Privacy policy

Who we are

MusMe is operated by Andrea Morachioli, Alexander Hidalgo, Andrei Balan and Damiano Corini. The controller is the members of the MusMe team, as joint controllers: Andrea Morachioli, Alexander Hidalgo, Andrei Balan and Damiano Corini. We decide the purposes and means of processing together and you can contact any of us; the single contact point for your rights is info@musme.app, where you can also ask for the essential terms of our arrangement. MusMe is available wherever the stores distribute it, except France. We have not appointed a Data Protection Officer (DPO).

Data we collect

Account: email address and password. The password is never stored in plain text: we only keep a cryptographic fingerprint of it.

Registration and legal updates: we keep the version, language, date and time of the terms you accept and the privacy policy you acknowledge at registration. When we show you an updated version, we separately record that you have seen both documents. These receipts record which texts were presented; they are not consent to the processing of personal data.

Profile: name, MusMe username, picture, bio and Instagram username, if you choose to add them. They are visible to other users, with the limits for people under 18 described below; your email and credentials are not.

Collection: albums and tracks you save, listening status, ratings, notes, reviews and lists. Reviews and lists stay private until you choose to publish them; notes and ratings stay private until you publish the review.

Recent items: we store the last eight profiles, albums or tracks you open from search on your device only, so you can find them again. You can remove them individually or clear the list on the search screen.

Other on-device data: appearance preferences, selected backgrounds and their favourites or history, and flags for tutorials you have seen. These stay on your device; temporary welcome data is removed when setup ends.

Social activity: people you follow and block, album and track swaps with their opinions, participation and content in Rooms, Jukebox rooms, moderation reports, decisions and appeals (including the reason, explanation and expiry of any restrictions), and notifications.

Connected music services (optional): if you connect Spotify or Apple Music we keep your account identifier on that service and the authorisations needed to use it. With Spotify connected we record your listening history (track, artists, album, date and time) for charts, Rewind, Jukebox and swap verification. For Apple Music, when you use those features, we request recent plays, Replay and playlists to display them in the app; we do not import Apple Music plays into MusMe listening history.

Streaming overlay (optional legacy Jukebox integration): if you set up an external overlay, we keep an access code and display settings linked to your Spotify identifier. Anyone with the code can retrieve that identifier and request the currently playing track or up to five queued tracks for display in the overlay; access is read-only. If the stream is public, its audience may see the displayed data. The record is removed when you disconnect Spotify or delete your account; that is the only way to revoke the code.

Spotify consent: when you connect it, we record the version, language and date/time of your specific consent and any withdrawal. The receipt stays linked to your account until you delete it; the retention period and legal basis need the controller's approval.

Notifications: if you allow them, we store your device's push token and message language. Notification titles and text, sent through Expo to Apple or Google push services, may include the display name of the person who interacted, an album, track, Room or review title and, for a reply to a review or a Room post/reply, an excerpt of the text of up to 80 characters. Private chat notifications do not include message text. When the server receives your sign-out request, it deletes the token. If you sign out without a connection, the request may not reach the server and the token may remain until it is updated later or the account is deleted. If you revoke push permission in your phone settings, the app sends a request to remove it from our databases the next time you open it while signed in; removal requires an internet connection.

Email verification and password recovery: for a short time, we keep only a cryptographic hash of temporary codes, not the codes in plain text.

Age: we use the date of birth you declare to calculate an age band (under 14, 14–17, or 18+) and do not keep that field. For people aged 14–17, we keep the exact date they turn 18, from which their date of birth can be worked out; we delete it when they become adults. Other users cannot see these data.

Chats: you can send text messages and track cards with a note; you cannot upload photos, audio or video. Messages are end-to-end encrypted on your phone. In ordinary use, the server keeps only ciphertext and does not have the keys to read it. You can compare the security code through another channel; it must match on both devices. The encryption has not had an independent audit. In clear we keep participants, status, times, the music card in a request and device public keys. If you report a chat, it ends; you may choose up to 30 messages to send to the team reviewing the report. The team can read them and keeps them for up to 90 days, unless account deletion removes them sooner. The attached text is supplied by your device and we cannot verify its authenticity. If the message is still on our server, we match its ID, sender and time against chat metadata; otherwise, we cannot verify those details. Notifications contain no message text.

Technical data: the server records IP address, date and time, the request method and path (without search parameters), response status and size, user-agent and referrer path, for security and troubleshooting. The app also sends the device's IANA time zone to the server to calculate local Room opening times and schedules; this is not GPS location.

MusMe does not request GPS or precise location data. IP addresses in server logs may allow a network provider to infer an approximate location. We do not show ads and we do not sell your data.

Why we use it

To provide the service you ask for when you create an account: sign-in, collection, reviews, profile, swaps, Jukebox and in-app notifications.

An account requires an email address, password, age declaration and acceptance of the Terms; without these we cannot create it. Connecting Spotify or Apple Music, adding optional profile details and enabling notifications are optional; the related features are unavailable if you do not choose them.

Legal bases: contract for the account, profile, collection, social features and chat; legitimate interest for security, abuse prevention, moderation and protecting minors; consent for Spotify data and device notifications; legal obligation when we must keep data or give it to authorities. Accepting the terms and acknowledging this policy do not, by themselves, amount to consent to data processing. If we rely on consent for a feature, we ask for it separately; you can withdraw it at any time in Settings or your device settings, without affecting processing already carried out.

For our legitimate interest: account security, abuse prevention, protecting minors through the date of birth, assessing reports and attached messages, moderation of reported content and the technical operation of the service. After a human review of a case, we may temporarily suspend only chat requests and messages, with a stated duration and an explanation sent to the user.

To calculate a score that may lead to an account restriction, automated moderation assesses recent reports by their number and timing. A report may count half as much if the reporting account was created less than 7 days ago; it does not count towards the score if at least 3 reports from that account in the previous 186 days were linked to content decisions later overturned. Events about overturned decisions are kept for 186 days. To handle appeals, we link reporters' account IDs to the moderation decision; this link contains no report text and is kept with the decision. The system may automatically hide content or, if the feature is enabled, temporarily put an account in read-only mode. This process does not automatically ban an account. You can appeal a decision in the app for at least six months; the team can review it. After deleting your account you can appeal by writing to info@musme.app within the same period.

Who we share it with

We use providers that process data on our behalf: OVH (MusMe's servers and database, the website, and confirmation, password recovery, report and outcome emails), and Expo and Apple and Google notification services (push notifications).

When you connect a service, MusMe talks to Spotify or Apple Music under their terms. Connected-service data and images come from Spotify or Apple Music; the collection catalogue also uses MusicBrainz and the Cover Art Archive. For music suggestions, the MusMe server queries ListenBrainz, operated by the MetaBrainz Foundation, using a shared set of MusicBrainz artist IDs associated with albums rated or selected during onboarding by MusMe users. The request does not include an individual MusMe or Spotify account ID or Spotify listening history; ListenBrainz receives the MusMe server IP address and request parameters. Its privacy policy is at metabrainz.org/privacy. MetaBrainz handles these requests under its own terms. When you search for an album or track, the app normally sends the search text directly to MusicBrainz, along with your device IP address and a user agent containing the app version and MusMe contact details. If the direct search fails, the request goes through the MusMe server. Loading images from the Cover Art Archive makes requests from your device to its servers, which receive its IP address.

GIFs and stickers in Room discussions come from GIPHY. Your searches go from our server to GIPHY without your account; images load from GIPHY's servers, which receive your device's IP address.

Providers, roles, processing countries and transfers: when a provider processes data outside the European Economic Area we rely on an adequacy decision or the standard contractual clauses in its contract; you can ask us for details at info@musme.app.

Other users can see what you make public: your profile, published reviews and lists, Room posts and replies, and, if you turn it on, your music activity. Rewind images you share go to the app you choose.

How long we keep it

Account, age band, profile, collection, reviews, relationships, swaps, Jukebox rooms, notifications and listening history: as long as your account exists. The date you turn 18 is deleted when you become an adult. You can remove individual items at any time.

Sign-in sessions: they expire after 30 days without use and are deleted within a day of expiring; signing out deletes them immediately.

Illegal content reports: name, email, content location and explanation for up to 186 days from submission, to assess them, reply and handle any challenge.

Recently opened items: they stay on your device until you remove them, clear the list or delete your account.

Other on-device preferences, including appearance, backgrounds and tutorials seen: they stay until you change them or clear app data; some may remain after account deletion. Temporary welcome data is removed when setup ends.

Password recovery codes: valid for 15 minutes and deleted within two days.

Email verification codes: valid for 15 minutes; their hash is deleted within two days after expiry.

Notifications you delete: permanently removed after 30 days.

Server technical data (logs): 30 days, then deleted automatically.

Events recording overturned decisions, used to assess report weight: up to 186 days, then deleted. To handle appeals, we link reporters' account IDs to the related moderation decision; this link contains no report text. We keep it with the decision; account deletion may remove it sooner.

Legal-text receipts: the version, language and date/time stay linked to your account while it exists and are deleted when you delete your account. Moderation decisions: we keep them for at least 186 days from the decision or appeal outcome and while an appeal is pending; account deletion may remove them sooner. After deleting your account you can appeal by writing to info@musme.app within six months of the decision. Administrative operation audit records: 90 days.

Spotify disconnection: we stop requests, delete listening history and remove derived summaries and states. We also delete the Spotify identifier and the old profile data tied to it; your MusMe account, collection and reviews remain. You can also revoke access in your Spotify account settings. Apple Music disconnection: we remove the token, storefront data and technical connection identifier from MusMe; you can also revoke permission in your device settings.

Chats: invites last 72 hours and accepted chats last 24 hours. When a chat ends, the server deletes its encrypted messages; data about the closed chat stays for 30 days and data about an inactive device for 30 days. The encrypted local copy is removed when the app processes the closure; if the phone is offline or the app is not reopened, we cannot promise immediate removal. When you delete your account, the app also tries to remove the encrypted chat vault and account preferences from the device; it tells you if it cannot confirm cleanup. If you report a chat, it ends and you may choose up to 30 messages: the team can read them and keeps them with the report for up to 90 days, unless account deletion removes them sooner. We cannot verify their authenticity.

Deleting your account

You can delete your account in Settings → Delete account by confirming your password. We delete your age band, any date you turn 18, profile, sessions, music connections, collection, ratings, notes, reviews, notifications, relationships, chats, reports made by or about you with their attached messages, moderation decisions and appeals, and listening history, including data from your old Spotify-linked MusMe profile. The app also tries to remove the encrypted chat vault and account preferences from your device and tells you if it cannot confirm cleanup. General appearance preferences stored only on your device may remain after account deletion.

Swaps you took part in, with the other person's opinions, and Jukebox rooms you hosted are deleted too. Images you already shared outside MusMe stay with whoever received them.

Your rights

You can ask to access, correct or delete your data, restrict processing, receive a portable copy and object to processing based on legitimate interest. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Write to info@musme.app: we reply within one month; where allowed, we may extend the deadline by up to two further months, telling you within the first month and explaining why.

You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority in your country.

Minimum age

MusMe has chosen 14 as its minimum service age: we do not create accounts for younger people. Age is self-declared: we do not ask for identity documents or independently verify the date. We do not collect parental or guardian consent. An existing account that declares an age under 14 cannot use normal features and can only sign out or delete itself. For minors, we keep the exact date they turn 18, from which their date of birth can be worked out, and delete it when they become adults. To correct the date, contact info@musme.app. The legal age for online consent varies by country and may differ from the service's minimum age. Spotify connection is available from age 14.

Anyone under 18, or who has not declared an age, does not appear in adults' search and suggestions, and adults do not appear in theirs. Here, “friends” means accounts that follow each other. Two adult friends and two minor friends can message directly. Two adults who are not friends can send a request containing only a music card; it must be accepted before they can exchange messages. Adults and minors can never chat privately, even if they are friends. Minors who are not friends cannot start a private chat. Reviews and lists stay private until you choose to publish them. Once public, like Room posts and replies, they are visible to all age groups and can receive replies from adults and minors. Instagram is hidden from others; bio and music activity are visible to friends only. You can block or report someone. Reporting a chat ends it; no message is sent to MusMe unless you choose it. You can select up to 30 messages: the team can read them and keeps them for up to 90 days, unless account deletion removes them sooner. The text is supplied by your device and we cannot verify its authenticity. If the message is still on our server, we match its ID, sender and time against chat metadata; otherwise, those details remain unverified.

Connecting Spotify

Connecting is optional and requires a separate consent choice from accepting the terms or acknowledging the privacy policy. It is available from age 14. With your consent we receive your Spotify identifier and profile data, recent listens, top tracks and artists, playlists and playback state. We use them for history, charts, Rewind, swaps, recommendations and Jukebox; Jukebox controls send playback requests to Spotify.

Rewind can be viewed by its owner; images you choose to share leave MusMe. Social features, Jukebox and Rooms may show tracks, profile information and listening comparisons to other participants: Spotify data is not used only privately.

To disconnect Spotify, open Settings → Music services → Disconnect Spotify. You can also revoke access in your Spotify account settings. Disconnecting deletes listening history and removes derived summaries and states; future requests stop. We also delete the Spotify identifier and the old profile data tied to it; your MusMe account, collection and reviews remain.

Spotify is a third-party beneficiary of this privacy policy and the MusMe terms, and can directly enforce the MusMe terms. MusMe’s collection and use of data is governed by this policy, which is separate from Spotify’s policy.

Changes

If we change this policy we update the date above and, for important changes, let you know in the app.

The musme.app website

The site is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. When you visit, the server records in its technical logs your IP address, date and time, the page requested and your browser type. They keep the site running and protect it from abuse, based on our legitimate interest, and OVH keeps them for the period set by its hosting service.

The site uses no cookies, no analytics, advertising or social plugins, and loads nothing from other sites: fonts and images are on our own server. The record covers come from Wikimedia Commons and are copied here, so your visit does not reach Wikimedia.

Links to the App Store and Google Play take you to Apple and Google sites, which process data under their own policies. If you write to info@musme.app we use your address and message only to reply.

If you use the form to report illegal content, the name and email you enter, the content’s location and your explanation reach our server. We use them to assess the report and reply to you, as the Digital Services Act requires, and delete them after 186 days.