Privacy Policy

1. Information We Collect

Depending on how you use the App, we may collect or process the following:

• Account information. If you choose to sign in, we use Sign in with Apple or Sign in with Google. We receive a unique provider identifier and, where you permit it, your email address and name. Accounts are created and managed through Amazon Cognito on our behalf. Signing in is optional; you may continue as a guest.
• Split balance and service usage. The App uses an allowance of splits to meter processing-intensive features. We keep a record of your split balance, grants, and the processing jobs you run, associated with your account or your device.
• Images you select. Images you choose (for example, to recognize an album cover) may be uploaded for processing.
• Audio you select. Audio files or portions of audio files you choose may be uploaded for processing (for example, for stem separation or waveform generation).
• Device and integrity information. We generate an app-specific device identifier and may use platform integrity services — Apple App Attest on iOS and Google Play Integrity on Android — to confirm requests come from a genuine, unmodified app. This helps prevent fraud and abuse of the free service.
• Security and audit logs. Our servers record technical request information such as IP address, timestamps, and request metadata for security, abuse prevention, and operational diagnostics.
• Diagnostics and crash data. We collect anonymous usage, performance, and crash information, which may include device model, operating system version, and app state at the time of an error.

2. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the App’s features
• Create and manage your account and authenticate your sign-in
• Process images and audio using automated and AI-based functionality
• Operate the split allowance, including granting, metering, and replenishing splits
• Protect the service from fraud, abuse, and unauthorized use
• Enable sharing and export features
• Understand how features are used and improve performance, reliability, and user experience

We do not use your information for advertising, and we do not track you across other apps or websites.

3. Legal Bases for Processing (UK GDPR)

Where UK or EU data protection law applies, we rely on the following legal bases:

• Performance of a contract — to provide the features you request, manage your account, and operate the split allowance.
• Legitimate interests — to keep the service secure, prevent abuse of the free allowance, and improve the App. We balance these interests against your rights.
• Consent — where required, for example when you grant access to your email and name during sign-in. You can withdraw consent by signing out or deleting your account.

4. Sign in with Apple and Sign in with Google

When you sign in, the provider returns a unique identifier for your account and, if you allow it, your email address and name. We use this only to create and identify your account. We never receive your Apple or Google password. If you use Apple’s “Hide My Email” feature, we receive a private relay address rather than your personal email.

5. Uploads and Remote Processing

When you use features that require processing, the images or audio you select are transmitted from your device to our own infrastructure — cloud services hosted on Amazon Web Services, and servers we operate ourselves — and processed there by our own automated and AI-based systems to deliver the requested result. No third-party AI service receives them. Uploads occur only when you initiate them through the App.

6. Third-Party Services

We rely on trusted third-party providers to operate the App. They process data only to provide services on our behalf, under their own privacy and security practices, and we do not permit them to use your content for their own purposes. These include:

• Amazon Web Services — cloud hosting, storage, account management (Amazon Cognito), and part of the processing of uploads; the rest runs on servers we operate ourselves.
• Apple — Sign in with Apple, App Attest, and the Apple Music API.
• Google — Sign in with Google and Google Play Integrity.
• Firebase / Crashlytics (Google) — crash reporting, performance diagnostics, and remote configuration.
• RevenueCat — purchase and entitlement management. When you buy a subscription, RevenueCat receives the purchase receipt from Apple or Google and an identifier for your SnagTrax account (or an anonymous, app-generated identifier if you are not signed in), so your subscription can be recognised across your devices. RevenueCat does not receive your payment details; Apple or Google process the payment.
• YouTube (Google) — embedded video playback for preview features.

7. Apple Music API

The App accesses the Apple Music API using a developer token to enable music-related features. We do not collect, store, or have access to Apple Music account credentials or personal Apple ID information.

8. Analytics and Crash Reporting

We collect anonymous, aggregated data about how the App’s features are used and how the App performs, including feature usage, performance metrics, and crash reports. Crash reports may include technical information about your device, operating system version, and app state at the time of the crash. This information is used solely to improve functionality and reliability, is not used for advertising, and is not used to identify you.

9. International Transfers

We are based in the United Kingdom, and our service providers may process your information in the United States and other countries. Uploads processed on the servers we operate ourselves may also be processed outside the UK. Where information is transferred outside the UK or EEA, we rely on appropriate safeguards, such as the providers’ standard contractual clauses and equivalent protections.

10. Data Retention

Uploaded audio and processing results are kept only to deliver the feature you asked for and are then deleted automatically: audio you upload for processing within 30 days of upload, and processing results (such as separated stems and waveforms) within 8 days.

Images you upload for album recognition, together with the recognition result, are kept after the request has been served. We use them to evaluate, train and improve the album-recognition system, which is our legitimate interest in maintaining and improving the App. They are stored with no link to your account, your device or any other identifier — only the image, the recognition result and a timestamp — and they are not used for advertising or shared with third parties for their own purposes. Because nothing connects a stored image to a person, we are not able to find and delete the images a particular person uploaded; if you object to this use, contact us (see section 15) and we will stop using images you upload from then on, or simply do not use the album-recognition feature. Please make sure the photo shows only the album cover and not people or other personal details. We retain these images for as long as they remain useful for improving recognition and review this periodically.

Account information and split records are retained while your account is active. Security and audit logs are kept for a limited period for fraud prevention and operational purposes. We may retain certain information longer where required for legal, security, or legitimate operational reasons.

11. Your Rights and Choices

Subject to applicable law, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability. To exercise these rights:

• Delete your account. You can delete your account and associated personal data from within the App (in the account settings). Deleting your account removes your account record; some information may be retained in anonymized form or where required by law.
• Sign out at any time to stop using account-based features.
• Contact us at the address below to make any other request.

If you are in the UK or EEA and believe we have not handled your data properly, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

12. Data Security

We take reasonable technical and organizational measures to protect information from unauthorized access, loss, misuse, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children’s Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided information through the App, please contact us and we will take appropriate steps to address it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes become effective when the updated policy is made available within the App or on our website. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

15. Contact

If you have questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact us at:
Curious Forms Digital Ltd.
[email protected]