Privacy Policy

Last updated: 12 August 2026

This is a translation provided for your convenience. In case of any discrepancy, the Italian version prevails.

This page explains what data SoundUp collects, why, how long it is kept and what you can do to make it disappear. It is written to actually be read: where a sentence is vague, it is because that part depends on a choice of yours, not because something is being hidden.

In short. SoundUp does not sell your data, does not pass it to advertisers and uses no profiling or tracking cookies. The only third parties involved are the payment processors and — only if you choose to use it — the provider handling Google or Apple sign-in. You can download everything we hold about you, and you can delete your account from inside the app at any time.

1. Who processes the data

The data controller is the operator of SoundUp, reachable at soundup2026@protonmail.com. If the service is run by a company in the future, its name, registered office and VAT number will appear here.

2. What data we collect

Data you give us

Data	When	Why
Email address	at registration	to identify the account and let you sign back in
Username	at registration	it is how other people see you in the app
Password	at registration	never stored: we keep only a cryptographic hash (PBKDF2-SHA256, 200,000 iterations) from which the password cannot be recovered
Bio, city, country, profile and cover picture	if you fill in your profile	they are your public page; you choose them and they are optional
Tracks, artwork, posts, concert dates	if you publish as an artist	this is the content you put online
Private messages	if you write to someone	to deliver them to the recipient
Language, theme and colour	when you change them	so your settings follow you to another device

Data generated by using the app

Votes: which track, how many credits, whether you back or challenge it, and when.
Plays: which tracks you played inside the app and how many times. They are used to count a track's real listeners — that is the promise we make to artists: no invented numbers.
Library, playlists and reposts.
XP, rank and Fan level, computed from the above.
Reports you submit about content or people.
Terms acceptance: the date and the version accepted.
Sessions and remembered devices: a random identifier that keeps you signed in, with the date it was last used.

Data we do NOT collect

No advertising cookies, no tracking pixels, no third-party analytics library.
No GPS location. City and country, if present, were typed by you.
No access to contacts, photos, microphone or other device content beyond the files you upload yourself.
No payment card data: you see and enter those numbers only on Stripe's or PayPal's pages, never on SoundUp.

3. On what legal basis

Performance of a contract (Art. 6.1.b GDPR) for everything needed to run the account: registration, sign-in, votes, publishing, messages, buying credits.
Legal obligation (Art. 6.1.c) for retaining the accounting records tied to payments.
Legitimate interest (Art. 6.1.f) for security: the temporary lockout after repeated failed sign-in attempts, and the moderation of reported content.

4. Who else sees your data

Only these parties, and only the part that concerns them:

Party	What it receives	When
Stripe	amount, order identifier and the payment details you enter on its page	only if you buy credits or start a subscription
PayPal	the same, if you choose PayPal	only if you buy credits or start a subscription
Google (Firebase)	handles sign-in and returns your email address and an identifier to us	only if you choose “Continue with Google” or with Apple
Hosting provider	stores the database and uploaded files on our behalf	always

If you do not use Google or Apple sign-in, the Firebase SDK is not even loaded by the app. None of these parties receives your data to use for their own purposes, and no data is sold or shared for advertising.

5. What is public and what is not

Public — username, profile picture and cover, bio, city and country if you entered them, the tracks and posts you publish, your rank and your leaderboard position.

Private — email address, credit balance, purchase history, messages, which tracks you saved, your playlists and the reports you submit.

The detail of your votes is visible to others only in aggregate on the track (how many people backed it), never with your name next to each individual vote.

6. How long we keep it

Account data: as long as the account exists.
Sessions: they expire 30 days after last use and are deleted automatically.
Remembered devices: 90 days, and you can revoke them one by one from your account settings.
Accounting records for payments: for the period required by tax law, even after the account is closed, but with every reference to you removed (amount, tax and date remain).
Everything else: gone when you delete your account.

7. Your rights, and how to actually exercise them

You have the right to access your data, correct it, erase it, restrict its processing, object, and receive it in a machine-readable format. Two of these you can exercise yourself, right now, without writing to anyone:

Download your data — Account → “Download my data”. You get a JSON file with everything: profile, tracks, votes, library, playlists, sent messages, payments and reports.

Delete your account — Account → “Delete account”. It asks for your password and your username in full, because there is no undo. Profile, published tracks, votes, library, playlists, messages and conversations are deleted.

For correction, restriction and objection write to soundup2026@protonmail.com. You also have the right to lodge a complaint with the Italian data protection authority (garanteprivacy.it) or with the supervisory authority of your own country.

8. Security

Passwords are stored only as a cryptographic hash with a random salt; not even the people running the service can read them.
After a few failed sign-in attempts the account is temporarily locked, so that trying passwords in bulk is pointless.
Sessions expire and can be closed from any device.
Uploaded files are checked on their actual content, not their name.

9. Minors

SoundUp is not intended for anyone under 14. If we learn that an account belongs to someone younger, we close it and delete the related data.

10. Changes

If we change this policy, the date at the top changes and anyone with an account is notified inside the app before the changes take effect.

11. Contact

For any request about your data — access, correction, restriction, objection — write to:

soundup2026@protonmail.com

We reply within 30 days, as required by Art. 12 GDPR. Account deletion and data export do not need to go through here: you do them yourself from the app, at any time, under Account → Your data.

← Back to SoundUp