Privacy Policy

This privacy policy applies to the Relody app (hereby referred to as "Application") for mobile devices, created by Denys Merkulov (hereby referred to as "Service Provider") as a free service. This service is intended for use "AS IS". The Service Provider is registered with the Information Commissioner's Office (ICO) under registration number ZC169182.

Information We Collect

The Application collects the following categories of information:

Account & Identity

• Email address and display name (provided during sign-up)
• Profile photo (if uploaded)
• Authentication credentials managed by Firebase Authentication, including Google or Apple sign-in tokens where applicable

Content You Create

• Names, relationship types, and profile photos of people you add to the Application
• Occasions and dates you associate with people (e.g. birthdays, anniversaries)
• Notes — text content and images you attach to notes about people
• Song moments — songs and descriptions you record as memories
• Song metadata associated with people: song name, artist, album, album artwork URL, and a link to the song on Spotify
• Gift messages you send to friends within the Application
• Content reports you submit — if you report a gift message as inappropriate, we store the report reason alongside the identifiers of the reporter and the reported content, used solely for moderation purposes
• Activity metadata — a brief summary of your most recent note or song moment per person (e.g. a content snippet and timestamp), stored to display relationship recency indicators within the Application

Social & Friends

• Friend connections you establish with other Relody users
• A snapshot of your display name and profile photo stored alongside friendship records at the time a friendship is created

Spotify Integration (optional)

• Your Spotify user ID, stored to enable playlist creation on your behalf
• Spotify OAuth access and refresh tokens, stored securely on your device only and never transmitted to our servers
• Song search queries you enter, sent to our backend which queries the Spotify API

Song metadata (titles, artists, album artwork, and Spotify track links) is stored as part of your song moments and melodies. Disconnecting Spotify removes your account credentials but does not delete your saved song content.

Audio — Song Recognition (optional)

• When you use the song recognition feature, a short audio recording is captured from your microphone and sent to AudD (a third-party song recognition service) to identify the song. This audio is not stored by the Service Provider after the request completes.

Push Notifications

• Your device push notification token, stored to deliver connection reminders and occasion alerts

Usage & Device

• Your device's IP address
• Mobile operating system type and version

The Application does not collect precise geolocation data.

How We Use Your Information

• To create and maintain your account
• To provide the core features of the Application (relationship journaling, song associations, sharing)
• To send push notifications for connection reminders and upcoming occasions
• To enable music features: song search and playlist export via Spotify; audio preview lookup via iTunes
• To recognise songs via the microphone feature
• To communicate important service updates or respond to support requests
• To improve and maintain the Application

Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, the Service Provider processes your personal data under the following legal bases:

• Performance of a contract — account data, content you create, notifications, and core app functionality
• Legitimate interest — usage analytics to improve the Application, security monitoring
• Consent — Spotify account connection (you can disconnect at any time in Settings); push notification permission (you can revoke at any time in your device settings)

California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom it is shared
• Right to Delete — request deletion of personal information we have collected from you, subject to certain exceptions
• Right to Opt-Out — the Service Provider does not sell your personal information to third parties and has not done so in the preceding 12 months
• Right to Non-Discrimination — you will not receive discriminatory treatment for exercising your CCPA rights

To exercise these rights, contact us at relody.official@gmail.com. We will respond within 45 days of a verifiable request.

Third-Party Services

The Application uses the following third-party services. Each operates under its own privacy policy:

• Firebase / Google Cloud — authentication, database, file storage, and cloud functions
• Google — optional Google sign-in
• Apple — optional Sign in with Apple
• Spotify — music search and playlist creation; track search queries are sent to our backend which calls the Spotify API using application-level credentials (no personal Spotify account required for search)
• Apple / iTunes — the iTunes Search API is queried automatically to fetch audio preview URLs when you save a song; track name and artist are sent as a search query (no account required)
• AudD — song recognition from audio (only when you use the recognition feature)
• Expo — push notification delivery and over-the-air app updates

The Service Provider may also disclose your information:

• As required by law or to comply with legal process
• To protect the rights, property, or safety of the Service Provider, users, or others
• To other Relody users only to the extent necessary to provide social features you initiate (e.g. friend requests, gifts)

Data Retention

Your data is retained for as long as your account is active. When you delete your account through the Application (Settings → Delete Account), the Service Provider permanently deletes:

• Your account and profile data
• All people, notes, song moments, and occasions you created
• All images you uploaded
• Your friendship connections and sent/received gifts
• Your push notification token

Note: gift messages you sent to other users, and friendship snapshots stored in other users' accounts, may be retained in those accounts after you delete yours. Profile snapshots captured at the time of friending may persist in a friend's data even if you later update your profile.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data (most content can be edited directly in the app)
• Deletion — delete your account and all associated data via Settings → Delete Account, or by contacting us
• Data portability — download a copy of all your data (profile, people, notes, song moments, and more) in JSON format directly from the app via Settings → Download My Data. You may also request a copy by contacting us at relody.official@gmail.com
• Withdraw consent — disconnect Spotify in Settings at any time; revoke push notification permission in your device settings at any time
• Opt out — you can stop all data collection by uninstalling the Application

UK residents may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. EU/EEA residents may lodge a complaint with their local data protection supervisory authority.

Children's Privacy

The Application is not directed to children under the age of 13, and the Service Provider does not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information, please contact us at relody.official@gmail.com and any such data will be promptly deleted.

Security

The Service Provider implements reasonable technical and organisational measures to protect your data, including encrypted data transmission (HTTPS), Firebase security rules restricting data access to account owners, and secure on-device storage for sensitive credentials such as Spotify tokens. No method of transmission or storage is 100% secure, and the Service Provider cannot guarantee absolute security.

The Application uses Apple App Attest and Google Play Integrity (via Firebase App Check) to verify that requests to our backend come from a genuine, unmodified copy of the Application. This may share device-level integrity signals with Apple or Google; the Service Provider does not receive or store any additional personal data as part of this process.

Changes to This Policy

This Privacy Policy may be updated from time to time. For material changes, the Service Provider will provide notice within the Application or by email at least 14 days before the change takes effect. Continued use of the Application after the effective date constitutes acceptance of the revised policy.