Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains how Reprised collects, uses, and protects your information when you use the Reprised application and website (the "Service").

1. Who is responsible for your data

Reprised is operated by Bastian Dave Bustamante Salkeld ("we", "us"), Buenos Aires, Argentina, who is the data controller for the personal data described here. Contact: support@reprised.app.

2. Information we collect

Account information: your email address, username, display name, and optional profile details you provide (bio, city, country, social link). If you use Sign in with Apple, we receive the email address Apple shares with us, which may be a private relay address.
Profile images: a profile picture and banner image, if you upload them.
Approximate location: only if you allow it in the app, used solely to tell you about live events near you. A city you type on your profile always takes priority over it, it is never shown to other users, and you can turn location access off in your phone's settings at any time.
Activity: the music you log, ratings, reviews, lists, favourites, follows, and similar in-app actions.
Device & usage data: basic technical information such as device type, app version, time zone, push-notification token, and IP address in server logs, used to operate, secure, and improve the Service. We do not use advertising identifiers or third-party analytics or advertising trackers.
Payment information: handled by our payment providers. Purchases through the Apple App Store or Google Play are processed by Apple or Google; web purchases are processed by Lemon Squeezy. We do not store your card details; we receive limited information such as subscription status, plan, a customer reference, and country.

3. Why we use it, and our legal basis

If you are in the EU, the UK, or another place with similar laws, we must have a legal basis for each use:

Running your account and the Service (diary, ratings, reviews, lists, follows, recommendations, social features, account email such as password resets): performance of our contract with you (GDPR Art. 6(1)(b)).
Subscriptions, billing, and support: contract, and legal obligation for tax and accounting records (Art. 6(1)(b) and (c)).
Live events near you from your device location, and push notifications: your consent, given in your phone's permission prompt and withdrawable there at any time (Art. 6(1)(a)).
Newsletter and offers: your consent (Art. 6(1)(a)); see section 4.
Reminder and re-engagement email about your own activity (for example a welcome email or a reminder that friends reviewed albums you logged): our legitimate interest in helping you get value from the Service (Art. 6(1)(f)). You can switch these off in Settings or via the link in each email.
Security, abuse prevention, and moderation (bot protection, screening uploaded profile images, enforcing our Terms): legitimate interest in keeping the Service safe (Art. 6(1)(f)).
Complying with law and answering lawful requests: legal obligation (Art. 6(1)(c)).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Marketing emails

Separately from the account and service messages described above, you can choose to receive our newsletter. It is optional, off by default, and never required to use the Service.

What it contains: music recommendations, artist features, product news, and offers. Some artist features and offers are paid placements funded by labels, artists, or their representatives. Every paid placement is clearly labelled as sponsored inside the email.
How we obtain consent: only when you actively tick the newsletter box while creating an account, or turn it on later in Settings. The box is never pre-ticked, and we never add you without that action.
How to stop: switch off "Newsletter and offers" in Settings, or use the unsubscribe link in any newsletter. Withdrawing consent is as easy as giving it.
Who delivers it: we use Resend as our email provider. Your address is shared with them solely to deliver these messages. We do not sell or rent your email address, and advertisers never receive your personal data: sponsors buy placement in the newsletter, not access to you.

Turning the newsletter off does not affect essential account email such as password resets and security notices.

5. How we share it

We do not sell your personal information and do not share it for advertising. We share data only with service providers that process it on our behalf under data processing agreements, and only as needed for their task:

Supabase: database, authentication, file storage, and server functions.
Resend: delivery of account email (such as password resets) and, if you opt in, the newsletter.
Apple and Google: app distribution, in-app subscriptions, Sign in with Apple, and delivery of push notifications.
RevenueCat: subscription status and entitlement management.
Lemon Squeezy: merchant of record for subscriptions purchased on the web. As merchant of record, Lemon Squeezy is also responsible for the payment data it collects at checkout under its own privacy policy.
Cloudflare: bot protection (Turnstile) on the sign-up and sign-in forms. Cloudflare receives your IP address and basic device signals in order to tell people apart from automated traffic.
Anthropic: generation of the AI-written background material described in our Data Sources & Acknowledgements, and automated screening of uploaded profile images for content that breaches our Terms. Screening sends the image only, and it is not used to train models.
images.weserv.nl: an image-resizing proxy used to deliver avatars and artwork efficiently. It receives your IP address and the address of the image being loaded.
YouTube (Google): videos on album and artist pages are embedded in YouTube's privacy-enhanced mode and load only when you open a video. YouTube then receives your IP address; its handling is governed by the Google Privacy Policy. The website serves its typefaces itself; older versions of the mobile app load typefaces from Google Fonts, which receives your IP address.
Vercel: hosting and delivery of the web app, including standard server logs.
Providers of music metadata, artwork, and content used to display information in the app receive search terms and IP addresses, not your account details. See our Data Sources & Acknowledgements.

We may also disclose information where required by law or to protect rights and safety. Public content you choose to post (your profile, reviews, ratings, and lists) is visible to other users and, on the web, to anyone.

6. Cookies & local storage

We use local storage and similar technologies only to keep you signed in, remember preferences, and cache content for performance. These are strictly necessary for the Service, so they do not need consent. We do not use analytics or advertising cookies. Third-party content (YouTube videos, the web checkout, and bot protection) may set its own cookies when it loads.

7. Data retention

Account and activity data: kept while your account exists, deleted when you delete it (see below).
Backups: deleted data can remain in encrypted database backups for up to 14 days, after which those backups are overwritten.
Server and request logs (which include IP addresses): kept for up to 30 days.
Device location: only the latest position is stored; it is overwritten each time and deleted with your account.
Subscription and invoice records: kept as long as tax and accounting law requires (usually several years), by us and by the payment provider.
Support and privacy requests: kept for up to 3 years to show that we handled them.

Deleting your account

In the app: open your profile, tap the settings (gear) icon, then Deactivate account. This permanently deletes your account and everything in it (your reviews, ratings, lists, diary, and follows) immediately, and cannot be undone.
Without the app: email support@reprised.app from the email address on your account with the subject "Delete my account". We will delete the account and its data within 30 days and confirm by email.
Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel it in that store's subscription settings.

8. Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and get a copy of it;
correct it (most of it you can edit yourself in the app);
delete it (see "Deleting your account");
receive it in a portable format (a machine-readable file of your account data, logs, ratings, reviews, and lists);
object to processing based on legitimate interest, and restrict processing in certain cases;
withdraw consent at any time, without affecting processing before the withdrawal.

To use any of these rights, email support@reprised.app with the subject "Privacy request" from the email address on your account. We reply within one month. It is free.

You also have the right to complain to a data protection authority, in particular in the country where you live or work. In the EU, see the list at edpb.europa.eu; in the UK, the Information Commissioner's Office (ico.org.uk); in Peru, the Autoridad Nacional de Protección de Datos Personales; in Argentina, the Agencia de Acceso a la Información Pública. We'd appreciate the chance to sort it out with you first.

9. Security

We use technical and organizational measures to protect your information, including encryption in transit, database access rules that limit each user to their own private data, and automated checks of those rules whenever the database changes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident is likely to affect your rights, we will tell you and the relevant authorities as the law requires.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

11. International transfers

We operate from South America, and our service providers process data mainly in the United States and the European Union. When personal data from the EU, the UK, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where relevant) or, for US providers certified under it, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

12. Changes

We may update this Policy from time to time. Material changes will be notified in-app or by email, and the "Last updated" date above will change.

13. Contact

Questions or requests: support@reprised.app.