reporter (section 4.12).
• Notices from anyone about illegal content, including the sender's name and e-mail if given.
• Blocks and mutes.
• Moderation decisions: what was decided, by whom and when, and any request to look again and its outcome.
• Text stopped by our word filter isn't saved: the filter simply refuses it, and you see a short line saying so. The filter checks posts, comments, messages, private club names, display names, bios, Descriptions and usernames (Terms § 12.3).

Why. To keep people safe, enforce our Terms and Community Guidelines, handle reports and appeals, explain our decisions, and meet our legal obligations.

Legal basis. Our legitimate interests in keeping Songbestie safe and enforcing our rules, and compliance with legal obligations such as the EU Digital Services Act and the UK Online Safety Act.

Who sees it. Our moderators. The person you report isn't told who reported them. If we act on content, its author receives a statement of reasons.

How long. Reports and decisions: 12 months after the decision, or longer while an appeal, dispute or legal claim is open. If you delete your account, reports you made stay without your name. Blocks and mutes: until you remove them or delete your account. Where content is evidence of a serious crime, we may keep it as long as needed to pass it to the authorities.

4.17 When you contact us

What we collect. Your message, your contact details, and anything you choose to tell us or send us. E-mail to support@songbestie.com is forwarded by Cloudflare to our mailbox at Google (Gmail).

Why. To answer you and help with your request.

Legal basis. Contract or legitimate interests (helping you), and legal obligation when you exercise your privacy rights.

How long. Two years after our last exchange, unless we need it longer for a legal reason.

4.18 Keeping Songbestie safe and working

What we collect. Technical logs created when your phone or browser talks to our servers or our website, including your IP address, the time, the request made and any error. We also keep short-lived counters of actions to limit spam and abuse.

Why. To run Songbestie securely, prevent fraud, abuse and attacks, find and fix problems, and enforce limits.

Legal basis. Our legitimate interests in keeping Songbestie and its users secure.

How long. Server logs up to 7 days. Action counters 2 days.

4.19 If we offer paid features

If we offer paid features in the future, Apple or Google handles your payment. We don't receive your card details. We receive confirmation of what you bought, when, and whether it's still active, so we can give you what you paid for. Legal basis: contract, and legal obligations for tax and accounting records, which we keep as long as the law requires.

4.20 Downloading your data

You can get a copy of your data in Settings → Account → Download my data. The app makes one file with what belongs to your account, straight away, and you choose where to save or send it. We don't keep a copy of the file. Legal basis: legal obligation (your rights of access and portability).

5. Our legal bases, at a glance

European data protection law requires a legal reason for every use of personal data. Here are ours.

Where we rely on legitimate interests, our interest is running a safe, working music-taste service that does what people join it for. We've balanced that against your interests and rights. If you'd like to know more about how we weighed them, write to support@songbestie.com.

Where we rely on consent, you can withdraw it at any time, as easily as you gave it. That doesn't affect what we did before you withdrew it.

If you don't give us data. You need to sign in with Apple or Google and choose a username to use Songbestie. Everything else, including your birthday, photo, bio and notifications, is optional.

6. Your right to object

You can object at any time to our use of your data based on legitimate interests, including Twins, taste match, the ordering of lists of people, Crossed paths and notifications to other people about your lists, on grounds relating to your particular situation. Write to support@songbestie.com or use Settings → Help & legal → Contact us. We'll then stop that use, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. To leave other people's Twins lists right away, switch off "Show me in Twins" in Settings → Privacy & notifications → Privacy. We don't use your data for direct marketing, but if we ever did, you could object at any time, with no reasons needed.

7. Things we don't do

• We don't sell your personal data, and we don't share it with anyone for advertising.
• We don't show ads, and there are no advertising, analytics or tracking tools in Songbestie.
• We don't track you across other companies' apps or websites.
• We don't use your location. Songbestie doesn't ask for GPS or precise location.
• We don't read your contacts or upload your address book.
• We don't try to work out sensitive things about you from your music, such as your religion, politics, health or sexuality, and we don't sort people into groups like that. Music taste can say a lot about a person, so we keep it simple: we compare songs, not people.
• We don't use your content to train artificial intelligence models, and we don't let others do so.
• We don't use automated decisions that have legal or similarly significant effects on you. Our only automated moderation tool is a word filter that stops slurs and calls for violence against a group from being posted. A person makes every other moderation decision (Terms § 12.3).

8. Who we share data with

8.1 Other people on Songbestie

What other people can see depends on what you share and with whom (section 3).

8.2 Service providers who work for us

These companies process data on our behalf, under contracts that require them to protect it and use it only to provide their service to us:

The text of a push notification doesn't include the content of your messages.

8.3 Companies you connect with yourself

These companies are responsible for their own processing under their own privacy policies:

• Apple, when you sign in with Apple, download Songbestie from the App Store, play previews, load covers, or open Apple Music: https://www.apple.com/legal/privacy/.
• Google, when you sign in with Google or download Songbestie from Google Play: https://policies.google.com/privacy.
• YouTube (Google), when you open a YouTube search for a song added by hand: https://policies.google.com/privacy.

8.4 Legal reasons and safety

We may share data with courts, police, regulators or other authorities when the law requires it, to respond to valid legal requests, to protect someone's life or safety, to report suspected child sexual exploitation to the appropriate organisations, to defend legal claims, or to enforce our Terms. Where the law allows, we'll tell you before we share your data in response to a legal request.

8.5 If Songbestie changes hands

If Songbestie is sold, or moves to a company, your data may be transferred to whoever takes over Songbestie. It will remain protected by this policy, and we'll tell you before it becomes subject to a different one.

8.6 With your permission

We'll share your data in other ways only if you ask us to or agree to it.

9. Data stored or accessed outside your country

Our database is stored in the United States. Our hosting provider's contracting company is in Singapore, and some providers, and Apple and Google, are based in or access data from other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that doesn't have an adequacy decision, it's protected by the European Commission's Standard Contractual Clauses (and the UK addendum or Swiss equivalent), or by the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified. You can ask for a copy of the relevant safeguards at support@songbestie.com.

10. How long we keep data

10.1 The table

10.2 When you delete your account

You can delete your account at any time in Settings → Account → Delete my account, or by writing to support@songbestie.com from the e-mail address linked to your account if you no longer have the app (see songbestie.com/delete-account). When you confirm, straight away:

• if you signed in with Apple on an iPhone, we first ask Apple to remove the link between your Apple ID and Songbestie (section 4.1);
• your account, profile, photo, Top 10, honourable mentions, Descriptions, Self notes, changes log, Stuck-on history, posts, comments, likes, saves, votes, guesses, birthday, follows, friends, push tokens and notification history are deleted from our live systems;
• the messages you sent stay in the other people's chats, no longer linked to you;
• your votes leave the album rankings; a release-week ranking that was already frozen keeps its totals;
• private clubs you created stay for their other members;
• reports you made stay, no longer linked to you;
• your username is retired, never reissued.

Signing in with Google, or with Apple outside the iPhone app, leaves a link to Songbestie in your Google account or Apple ID. You can remove it there (on iPhone: Settings → your name → Sign in with Apple; for Google: myaccount.google.com → Security → Third-party connections).

10.3 Deleted messages and content

When you delete a message for everyone, a post or a comment, it's removed from our live systems straight away.

11. Your rights

11.1 Everyone. Wherever you live, you can:

• see and download your data: Settings → Account → Download my data;
• correct your data: edit your profile and lists in the app, or ask us;
• delete things: delete content in the app, or delete your account;
• change your choices: notifications, birthday, Twins, who can message you, and blocks, in Settings;
• ask us questions about your data at support@songbestie.com.

11.2 If you're in the EEA, the UK or Switzerland, you also have the right to:

• access your personal data and get a copy;
• rectification of inaccurate data;
• erasure ("the right to be forgotten");
• restrict our use of your data in some situations;
• data portability: receive the data you gave us in a machine-readable format, or have it sent to another company where that's technically possible;
• object to processing based on legitimate interests (section 6);
• withdraw consent at any time, where we rely on consent;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we don't make such decisions);
• complain to a data protection authority, in particular in the country where you live, work, or where you think the problem happened. A list of EU authorities is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, it's the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information. We'd appreciate the chance to sort things out with you first.

11.3 How to use your rights. Use the settings in the app, or write to support@songbestie.com. We may need to confirm it's really you, usually by asking you to write to us from the e-mail address linked to your account. We reply within one month. If a request is complex, we may need up to two more months, and we'll tell you if so. It's free, unless a request is clearly unfounded or excessive.

12. If you live in the United States

12.1 California

This section is our notice at collection and our privacy policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

Categories of personal information we collected in the last 12 months:

We don't collect precise geolocation, government identifiers, financial account details, biometric information, or information about protected characteristics such as race or religion.

Sale and sharing. We don't sell personal information, and we don't "share" it for cross-context behavioural advertising. We haven't done so in the past 12 months. We don't knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use it only to provide Songbestie and keep it secure, as the CCPA permits, and not to infer characteristics about you. So there's no need for a "limit the use" link.

Your California rights. You can ask to know what personal information we've collected about you, including the categories and specific pieces; ask us to delete it; ask us to correct it; and not be treated differently for using these rights. An authorised agent can make a request for you if you've given them written permission and we can verify your identity. Write to support@songbestie.com or use Settings → Help & legal → Contact us.

Retention. See section 10.

Shine the Light. We don't share personal information with third parties for their own direct marketing.

12.2 Other U.S. states

Several other U.S. states give residents privacy rights, such as rights to access, correct, delete and port data, and to opt out of targeted advertising, sale and certain profiling. We don't sell personal data or use it for targeted advertising, and we don't use profiling to make decisions with legal or similarly significant effects. You can use your rights by writing to support@songbestie.com. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We'll respond within the time your state's law requires, and tell you how to contact your state's attorney general if you're not satisfied.

12.3 Opt-out signals

Because we don't sell or share personal information for advertising, browser "Do Not Track" and Global Privacy Control signals don't change anything in how Songbestie works.

13. Teens and children

13.1 Songbestie is for people aged 13 and over, or older where local law sets a higher age (Terms § 2). We don't knowingly collect personal data from children under 13. If we learn that an account belongs to a child under 13, we'll delete it. If you're a parent or guardian and think your child under 13 has an account, please write to support@songbestie.com and we'll take care of it.

13.2 Protections for everyone, including teens. We don't ask for anyone's age, so the protections we've built apply to everyone:

• no ads, no selling of data, no tracking;
• no location;
• by default, only friends can message you; anyone else can only send a message request, holding one message and one song, until you accept;
• you can block, mute and report anyone;
• your birthday is only for you, and never includes a year;
• your e-mail address is never shown to anyone.

14. How we protect your data

• Data is encrypted in transit (TLS) between your phone and our servers. Our hosting provider encrypts stored data (AES-256).
• Every table in our database has access rules, so each person can only read and change what they're allowed to. The app has no administrator keys.
• Only the people who run Songbestie can access personal data, and only when their job requires it.
• Sign-in is handled by Apple and Google, so we never store passwords.
• We have a process to detect, handle and record security incidents. If a breach puts your rights at risk, we'll notify the authorities within 72 hours where required, and tell you without undue delay if the risk to you is high.

No system is perfectly secure. If you find a security problem, please tell us at support@songbestie.com.

15. Data stored on your phone

Songbestie stores some data on your phone so it can work, for example your sign-in session, your settings, your draft Top 10 before you create an account, and copies of screens so the app loads quickly. These are needed for the app to work, so we don't ask for separate consent for them. Songbestie has no advertising identifiers, no analytics and no tracking tools.

Our website at songbestie.com sets no cookies and uses no analytics.

16. Other countries

If you live outside Europe and the United States, you have the rights your local law gives you, and you can use them by writing to support@songbestie.com. For example:

• Brazil (LGPD): you can confirm whether we process your data, access, correct, anonymise, port or delete it, learn who we share it with, and withdraw consent. You can also petition the national authority (ANPD).
• Canada, Australia, and other countries: you can access and correct your data and complain to your national privacy regulator.

17. Changes to this policy

We may update this policy when Songbestie or the law changes. If a change matters, for example a new kind of data or a new use of it, we'll tell you in Songbestie before it takes effect, at least 30 days ahead where we can, and explain what's changing. Where a change needs your consent, we'll ask for it. For small changes, we'll update the date at the top. You can ask us for an earlier version at support@songbestie.com.

18. Contact and complaints

• Songbestie, Mina Nasralla, Berlin, Germany (full postal address: songbestie.com/legal-notice)
• Privacy questions and requests: support@songbestie.com
• In the app: Settings → Help & legal → Contact us

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can always complain to a data protection authority (section 11.2).

Last updated: 23 October 2026 · Effective: 23 October 2026