Privacy Policy

1. Data Controller & Contact Channel

The data controller responsible for the processing of personal data on timbrii.com and timbrii.com.br is:

• Entity: [Legal operator — to be completed before launch]
• Business Mailing Address: [Business mailing address — to be completed before launch]
• Data Protection & Privacy Contact: [email protected]

Timbrii provides a music journaling and social listening platform accessible across both global (.com) and Brazilian (.com.br) domains. Sign-in credentials and user profiles are shared across domains using secure, single-use server-side ticket transfer.

2. Categories of Personal Data We Collect

We process the following categories of personal data when you interact with Timbrii:

A. Account & Identity Credentials

Email address, display name, username, password hash (for credential sign-in), OAuth subject identifier (for Google sign-in), avatar image URL, biography, and account creation timestamp.

B. Music Journaling & Activity Data

Listening logs, dates and timestamps of plays, album and track ratings (1–10 scale), written reviews, tags, custom curated lists, favorited genres, and concert attendance logs (including venue, show date, and notes).

C. User Content & Uploaded Media

Text reviews, list descriptions, comments, and uploaded images (such as concert ticket photos or custom list covers). Uploaded images are stripped of GPS location and camera EXIF metadata prior to permanent storage.

D. Social & Communication Data

Followers, following relationships, direct messages between users, user blocks, and interaction history.

E. Legal, Safety & Moderation Records

Takedown and rights requests submitted via our public portal (/report or /privacy/rights), versioned terms acceptance records, and lawful preservation hold markers.

Artist profiles and verification

Artist applicants submit their project role, contact email, official links, profile details and supporting information for administrative review. Approved accounts can publish artist posts and receive likes and comments. Verification contact details and supporting proof are restricted to the applicant and administrators; artist profile details and posts are shown subject to account visibility and safety controls. External image links may send a viewer’s network information to the image host. Do not include identity documents or sensitive personal information in proof fields.

F. Technical & Security Telemetry

IP addresses (processed transiently in volatile memory for rate-limiting and DDoS mitigation; not permanently logged or sold), browser user-agent headers, session cookies, and authentication state tokens. We do not forward IP addresses to third-party geolocation services.

Optional Last.fm connection

If you connect Last.fm, Timbrii stores your Last.fm username and session credential, and requests your completed listening history from Last.fm to populate your diary and statistics. This includes track, artist and album names, catalog identifiers and play timestamps. Available history is imported in batches, followed by periodic updates. Your profile privacy applies to imported plays; plays on a public profile may appear in feeds and discovery. Timbrii does not receive your streaming-service password or connect directly to Spotify.

Disconnect in connection settings to stop imports and remove the stored Last.fm credential and sync progress. Existing diary entries remain until you delete them or your account, subject to the retention exceptions below. When you remove an imported play, we retain an account-linked event identifier to prevent a later sync from importing that play again. This identifier is removed with your account. You can also revoke Timbrii from your Last.fm settings. Last.fm operates under its own privacy policy.

3. Purposes and Lawful Bases for Processing

In accordance with the EU General Data Protection Regulation (GDPR Art. 6), UK GDPR, and Brazil Lei Geral de Proteção de Dados (LGPD Art. 7), we process personal data under the following legal bases:

4. Third-Party Processors, Subprocessors & Technical Roles

The application integrates the providers below. Enabled services and accepted account-specific agreements require verification before release:

• Neon Inc. (United States): Primary serverless PostgreSQL database hosting. Stores encrypted-at-rest account credentials, music reviews, ratings, lists, and relations.
• Supabase Inc. (United States): Private cloud object storage for uploaded concert photos and custom list covers. Objects are stored in access-controlled private buckets and delivered through authenticated application proxies.
• Upstash Inc. (United States): Redis integration for caching, rate limiting and session-related operations. Retention depends on each stored record and the configured provider settings.
• Inngest Inc. (United States): Asynchronous event orchestration platform used to queue background catalog updates and metadata maintenance jobs.
• Google LLC (United States): Identity authentication provider when you choose "Continue with Google" via Google OAuth 2.0. Third-party AI review enrichment (Google Gemini) is currently disabled server-side across the entire platform pending provider licensing, enterprise configuration, and age-assurance architecture. No review text, listening history, or journal entries are transmitted to Google Gemini.
• Transactional SMTP Provider: Secure mail transport utilized strictly for essential transactional emails (verification, password resets, and user-opted support case updates). We do not send unsolicited marketing blasts and do not embed third-party tracking pixels in transactional emails.

External Catalog, Media & Ticket Discovery Providers

When browsing music releases, streaming 30-second promotional previews, or navigating to concert listings, certain external services are accessed directly or queried on your behalf:

• Apple Inc. (Apple Music & iTunes Store API): Music release metadata and 30-second promotional audio previews are retrieved via Apple Search API. Audio preview streams are delivered directly to your browser from Apple's verified CDN (audio-ssl.itunes.apple.com) with streaming-only enforcement (controlsList="nodownload", preload="none"). Your browser connects directly to Apple CDN servers during playback, subject to Apple's Privacy Policy. Outbound links to purchase or stream tracks link canonically to Apple Music.
• MetaBrainz Foundation (MusicBrainz): Open community music metadata queried under CC0 for release verification and supplementary tag discovery. No personal user data is shared with MetaBrainz.
• Wikimedia Foundation (Wikimedia Commons & Wikipedia): Artist and album cover images displayed under Creative Commons (CC BY, CC BY-SA) or Public Domain licenses with photographer credit and attribution links. Direct image fetches connect to Wikimedia upload servers.
• Ticketmaster & Bandsintown (Live Event Discovery): Concert dates and outbound ticketing links are displayed in uncontracted placeholder mode for user convenience. When you click an event ticket link, you leave Timbrii and navigate directly to the ticketing provider.
• Permanently Retired / Disabled Services: Spotify Web API integration is completely retired with HTTP 410 Gone responses and zero data transmission. YouTube and Deezer scraping and imports are permanently disabled server-side.

5. International Data Transfers & Safeguards

Our integrations may process data outside your country, including in the United States. The complete configured processing regions and transfer arrangements remain under review.

We have not yet verified all required provider agreements and international transfer safeguards. This draft does not certify executed Standard Contractual Clauses, a UK transfer addendum or equivalent arrangements. These remain release requirements where applicable.

6. Data Retention Schedule & Backup Lifecycle

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal requirements:

• Active Accounts: Account data and associated music logs remain active until you request deletion or close your account.
• Account Deletion Lifecycle: Requesting account deletion disables account access and schedules removal from our active database and media storage. Failed storage removals remain pending for retry. Preserved case evidence and records subject to a legal hold require a separate retention review.
• Operational Database Backups: Backup retention depends on the provider and configured account settings. A verified backup expiry period and recovery suppression procedure have not yet been established. Contact us for the status of copies relating to a deletion request; active-record deletion does not establish erasure from every backup.
• Legal Preservation Holds: If an account or specific content is subject to a formal preservation hold (LegalHold) arising from an active legal dispute, court order, or formal investigation, deletion of the specific preserved records is suspended until the legal obligation has concluded.

7. Your Data Protection Rights & How to Exercise Them

Depending on your location (including under GDPR, UK GDPR, Indiana CDPA § 24-12, and Brazil LGPD Art. 18), you possess specific enforceable statutory rights:

• Right of Access: You may request confirmation of whether we process your data and receive a readable copy.
• Right to Data Portability: Signed-in users can immediately export their full JSON account data dossier at any time via GET /api/users/me/export without requiring acceptance of updated terms.
• Right to Rectification: You may edit profile information directly in your account settings or request correction of inaccurate records.
• Right to Erasure ("Right to be Forgotten"): You may request complete erasure of your personal data through our self-service deletion controls or rights portal.
• Right to Restriction & Objection: You may object to processing based on legitimate interests or request temporary restriction while a dispute is reviewed.

To exercise any of these rights, visit our interactive Privacy Rights Portal or email us at [email protected]. We respond to verified requests within the statutory timeframe applicable in your jurisdiction (typically 30 calendar days under GDPR and Indiana CDPA, or 15 days under LGPD).

8. Advertising, Sponsored Content & Affiliate Transparency

Timbrii respects your attention and musical privacy:

• No Sale or Third-Party Sharing: We do not sell your personal data or provide personal information to third-party data brokers or commercial ad-targeting networks.
• Current Commercial Status — Placeholder Mode: Timbrii currently maintains zero active commercial affiliate contracts or third-party ad network integrations. Outbound concert ticket links (Ticketmaster, Bandsintown) and merchandise searches operate as functional placeholders for user convenience.
• Future Affiliate Monetization & FTC Transparency: If and when commercial affiliate partnerships are activated, qualifying outbound links may include partner attribution parameters that generate a sales commission for Timbrii at no extra cost to you. All sponsored placements and affiliate links are accompanied by clear, conspicuous disclosures in compliance with FTC Guides (16 CFR § 255.5) and Brazilian consumer protection rules (CDC Art. 36/37).
• First-Party Sponsored Discovery (Currently Disabled): When sponsored artist or release discovery is active, placements are matched exclusively using self-selected favorite genres. We never use your private reviews, private listening logs, or personal messages to target advertising.
• Strict Minor Protection: Users under 18 and accounts with unverified age bands are strictly excluded from all commercial promotions, sponsored discovery matching, and monetization profiling.
• Click Telemetry & Privacy: Outbound link clicks may be logged internally to track link health and provider attribution. We never record raw IP addresses or browser fingerprints in click telemetry. For registered accounts, click telemetry records are permanently purged upon account deletion under GDPR Art. 17 and LGPD Art. 18.

9. Children's and Minors' Privacy

Timbrii is intended for general audiences and is not directed to children under 13 years of age (or under 16/18 where mandated by local law, including the UK Age Appropriate Design Code and GDPR Art. 8).

Under-18 High Privacy Mode: Accounts identifying as under 18 (or whose age is unverified) operate under strict high-privacy protections: third-party AI processing (Google Gemini) is completely disabled server-side across the platform, and zero user data is transmitted to external AI models. Internal mathematical compatibility scoring is calculated strictly from first-party rating data, and accounts with unverified or minor age bands receive high-privacy defaults.

We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has registered an account without parental consent, please contact us immediately at [email protected] or submit a request at /privacy/rights. We will promptly investigate and permanently delete any unauthorized child records. For a youth-friendly overview of these protections, please read our dedicated Youth Privacy Guide.

10. Supervisory Authorities & Right to Lodge Complaints

If you believe our processing of your personal data infringes applicable data protection law, we encourage you to contact us first at [email protected]. You also have the right to lodge a formal complaint with the relevant data protection supervisory authority:

• United States (Indiana): Office of the Indiana Attorney General, Consumer Protection Division, 302 W. Washington St., 5th Floor, Indianapolis, IN 46204 (in.gov/attorneygeneral).
• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk).
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD), Esplanada dos Ministérios, Bloco C, Brasília - DF, CEP 70297-400 (gov.br/anpd).
• European Union: You may file a complaint with the Data Protection Authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.