1. Introduction
Whohears ("we," "our," or "us") operates the Whohears mobile application and website (whohears.com). This Privacy Policy explains how we collect, use, and protect your information when you use our services.
2. Information We Collect
Account Information
- Email address, from your sign-in provider (Google or Apple) or from an existing email and password account
- Display name and profile handle
- Profile photo (if provided by your sign-in provider)
Music Data
- The public Last.fm username you give us
- Public Last.fm listening data for that username — top artists, top tracks and recent plays
- Your public Last.fm friends list, and the same public listening data for those friends, which is what your Dex is built from
- Your generated taste card data (top artists, top tracks, scores)
Usage Data
- Comparisons you initiate with other users
- Tracks you catch in your Dex, and your collection progress (XP and level)
- Basic app usage analytics
3. How We Use Your Information
- To build, save and display your Dex
- To create and display your taste card
- To calculate taste overlap with other users
- To power the discovery feed with personalized recommendations
- To enable sharing and comparison features
- To improve and maintain our services
4. Data Sharing
We do not sell your personal information. Your taste card and comparison data may be visible to other Whohears users as part of the app's core functionality. We may share data with:
- Service providers: Supabase (database hosting), Last.fm (public music data), Google (authentication and the YouTube API), Apple (authentication), Vercel (website hosting)
- Other users: Your taste card, handle, and comparison results are visible to users you interact with
- Legal requirements: When required by law or to protect our rights
5. YouTube API Services
Whohears uses YouTube API Services to look up publicly available videos and to embed YouTube's player for playback. By using our app, you agree to be bound by the YouTube Terms of Service. We do not connect to your YouTube account and hold no YouTube credentials, so there is no YouTube access to revoke. If you signed in with Google, you can revoke that sign-in at any time via Google Security Settings.
6. Data Storage & Security
Your data is stored securely using Supabase with row-level security policies. We use industry-standard encryption for data in transit and at rest.
7. Data Retention & Deletion
We retain your data for as long as your account is active. You can delete your account and all associated data at any time from the app's profile settings. Upon deletion, we remove your profile, taste card, comparisons, and all related data from our servers. A Dex built without an account is stored against the Last.fm username it was built for — contact us and we will remove it.
8. Children's Privacy
Whohears is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.
9. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Revoke your Google or Apple sign-in at any time
- Opt out of non-essential data collection
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email.
11. Contact Us
If you have questions about this Privacy Policy, contact us at hello@whohears.com.