Privacy Policy

• •I only store what the app needs to work: your account, your songs and the things you choose to send me.
• •There are no analytics, no session recordings, no ads and no tracking cookies.
• •I don't sell your data, and I don't use your songs to train AI.
• •Anything you publish (songs and your public profile) can be seen by anyone with the link.
• •You can delete your songs or your whole account from the app, and you can email me for anything else.

Melodoodle is run by Pablo Domínguez, an individual developer based in Mexico. I decide how your personal data is used, so I am the one responsible for it (the "controller" under the GDPR, the "controlador" under Brazil's LGPD and the "responsable" under Mexican law).

For anything about your data, including exercising your rights, write to hi@dominguezpablo.com. That address is also the contact for data protection questions. I have not appointed a separate data protection officer.

This policy covers the Melodoodle app (on the web and the Android app from Google Play) and the melodoodle.io website.

• •Your account. Your email address, and a display name and profile picture if you have one. If you sign up with email, your password is stored only as a secure hash. If you sign in with Google, Google shares your name, email address, profile picture and Google account ID with me.
• •Your songs. Everything you put in a song: titles, sections, lyrics, chords, melodies, bass, drum and strum patterns, backing tracks you upload, voice recordings and takes, and song settings.
• •Your scratchpad. The text notes and voice notes you save there.
• •Your public profile and published songs. If you create a public profile, your username, display name, bio, photo and social links. If you publish a song, the parts you choose to publish. Both are public (see "Public content" below).
• •Your settings. Preferences such as the app language and how note names are shown (letters or Do Re Mi).
• •Your country. When you sign up, the country you connected from, as a two letter code worked out from your IP address by my hosting provider. Not your city or precise location.
• •Your subscription. Your plan, whether you pay through Stripe or Google Play, trial, renewal and cancellation dates, and the reference IDs those services give me. I never see or store your card details.
• •Plan limit counters. For example, how many exports you have made recently, so the free plan limits work.
• •Bug reports and suggestions you send. What you write, plus technical details that help me fix the problem: the page you were on, your browser and device, screen size, language, a snapshot of the audio engine state and recent app logs.
• •Automatic sync error reports. If saving or syncing your work fails, the app can file a bug report on its own with the same kind of technical details and recent app logs, so I can find and fix the problem.
• •Sign-in and server records. When you sign in, the sign-in service records your IP address, browser and times for each session. My hosting providers also keep short-lived request logs that include IP addresses.
• •Plays and likes on published songs. When anyone plays or likes a published song, a shortened, hashed version of their IP address is saved to count plays and stop duplicate likes.
• •Email preferences. If you unsubscribe from Melodoodle emails, your email address is kept on the unsubscribe list.

Melodoodle keeps copies of your songs and recordings in your browser's storage so it works offline and feels fast. If you try the app as a guest, your song lives only on your device until you create an account. Small preferences (like the theme, dismissed tips or your microphone calibration) are also saved on your device. Your microphone is only used when you record, and the audio is processed on your device until a take is saved to your account.

There are no analytics, no session recordings, no advertising and no tracking pixels in Melodoodle or on the website. I don't track you across other sites.

The only cookies and storage used are the ones needed for things to work:

• •Sign-in cookies that keep you logged in.
• •NEXT_LOCALE, a cookie that remembers the language you picked (kept for up to a year).
• •Browser storage for your offline copies and preferences, as described above.

Because these are strictly necessary or simply remember choices you made, there is no cookie banner. The Google sign-in button on the login page is loaded from Google, and Google may set its own cookies under its privacy policy.

• •To give you the service you signed up for: your account, saving and syncing songs, recording, exporting, publishing, emails needed for sign-in and password resets, and your subscription. Legal basis: performing our contract.
• •To handle payments and keep the records the law requires. Legal basis: performing our contract and legal obligations.
• •To keep Melodoodle working and safe: fixing bugs (including automatic sync error reports), preventing abuse and fraud, counting plays and likes, and replying to your reports and suggestions. Legal basis: my legitimate interests in running a reliable, secure app. You can object to this at any time.
• •Where I ask for your permission, such as microphone access (which you grant in your browser or phone). Legal basis: your consent, which you can withdraw at any time.

Under Brazil's LGPD these match the legal bases of performing a contract, complying with a legal obligation, legitimate interest and consent. Under Mexican law, the data needed to provide the service is used to fulfil our relationship, and nothing is used for secondary purposes such as marketing. I don't make automated decisions that have legal or similarly significant effects on you, and I don't build profiles about you.

• •I don't sell or rent your personal data, and I don't share it for advertising.
• •There are no ads in Melodoodle.
• •I don't use your songs, lyrics or recordings to train AI models.
• •I have admin access to run the service, but I only look at your account or content when you ask for help, when it is needed to fix a problem, or to deal with abuse or a legal request.

These services process data to make Melodoodle work. Each one only gets what it needs for its job:

• •Supabase: database, file storage and sign-in. Your account data, songs and recordings are stored in the European Union (Paris, France).
• •Vercel: hosts the app and the website, and handles every request to them (including your IP address).
• •Stripe: web payments. Stripe receives your email address and processes your payment details under its own privacy policy.
• •Google: Sign in with Google, Google Play billing for purchases in the Android app, and the fonts the app loads from Google Fonts (which receives your IP address).
• •Resend: sends emails such as sign-up confirmations, password resets and replies about your reports. It receives your email address and the email content.
• •Rhyme search: when you look up rhymes, the word you search is sent to a rhyme service. For English (and Spanish spelling fixes), the request goes through my server to Datamuse, which gets the word but not your IP address. For Spanish rhymes, your browser asks RhymeBrain directly, and for German, French and Portuguese it asks Wiktionary (run by the Wikimedia Foundation) directly, so those services see the word and your IP address.
• •GitHub: some instrument sounds are downloaded from GitHub Pages, which sees your IP address like any website you load.

I may also share data if the law requires it (for example, a valid court order), to protect people's safety or my legal rights, or with whoever takes over Melodoodle if it is ever transferred, in which case I'll tell you first.

The main database is in the European Union, but some of the providers above are based in or process data in the United States and other countries, and I operate Melodoodle from Mexico. Where the law requires it, these transfers rely on safeguards offered by the providers, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework for certified companies, and equivalent mechanisms under the LGPD. Rhyme lookups sent directly from your browser happen only when you use that feature.

When you publish a song or create a public profile, it can be seen by anyone with the link, including people without a Melodoodle account, and they can play and like published songs. I ask search engines not to index the app, but people can still share the link. Only publish what you are happy for the world to see.

You can unpublish a song at any time and it disappears from its public page. Copies someone else already made are out of my control, and published files can stay reachable at their direct address for a while. If you want them removed right away, email hi@dominguezpablo.com.

• •Account and content: for as long as you have an account, or until you delete them.
• •When you delete your account: any active Stripe subscription or Google Play renewal is cancelled first, then your account, songs, recordings, scratchpad (including voice notes), uploaded backing tracks, public profile and photo, published song files, subscription record and sign-in sessions are deleted.
• •What can stay after deletion: bug reports and suggestions you sent are kept to improve the app but are no longer linked to your account (ask me and I'll delete them). Payment records are kept by Stripe and Google as the law requires.
• •Bug reports and error reports: for as long as they help me fix problems. You can ask me to delete yours at any time.
• •Hosting request logs: short periods set by the providers, typically days.
• •Backups: deleted data can remain in database backups for a short time (currently about a week) until they are replaced.
• •Unsubscribe list: for as long as needed to make sure I don't email you again.

Connections are encrypted, data is encrypted at rest by the storage provider, passwords are stored as hashes, and database access rules make sure only you can reach your private songs. No system is perfectly secure, but if a breach affects your data, I'll let you and the authorities know as the law requires.

Wherever you live, you can ask me to:

• •Tell you whether I process your data and give you a copy of it
• •Correct data that is wrong or incomplete
• •Delete your data
• •Give you your data in a portable format
• •Restrict or stop some processing, or object to it
• •Withdraw consent you gave, without affecting what was done before

Many of these you can do yourself: change your profile and settings in the app, delete songs, export songs, and delete your whole account in Settings. For a copy of all your account data, or anything else, just email me.

In the EU, EEA and UK (GDPR): you have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. You can also complain to the data protection authority where you live or work (in the UK, the ICO).

In Brazil (LGPD, Art. 18): you can ask for confirmation that your data is processed, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who I share it with, information about refusing consent and what that means, and revocation of consent. You can also petition the ANPD (Autoridade Nacional de Proteção de Dados).

In Mexico: you have the ARCO rights (Acceso, Rectificación, Cancelación and Oposición), and you can revoke your consent or limit the use of your data. You can also go to the Mexican data protection authority (currently the Secretaría Anticorrupción y Buen Gobierno).

How to make a request: email hi@dominguezpablo.com, ideally from the address on your account, and say what you'd like. It's free. I may ask you to confirm it's really you. I'll reply within 15 days, and if a request needs more time and your local law allows it, I'll explain why within that period.

Melodoodle is meant for people who are 16 or older. Younger people can only use it with the permission of a parent or guardian. If you believe a child is using Melodoodle without that permission, email hi@dominguezpablo.com and I'll delete the account.

If I change this policy, I'll update the effective date at the top. If the change is important, I'll let you know in the app or by email before it takes effect.

Questions, requests or worries about your privacy: hi@dominguezpablo.com. A real person (me) reads every email.