Privacy notice

Last updated 30 October 2026

The controller of your data is [COMPANY NAME] d.o.o., [street address], [postcode] [city], Croatia, OIB [number], registered at the Commercial Court in [city] under MBS [number]. Contact: [privacy email].

What we store, and why

• Your account: email address and a salted hash of your password, so you can sign in. Legal basis: the contract with you.
• Your recordings and lyrics: the files you upload, the separated stems, and the analysis results and corrections, so we can show your songs to you and let you practise with them. A recording of a voice can be personal data. Legal basis: the contract with you.
• Feedback you send us: your message, the email address to answer to (your account's, or the one you give), the page you wrote it from and the kind of browser you used, so we can read it, act on it and reply. We delete a message once it has been dealt with. Deleting your account does not delete the messages you sent, but they are no longer linked to it; the email address in them stays, so that we can still answer. Write to [privacy email] to have them removed. Legal basis: our legitimate interest in improving rythmify, and your request where you ask for an answer.
• Server logs: IP address, time and requested page, kept for [30] days to keep the service secure. Legal basis: our legitimate interest in running a secure service.
• Payments: [handled by [payment provider]; we never see your card number. Fill in once payments exist.]

Cookies and measuring visits

Only if you allow it in the cookie banner, we use Google Analytics 4, a service of Google Ireland Limited, to count visits and see which parts of rythmify are used: which pages are opened (the front page, signing in, your songs, a song), when an account is created or signed in to, when a song is added and how (by search, link or file), and when a song is first played. We never send your email, your songs or their names, or your recordings. Like any server you connect to, Google also receives your device's IP address and browser, from which it works out a rough location. Google's advertising features and Google signals are switched off.

Google Analytics sets two cookies, _ga and _ga_…, which hold a random identifier for up to two years. Google Analytics keeps the record of each visit and event for 2 months, and what it knows about the random identifier for 14 months; after that, only totals that identify nobody remain. Google may process it in the US; transfers rest on the EU-US Data Privacy Framework, under which Google LLC is certified. Legal basis: your consent.

You can change your answer at any time with Cookies at the foot of the app's pages; saying no removes the cookies. Without your OK, nothing is loaded from Google. The browser also stores your display preferences (for example which panels are shown) and your answer to the cookie banner on your own device only.

Who else sees it

Your data is stored on servers run by Fly.io in Frankfurt, Germany, under a data-processing agreement. Fly.io is a US company; transfers to it rest on [the EU-US Data Privacy Framework / standard contractual clauses — confirm which applies]. [If any analysis is sent to an outside service such as Music.AI, name it here, say what is sent (the recording) and where it is processed.] If you allow it, Google receives what is described under "Cookies and measuring visits". Nobody else receives your data, unless the law requires it.

How long

As long as your account exists. Deleting your account removes your account and every recording and result in it at once; backups are overwritten within [30] days.

Your rights

You can see, correct, export and delete your data: your songs and corrections are visible in the app, and the account can be deleted from the library page. For anything else, write to [privacy email]. You may also complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the authority of your own country.