Privacy Policy for Soundtrak

Introduction

Welcome to Soundtrak ("we," "our," or "us"). We are committed to protecting your privacy and being transparent about how we collect, use, and share your information. This Privacy Policy explains how Soundtrak handles your data when you use our iOS app.

Soundtrak is an innovative music app that creates personalized, adaptive soundtracks based on your real-time context—including your location, activity, health metrics, and calendar events. To deliver this unique experience, we need to collect various types of data from your device and sensors. This policy explains what we collect, why we collect it, and how we protect your privacy.

Information We Collect

1. Personal Information

When you sign in to Soundtrak, we collect:

• Email address - Used for account authentication and communication
• Full name - Collected via Google OAuth for personalization
• User ID - A unique identifier for your account

2. Location Data

To create music that reflects your environment and journey, we collect:

• Precise GPS coordinates (latitude, longitude)
• Altitude and elevation changes
• Speed and direction of travel
• Compass bearing (direction you're facing)
• Journey tracking data including:
  • Origin and destination points
  • Travel patterns (direct route, exploring, commuting, returning)
  • Significant places you visit frequently
  • Distance traveled
  • Time spent at locations

3. Health & Fitness Data (via HealthKit)

With your permission, we access:

• Heart rate data (current, average, resting, variability)
• Workout information (type, duration, intensity)
• Step count and walking/running distance
• Active calories burned
• Exercise minutes
• Activity level (sedentary to extremely active)

4. Calendar Data

With your permission, we access:

• Current and upcoming events (titles, times, locations)
• Recent past events for context
• Event details (whether events have attendees, are all-day events)
• Calendar names (e.g., "Work," "Personal")
• Event patterns (how busy your day is compared to typical)

5. Motion & Sensor Data

To detect your activity and create matching music:

• Activity type (walking, running, cycling, driving, stationary)
• Motion data (accelerometer, gyroscope, magnetometer readings)
• Device orientation (pitch, roll, yaw)
• Step count and cadence (steps per minute)
• Barometric pressure (for altitude detection)

6. Environmental Data

To create contextually appropriate music:

• Weather conditions via OpenWeatherMap API (temperature, humidity, conditions, wind speed, visibility)
• Time of day (early morning, morning, afternoon, evening, night)
• Ambient light level (inferred from screen brightness)

7. Device & System Data

For optimal app performance and user experience:

• Battery level and charging state
• Low Power Mode status (to adjust sensor accuracy)
• Device orientation (portrait/landscape)
• Screen brightness
• Audio output route (speaker, headphones, Bluetooth, CarPlay)
• System volume
• Network type (WiFi, cellular, offline)
• Timezone and locale

8. Usage Data

To provide and improve our service:

• Songs generated (prompts, lyrics, titles, album art URLs)
• Music generation preferences (genre, mood, energy level)
• Audio source/model used (which AI model generated the music)
• Liked/disliked songs
• Daily usage minutes (for subscription management)
• Generation context (sensor data snapshot used for music generation)

9. Transaction Data

For in-app purchases:

• StoreKit transaction information (transaction IDs, product IDs)
• Subscription status (free, subscribed, grace period, expired)
• Subscription expiration dates

How We Use Your Information

We use the collected information to:

Data Sharing & Third-Party Services

To provide Soundtrak's functionality, we share certain data with trusted third-party services:

Data Storage & Security

Where We Store Your Data

• Supabase Database: User accounts, songs, preferences, usage tracking
• Local Device Storage: User settings, cached sensor data
• Temporary Processing: Sensor data is processed in real-time and not permanently stored unless part of a song's generation context

Security Measures

We implement industry-standard security practices:

• Encryption in transit: All data transmitted to our servers uses HTTPS/TLS encryption
• Encryption at rest: Database is encrypted using Supabase's security standards
• Authentication: JWT-based authentication with Google OAuth
• API Keys: All third-party API keys are stored securely in backend environment variables, never in the app
• Row-Level Security: Database queries are restricted to your own data via Supabase RLS policies
• Rate Limiting: API endpoints are rate-limited to prevent abuse

Data Retention

• Active accounts: Data is retained while your account is active
• Generated songs: Stored until you delete them
• Usage tracking: Daily usage records retained for billing purposes
• Sensor data: Real-time data is not permanently stored; only snapshots used for music generation may be saved as optional "generation context"
• Deleted accounts: All user data is permanently deleted within 30 days of account deletion

Your Privacy Rights & Choices

iOS Permission Controls

You control what data Soundtrak can access:

Account Data Rights

You have the right to:

Marketing Communications

We do not send marketing emails. All communications are service-related (e.g., subscription renewal reminders, important updates).

Region-Specific Rights

California Residents (CCPA)

If you are a California resident, you have additional rights:

• Right to Know: Request details about the personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of "sale" of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at [support email].

European Residents (GDPR)

If you are in the European Economic Area, UK, or Switzerland, you have additional rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw permission for data collection

Legal Basis for Processing:

• Consent: We collect health, calendar, and location data based on your explicit consent
• Contract Performance: We process account and usage data to provide our service
• Legitimate Interests: We process technical data to improve app performance

To exercise these rights or contact our Data Protection Officer, email [support email].

Children's Privacy

Soundtrak is not intended for users under 13 years old. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at [support email], and we will delete the information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or in-app notification
• Your continued use of Soundtrak after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Compliance & Certifications

Soundtrak is committed to compliance with:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Apple App Store Privacy Guidelines
• HealthKit Data Use Guidelines

About Data Minimization

While Soundtrak collects extensive sensor data to create personalized music, we practice data minimization:

• Most sensor data is processed in real-time and discarded after music generation
• We only store what's necessary for core functionality (songs, preferences, usage limits)
• You can use Soundtrak with minimal permissions, though this reduces personalization
• Raw sensor data is not shared with third-party AI services; only processed, anonymized context descriptions are sent

Your Privacy Matters

We built Soundtrak with privacy in mind. All sensor data collection is transparent, optional (via iOS permissions), and used solely to enhance your musical experience. We never sell your data, and we give you full control over what information we access.

If you have any concerns about how we handle your data, please don't hesitate to contact us. We're here to help.