Privacy Policy

Last updated: 2 June 2026 · Version 1.0

1. Controller

[Legal entity / Name], [Address], email: datenschutz@saveitup.app.

2. What this is about

Spin is a social music app: you share one song per day, follow friends and see their posts. We only process the data needed for this function. We do not sell data, run no tracking and show no ads.

3. What data we process

• Account: email address, password (stored only as a hash by our auth provider), username, display name, optional bio, optional phone number (voluntary, only for contact matching; never visible to other users).
• Profile picture: only if you upload one.
• Content: your daily song (metadata such as title, artist, ISRC), your captions, comments, likes, follows, your streak.
• Technical: timestamps of your posts. Server logs of the backend provider (for operational security).

We collect no location data and no advertising IDs.

4. Purposes and legal basis

Processing to perform the user agreement (Art. 6(1)(b) GDPR): login, display of your profile, your friends' feed, social features. Security and abuse prevention (reporting/blocking) on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

5. Processors and third-party services

• Supabase (backend, auth, database, storage) — region Frankfurt/EU. A data processing agreement is in place. [Link/confirmation]
• Apple — app delivery via the App Store; retrieval of track metadata and 30-second previews via the iTunes Search API.
• Deep links: when you tap a song you open Spotify or Apple Music. From that moment their privacy policies apply. Spin transmits no personal data to these services in the process.

Currently no analytics or crash-reporting service is active. Should this change, we will update this policy before activation.

5a. Finding friends via contacts (optional)

If you choose "Search contacts" during onboarding, we ask for access to your contacts. The email addresses and phone numbers of your contacts are turned into checksums on your device using SHA-256 (phone numbers are first normalized to the uniform E.164 format); we send only these checksums to our matching function, which compares them against the accounts of registered users. We store neither your contacts nor the checksums — the matching happens in memory and is discarded immediately.

If you enter a phone number in your own profile, we store it solely so that your contacts can find you: as plain text (visible only to you) and as a checksum for matching. Other users never see your number. You can remove it again at any time in your profile.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you grant via the permission dialog and can withdraw at any time in the iOS settings.

6. Retention and deletion

We store your data for as long as your account exists. You can delete your account at any time in the app (Settings → Delete account). This removes your profile, your posts, comments, likes and follows. Statutory retention obligations remain unaffected.

7. Your rights

Access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). Contact: datenschutz@saveitup.app. You have the right to lodge a complaint with a supervisory authority.

8. Minors

Spin is not directed at children under 16. We do not knowingly collect data from children below this age.

9. Changes

We update this policy as needed. The current version is available in the app and at spin.1020.dev/privacy.