Privacy Policy

1. Who We Are

Boundtracks (“we,” “us,” or “our”) operates the Boundtracks mobile application and website at boundtracks.fm. For the purposes of EU data protection law, Boundtracks is the data controller for personal data collected through our services.

2. What Data We Collect

Account and subscription data

• Email address
• Subscription status, plan type, and billing history (processed via RevenueCat and Apple/Google payment systems — we do not store payment card details)

Usage and analytics data

• App interactions, screens viewed, and listening activity (collected via Google Analytics for Firebase)
• Device type, operating system, and app version
• Approximate location (country/region level, derived from IP address)

Technical data

• Crash reports and diagnostic information
• App performance data

We do not collect sensitive personal data such as health information, biometric data, or financial account details.

3. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)) — to provide your subscription, manage your account, and deliver the service you have paid for
• Legitimate interests (Art. 6(1)(f)) — to understand how the app is used, improve our service, and prevent fraud
• Consent (Art. 6(1)(a)) — where we ask for your consent, such as for marketing communications. You may withdraw consent at any time.

4. How We Use Your Data

• To create and manage your account
• To process your subscription and provide access to content
• To send transactional emails (receipts, subscription confirmations, account notices)
• To analyse app usage and improve the product
• To respond to support requests
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Third Parties We Share Data With

These services act as data processors on our behalf and are contractually required to handle your data in accordance with applicable data protection law.

6. International Data Transfers

Some of our third-party service providers (including Google and RevenueCat) are based in the United States. Where data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

• Account and subscription data is retained for the duration of your account and for up to 3 years after account closure, for legal and accounting purposes.
• Analytics data is retained in accordance with Google’s default Firebase Analytics retention settings (up to 14 months).
• You may request deletion of your data at any time (see Section 8).

8. Your Rights Under GDPR

If you are located in the EU or EEA, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data (“right to be forgotten”)
• Right to restriction — request that we limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hi@boundtracks.fm. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD): cnpd.pt

9. Cookies and Tracking

Our mobile app does not use browser cookies. Our website (boundtracks.fm) may use cookies for analytics purposes. Where we use non-essential cookies, we will request your consent before placing them.

10. Children’s Privacy

Boundtracks is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at hi@boundtracks.fm and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or to exercise your rights:

Email: hi@boundtracks.fm

Website: boundtracks.fm