Privacy
Privacy Policy
Last updated 12 October 2026
This page explains what Castunes collects about you, why, who helps us run the service, how long we keep it, and what you can do about it. It covers the Castunes Android app and the website at castunes.app.
The short version: we collect what we need to run a music platform. We don't sell your data, we don't show ads, and we don't use third-party analytics or advertising trackers.
- Who we are
- What we collect
- Why we use it
- What other people can see
- Who we share it with
- Google sign-in
- Data outside Europe
- How long we keep it
- Deleting your account
- Your rights
- How we protect it
- Automatic decisions
- Changes to this policy
Who we are
Castunes is an independent project run by its founder, who is responsible for your data (the "controller" under data protection law). We have not appointed a data protection officer.
For any question about your data or this policy, email help@castunes.app.
What we collect
When you make an account
- Your email address and a password. The password is stored only in a scrambled (hashed) form that nobody can read, us included.
- If you sign in with Google: Google tells us your email address, name and profile picture so we can create your account. We never see your Google password, and we don't get access to anything else in your Google account.
What you add
- Your profile: name, username, profile picture, banner, bio, location and social links.
- Your music: audio files, artwork, titles, descriptions, lyrics, credits and release dates.
- What you post: comments, playlists, messages, reports, verification requests and feedback.
What happens as you use Castunes
- Activity: songs you play (your listening history), likes, follows, saves and favourites.
- Technical data: your IP address and basic device and browser information, which our providers record when your device connects. On the website's sign-in and sign-up forms, Cloudflare Turnstile also looks at browser signals to tell people from bots.
The app stores a few things only on your device, such as your sign-in session, your settings and recent searches. Those stay on your device.
Why we use it
Data protection law asks us to say why we use your data and on what legal basis.
To provide Castunes to you (needed for our agreement with you): to run your account, store and play music, show your profile, run playlists, comments and messages, send you sign-in codes and important account emails, and build your home page and recommendations from what you listen to.
Because of our legitimate interests in keeping Castunes safe and working well:
- to stop spam, bots and abuse: bot checks, limits on how often actions can be repeated, blocking links in posts, and handling reports;
- to show artists totals about their music, such as plays, saves and followers (counts, not who listened);
- to find and fix problems.
You can object to these uses at any time. See your rights.
To meet legal obligations, for example handling copyright complaints and answering lawful requests from authorities.
You need an email address (or a Google account) to make an account, and your profile needs a name. Without them we can't give you an account. You can still listen on the website without one.
What other people can see
Castunes is a public platform, so some of what you add is visible to anyone, including people without an account:
- your profile (name, picture, banner, bio, location and social links), your followers and who you follow;
- music you publish, your public playlists, your comments, and the songs you've liked or picked as favourites;
- your listening totals (minutes, top artists and genres) and your recently played songs. You can switch either of these off in Settings.
Messages are only visible to the people in the conversation. Private playlists are only visible to you and anyone you invite.
Who we share it with
We don't sell your data or share it with advertisers. To run Castunes, we use a few service providers. They handle data only on our behalf and under contracts that require them to protect it:
- A database, storage and sign-in provider that stores your account, your music and everything else on Castunes.
- A website hosting and security provider that serves castunes.app and runs the bot check on our forms.
- An email delivery provider that sends our sign-in codes and account emails.
- Google, only if you choose "Continue with Google". Nothing about what you play on Castunes is sent back to Google.
We may also share data when the law requires it, or to protect people or Castunes from fraud or harm.
Google sign-in and your Google data
You can make a Castunes account with "Continue with Google", in the app or on the website. This is how Castunes handles the Google user data that comes with it.
- What we access: only your basic Google profile: your email address, your name and your profile picture. We don't ask for, and can't see, your Google password, your contacts, your files, your emails or anything else in your Google account.
- How we use it: only to create your Castunes account and sign you in. Your email address becomes your account's email, which we use for sign-in codes and account emails. We don't use your Google name or picture on your profile unless you add them yourself.
- Who we share it with: nobody, except the database and sign-in provider that stores your account for us (see Who we share it with). We never sell it, never use it for advertising, and never use it to train AI models.
- How we protect it: it travels encrypted (HTTPS) and is stored with the rest of your account, behind the protections described in How we protect it.
- How long we keep it and how to delete it: for as long as you have your account. When you delete your account, it is permanently erased 14 days later. You can also remove Castunes' access at any time in your Google Account, under Security → Your connections to third-party apps and services.
Castunes' use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Data outside Europe
Some of our providers are based in, or use servers in, countries outside the European Economic Area, including the United States. When your data leaves the EEA, it is protected by the safeguards the law requires, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. Email us if you want more information about these safeguards.
How long we keep it
- Your account and everything in it, as long as you have your account.
- After you delete your account: it disappears from Castunes straight away, and is permanently erased 14 days later.
- Things you delete yourself, such as a song, a playlist or a comment, are removed when you delete them.
- Records of actions used to prevent spam are deleted after 2 days.
- Technical logs kept by our providers are deleted after a short time.
- Emails you send us, as long as we need them to answer and follow up.
- Copyright complaints and records of rule breaking, as long as needed to handle them, to keep a closed account closed, or to deal with a legal claim.
Copies may stay in our providers' backups for a short time before they are overwritten.
Deleting your account
Go to Settings → Delete account in the app or on the website. We email you a code to confirm it's really you. Your account then disappears from Castunes straight away: your profile, your music, your playlists, your plays and your messages. Everything is permanently erased 14 days later, and after that your email address can be used for a new account.
If you can't get into your account, email help@castunes.app from the address you signed up with, and we'll delete it for you.
Your rights
You have the right to:
- see the data we hold about you and get a copy of it;
- correct it if it's wrong. Most of it you can change yourself in your profile and settings;
- have it deleted, for example by deleting your account;
- limit how we use it in some cases;
- object to uses based on our legitimate interests;
- take it with you: get the data you gave us in a common, machine-readable format.
To use any of these rights, email help@castunes.app. We'll answer within one month.
You also have the right to complain to a data protection authority, for example the one in the country where you live or work.
How we protect it
- Everything between your device and Castunes travels encrypted (HTTPS).
- Passwords are stored only in hashed form.
- Database rules make sure each person can only change their own things, and messages can only be read by the people in the conversation.
- Only a small number of people who run Castunes can access the systems, and only when they need to.
Automatic decisions
Castunes doesn't make decisions about you by computer alone that have legal or similarly serious effects. Some things are automatic, like recommendations, the bot check, limits on repeated actions and blocking links in posts. These only affect what you see or stop a single post or action, and you can contact us if you think one got it wrong.
Changes to this policy
When we change this policy, we update the date at the top. If we ever want to use your data for a new purpose, we'll tell you in the app or by email before we do.