Privacy

1. Controller

2. What we process

Account. Email and sign-in times. Magic link or email code, optionally Google (OAuth via Supabase Auth). Display name, handle, bio, avatar, room visibility. An Apple ID login, if offered, is not the same as connecting Apple Music.

Apple Music (optional). You can browse and discuss without connecting. When you link Apple Music, we store a Music User Token encrypted on our servers so Noosic can sync recently played, tops, and saves, search the Apple catalog for your account, and play through MusicKit in your browser. Catalog search on the server uses an Apple developer token.

From that connection we keep snapshots that power rituals (Song of the Day, streak), room unlocks, Discover, and neighbourhoods. Neighbours on Noosic may see that you heard a work — not for advertising, and not to identify you to anyone outside Noosic. Disconnecting Apple Music deletes that listening snapshot.

Playback in the browser. Audio is Apple catalog audio via MusicKit (preview, or full tracks if your Apple Music subscription allows it). We do not re-host Apple audio. Artwork and streams are requested from Apple in your browser. Official “Listen on Apple Music” links go to Apple.

Content you create. Music Room, album and song discussions, moments, gifts, visits, follows, artist claims, shelves.

Supporter (optional). If you subscribe, Paddle handles payment. We store subscription status, Paddle customer and subscription IDs, months paid, and which cosmetic rewards you own. Payment card details stay with Paddle.

Safety. Short-lived technical data for rate limits (including a coarse client key / IP), reports, and staff audit logs.

We do not store your full listening history as marketing analytics.

3. Purposes and legal bases

Contract (Art. 6 (1) (b) GDPR): account, room, sync, ritual, discussions, in-app listening you start, settings.

Legitimate interest (Art. 6 (1) (f) GDPR): running the service, abuse prevention, moderation, error logs.

Apple Music access starts only after you authorize MusicKit. Disconnect in Settings; the stored token is then deleted or made unusable.

4. Recipients

Vercel Inc. Hosts the site and serverless functions.

Supabase. Authentication, Postgres, and file storage (avatars, room previews). Processing may happen in the EU and the US; where required we rely on Standard Contractual Clauses.

Apple. Independent controller of your Apple ID / Apple Music account. MusicKit and Apple Music API terms and Apple’s privacy notice apply. We do not send your Noosic password to Apple.

Google, if you sign in with Google — independent controller for that login step.

Paddle. Payment processor for optional Supporter subscriptions. Paddle’s privacy notice applies to checkout and billing data they collect.

5. Cookies

Essential cookies only: login, security, and remembering how you started. No analytics, ads, or social plugins. Under the TDDDG these do not need a consent banner. Deleting them in your browser ends the session.

• Supabase session (httpOnly, SameSite) — stay signed in
• noosic_intended_provider — which music service you chose at the start (Apple Music)
• noosic_invite — short-lived flag after a valid invite phrase (closed beta only)
• noosic_identity — fan or managed-artist mode

6. Retention

Account and content for as long as the account exists. Rate-limit entries only briefly. Account deletion soft-closes the profile (sign-in blocked, name anonymised) and permanently deletes Apple Music connection data: encrypted tokens, listening snapshots, metrics, Song of the Day rows from sync, and taste vectors built from that listening. Posts and gifts may remain as “[deleted]” where other people’s threads need them. Backups may hold data for a limited extra period.

7. Your rights

Access, rectification, erasure, restriction, objection, and portability (Art. 15–21 GDPR), and the right to complain to a supervisory authority — in Germany typically your state DPA or the Federal Commissioner for Data Protection. Delete the account in Settings; download a JSON copy under Settings → Account. Questions: info@noosic.com.

8. No automated decisions

Discover and neighbourhoods use similarity of listening data. That has no legal effect under Art. 22 GDPR and does not change your Apple Music account.

9. Age

Noosic is for people aged 16 and over.

10. Trademarks

Apple and Apple Music are trademarks of Apple Inc., registered in the U.S. and other countries. MusicKit and related marks are trademarks of Apple Inc. Noosic is not affiliated with, sponsored by, or endorsed by Apple Inc.