Privacy Policy

Introduction

InSync ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App") and related services (collectively, the "Services").

Please read this Privacy Policy carefully. By using InSync, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

Information We Collect

1. Information You Provide Directly

Account Information:

• Email address
• Display name and username
• Profile picture/avatar (optional)
• User biography (optional)

User-Generated Content:

• Direct messages sent to other users
• Messages posted in song rooms (public chat spaces)
• Connection requests and social interactions

2. Information We Collect Automatically

Music Streaming Data:

When you connect your Spotify or Apple Music account, we collect and process:

• Currently playing track information (song name, artist, album, album artwork)
• Recently played tracks
• Top tracks (short-term and long-term)
• Top artists
• Music genre preferences and distribution
• Playback state (playing or paused)
• Play counts and listening statistics
• Music service profile information

Spotify: We access this data through Spotify's Web API using OAuth 2.0 authorization.

Apple Music: We access this data through Apple's MusicKit framework using user-authorized tokens.

Location Data:

With your explicit permission, we collect:

• Precise GPS coordinates (latitude and longitude)
• Location updates occur when you have a track playing and location sharing is enabled

You can control location sharing through the App's Privacy Settings. When disabled, your location is not collected or shared with other users.

Usage Data:

• Unique tracks played per day
• Total plays per day
• Active listening sessions
• Time spent in the App
• Features accessed within the App

Device and Technical Data:

• Device identifiers (for maintaining WebSocket connections)
• IP address
• Operating system and version
• App version
• Network connection type

Social Interaction Data:

• List of users you connect with
• Connection requests (sent and received)
• Timestamps of social interactions
• Online/offline status
• Unread message indicators

3. Information From Third Parties

Spotify:

We receive data from Spotify when you authorize our App to access your Spotify account, including your Spotify profile information, listening history and preferences, current playback information, and top tracks and artists.

Apple Music:

We receive data from Apple Music when you authorize MusicKit access, including your Apple Music subscription status, listening history and preferences, current playback information, top tracks and artists, and music library data.

We do not sell or share your music streaming data with third parties for advertising or marketing purposes.

How We Use Your Information

Core App Functionality

• Display your currently playing track to other users
• Show your location on the live listener map (when enabled)
• Enable real-time discovery of nearby listeners
• Create personalized listening statistics and insights
• Facilitate social connections with other users
• Enable direct messaging and song room chat features
• Provide notifications about listeners and connections

Service Improvement

• Analyze usage patterns to improve App features
• Identify and fix technical issues
• Develop new features based on user behavior
• Optimize performance and reliability

Communication

• Send you updates about your account
• Respond to your support requests
• Notify you about important changes to our Services
• Send real-time notifications about App activity (new connections, messages, etc.)

Security and Safety

• Authenticate your identity
• Prevent fraud and abuse
• Enforce our Terms of Service
• Protect the rights and safety of our users

How We Share Your Information

With Other Users

Publicly Visible Information:

• Your profile information (name, username, avatar, bio)
• Your currently playing track (when you have music playing)
• Your location on the map (only when "Show Location" is enabled in Privacy Settings)
• Your online status (when "Show Online Status" is enabled)
• Your listening statistics (when "Show Stats" is enabled)

With Connected Users:

• Direct messages you send
• Your connection status

In Song Rooms:

• Messages you post are visible to all room participants
• Room participation is visible to other room members

With Third-Party Service Providers

We share information with trusted service providers who assist us in operating the App:

Spotify: We authenticate with Spotify using OAuth 2.0. Spotify processes your music data according to their Privacy Policy. We do not share your InSync activity data back to Spotify.

Apple Music: We authenticate with Apple Music using MusicKit authorization. Apple processes your music data according to their Privacy Policy. We do not share your InSync activity data back to Apple.

Hosting Provider (Railway): Our backend servers are hosted on Railway infrastructure. Data is stored on servers located in the United States. Railway may have access to user data as part of hosting services.

WebSocket Service: Real-time communication infrastructure for live updates, handling listener count updates, messages, and notifications.

As Required by Law

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Requests from law enforcement or government agencies
• Protection of our rights, property, or safety
• Protection of the rights, property, or safety of our users or the public

Business Transfers

If InSync is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

Data Retention

We retain your information for as long as your account is active or as needed to provide you Services.

• Account Data: Retained until you delete your account. Some data may be retained in backups for up to 90 days after deletion.
• Messages: Direct messages are retained indefinitely unless you delete them. Song room messages are retained for the lifetime of the room.
• Listening History: Daily statistics reset at midnight (UTC). All-time statistics are retained throughout your account lifetime.
• Location Data: Real-time location is only used for current session display. Historical location data is not permanently stored. Location data is removed from active display when you stop playing music.

You may request deletion of your account and associated data at any time through the App's Settings or by contacting us at support@insync-live.app.

Your Privacy Rights and Controls

Additional Rights

Depending on your location, you may have additional rights:

• Access: You can request a copy of your personal data
• Correction: You can update or correct your information in the App
• Deletion: You can request deletion of your account and data
• Portability: You can request a copy of your data in a portable format
• Objection: You can object to certain processing of your data
• Withdraw Consent: You can disconnect your Spotify or Apple Music account at any time

To exercise these rights, contact us at support@insync-live.app.

Data Security

We implement appropriate technical and organizational security measures to protect your information:

Encryption:

• All data transmitted between the App and our servers uses HTTPS/TLS encryption
• WebSocket connections use WSS (secure WebSocket) protocol
• Sensitive authentication tokens are stored in iOS Keychain with hardware-backed encryption

Authentication:

• OAuth 2.0 for Spotify integration
• MusicKit authorization for Apple Music integration
• Token-based authentication for API requests
• Automatic session expiration

Access Controls:

• Limited employee access to user data
• Database access restricted to authorized personnel
• Regular security audits and updates

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Children's Privacy

InSync is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information from our systems.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

By using InSync, you consent to the transfer of your information to the United States and other countries where we operate. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

Third-Party Links and Services

The App integrates with Spotify and Apple Music and may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with any information.

• Spotify: Your use of Spotify services is governed by Spotify's Privacy Policy
• Apple Music: Your use of Apple Music services is governed by Apple's Privacy Policy

California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: We do not sell your personal information. If we ever do, you will have the right to opt-out.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, email us at support@insync-live.app.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing:

• Consent: Processing your music streaming data (Spotify/Apple Music) and location data
• Contract Performance: Providing the Services you requested
• Legitimate Interests: Improving our Services and preventing fraud

Your Rights:

• Right to access your data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights or for GDPR-related questions, contact us at support@insync-live.app.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

Notification of Changes:

• We will notify you of material changes by updating the "Last Updated" date
• Significant changes will be announced through the App or via email
• Continued use of the App after changes constitutes acceptance

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Do Not Track Signals

Our App does not currently respond to "Do Not Track" signals from browsers or devices. We may adopt a standard for responding to such signals in the future.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@insync-live.app

For privacy-specific inquiries, please include "Privacy Policy" in your email subject line.

Consent

By using InSync, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.