Disc Privacy Policy

1. Information we collect

Information you provide

• Account information: your email address, account identifiers, and authentication information.
• Library information: uploaded audio files, artwork, filenames, music metadata, playlists, favorites, and library preferences.
• Communications: information you provide in support messages, account inquiries, or privacy requests.

Sign-in credentials

Firebase Authentication processes sign-in credentials, including your email address and password. An email address combined with a password may be treated as sensitive personal information under applicable law. We use this information for authentication and account security, not to infer personal characteristics.

Your private music library

Your uploaded content and library settings are associated with your account. We process them to store, organize, transcode, stream, synchronize, and deliver your music. Disc does not provide public posting or user-to-user library sharing at launch. Service providers process library content as needed to perform the functions described in Service providers and disclosures.

Listening activity and technical information

Disc records listening and library activity, including tracks played, playback times, listening duration, play counts, platform, recently played items, and storage usage. Listening statistics are enabled by default. You can pause new statistics or clear existing statistics in settings. Recently played shortcuts are separate and are not cleared when you clear listening statistics.

Disc and its service providers also process information needed to operate, troubleshoot, and secure the service. This may include IP addresses, browser type, device and application identifiers, device model, operating system, app version, service requests, timestamps, authentication and subscription events, and diagnostic information. This information may be associated with your account.

Payments and subscriptions

At launch, new subscriptions can be purchased only in the iOS app through Apple’s App Store. Apple bills these purchases. RevenueCat helps validate purchases and manage subscription access across Disc’s web and iOS apps.

We receive account and transaction identifiers, subscription products, purchase and renewal status, and access dates. We do not receive or store your full payment-card number or card security code. See the privacy notices for Apple and RevenueCat.

Information from service providers

We receive information from providers that authenticate accounts, deliver Disc, administer subscriptions, send account emails, and handle privacy requests. These providers and their roles are listed in section 4. We do not obtain user profiles from data brokers, marketing lists, or social media platforms.

2. How we use information

We use personal information to:

• Create and authenticate accounts and maintain access to Disc.
• Store, organize, transcode, stream, download, and synchronize your library and provide listening features.
• Validate purchases, manage subscription access, and reconcile subscription records.
• Respond to support inquiries and privacy requests and send transactional account, service, and policy notices.
• Understand service usage, troubleshoot problems, and improve performance and reliability.
• Protect accounts and the service, prevent fraud and abuse, comply with legal obligations, and establish or defend legal rights.

We do not use your personal information to serve advertising. Disc does not offer AI features at launch. If we propose another use that requires your consent, we will seek that consent before proceeding.

3. Consent and permitted processing

We collect, use, and disclose personal information for the purposes explained in this policy and in accordance with applicable law.

For users in Canada, we obtain consent where required. Consent may be express or, where permitted by law, implied from the circumstances. The appropriate form depends on the information’s sensitivity, the purpose, and your reasonable expectations. We may also process information without consent where applicable law permits or requires it, such as for certain legal obligations, investigations, or fraud prevention.

You can withdraw consent where processing relies on it. We will explain how withdrawal affects the service; some information is necessary to provide an account or store and deliver your library.

4. Service providers and disclosures

We disclose personal information to providers as needed for the functions below. Depending on the function, this may include account identifiers, contact information, uploaded content, technical information, or subscription records.

Processing by these providers is governed by the applicable service terms, data-protection arrangements, and law. Providers may use other providers to deliver their services. Some providers, including Apple for App Store purchases, also process information under their own privacy notices.

Other disclosures

We may disclose information where permitted or required by law to meet legal obligations, respond to lawful requests, prevent fraud or abuse, or establish or defend legal rights. We may also disclose or transfer information in connection with a merger, financing, acquisition, or sale of business assets, subject to applicable privacy requirements.

We do not sell personal information or share it for cross-context behavioral advertising.

International processing

Replicode, Inc. is based in Canada. We and our providers may process and store personal information in Canada, the United States, and other countries where our providers operate. Privacy laws may differ from those where you live, and local authorities may be able to access information under applicable law.

We use contractual and other safeguards appropriate to the processing and applicable law when information is handled outside your province or country. Contact [email protected] for information about these practices.

5. Cookies, device storage, and privacy signals

Disc uses authentication cookies and similar storage, including browser local storage, session storage, IndexedDB, and app storage. These help maintain sign-in, protect media access, remember preferences, cache library information and artwork, and synchronize listening activity. We do not use advertising cookies or Google Analytics.

You can clear browser storage or adjust browser settings, but doing so may sign you out or affect playback, cached information, and saved preferences.

Files and storage on iOS

The iOS app uses system file and photo pickers to access audio files and images you choose. It does not request access to your entire photo library, location, contacts, camera, or microphone. It stores downloaded music and cached information on your device.

Browser privacy signals

Disc does not change its practices in response to the legacy Do Not Track (DNT) browser signal.

Global Privacy Control (GPC) is a separate signal that communicates a request to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Disc does not engage in those activities, whether or not your browser sends a GPC signal. You can contact us about privacy choices through the methods in section 9.

6. Retention and deletion

We retain personal information for as long as needed for the purposes described in this policy, including providing Disc and meeting applicable legal obligations. Retention depends on the type of information and why it is needed.

Accounts, libraries, and listening statistics

We retain account information while your account remains open and as needed to provide account access and related services. Uploaded library content follows the subscription-expiry rule below and can be deleted sooner at your request. Listening statistics remain until you clear them or delete your account.

The 90-day library recovery period

If your paid subscription access ends, we retain your uploaded library for a 90-day recovery period so you can export your music files, delete your content, or resubscribe.

The recovery period begins after both confirmed loss of subscription access, including the end of any applicable provider-granted billing grace period, and our initial retention notice. Canceling renewal does not start this period while paid access remains.

After the recovery period, we delete remaining uploaded library content unless verified subscription access has been restored before cleanup. Your Disc account remains available for you to sign in and subscribe again. Resubscribing does not restore files that have already been deleted.

Deleting your account

You can request account deletion from account settings at any time; account deletion does not wait for the 90-day recovery period. You can also contact us through the privacy-request process.

Account deletion removes your application profile, library records, playlists, preferences, and listening statistics from our active application database. It also queues deletion of uploaded content and your authentication account from the relevant providers. Provider deletion runs asynchronously and is retried if it fails, so all copies are not necessarily removed at the same moment.

Account deletion clears account data and app-managed downloads on the device completing deletion. Other devices clear local account data when they receive confirmation that the account was deleted. Offline devices cannot be remotely erased. Files exported outside Disc remain under your control.

Deleting your Disc account does not cancel an App Store subscription. Manage subscription cancellation through Apple.

Other records and backup copies

Limited subscription identifiers and transaction or subscription records may remain after account deletion when needed for subscription administration, reconciliation, fraud prevention, or legal and accounting obligations. Temporary records needed to complete deletion remain until that work is finished.

Support messages, operational and security logs, backups, and records held by providers may follow separate retention schedules. We determine retention based on the record’s purpose, how long it is needed to resolve an issue or protect the service, and applicable legal requirements. Deletion from active systems may occur before backup copies expire. We delete or anonymize information when it is no longer needed, subject to applicable law.

7. Security

We use technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or disclosure. No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security.

If you believe your account or personal information has been compromised, contact [email protected].

8. Age eligibility

Disc is intended only for people aged 18 or older. You must be at least 18 to create an account or use the service. Parental permission does not make someone under 18 eligible.

We do not knowingly collect or solicit personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will deactivate the account and take reasonable steps to delete their personal information. Please contact [email protected] if you believe someone under 18 has provided personal information to Disc.

9. Your choices and privacy rights

Controls in Disc

• Account and library: use the available account settings and library controls to manage your information or request account deletion.
• Listening statistics: pause new statistics or clear existing statistics in settings. Recently played shortcuts are separate.
• Music downloads: use Disc’s music-download tools to obtain your files. A library music download does not include all account information, playlists, or edits made to metadata within Disc. Use the privacy-request process below for other personal information.
• Subscriptions: manage renewal and cancellation through Apple. Account deletion follows the separate process in section 6.

Rights under applicable law

Depending on where you live and which laws apply, you may have rights to access and obtain a copy of personal information, correct inaccuracies, request deletion, withdraw consent, or object to or restrict certain processing. You may also have rights to data portability and protections concerning decisions made solely by automated means.

Where applicable law requires it, if we make a decision about you solely by automated means that has legal or similarly significant effects, we will provide the required notice and explanation and a way to request human review. Additional information for US residents appears in section 10.

Withdrawing consent

If we rely on consent to process your information, you can contact us to withdraw it, subject to applicable legal or contractual restrictions. Withdrawal does not affect processing that occurred lawfully before withdrawal or processing otherwise permitted by law. We will explain any consequences for your use of Disc.

Making a privacy request

Email [email protected], submit our privacy-request form, or use the postal address in section 12. Tell us what you would like to access, correct, delete, or ask about.

For requests that require verification, we may need to verify your identity or authority before fulfilling the request. We use information supplied for verification only for identity, authority, security, or fraud-prevention purposes. If we cannot verify you using information we already hold, we may ask for additional information.

Where applicable law permits an authorized agent to act for you, we may request proof of the agent’s authority and verification of your identity. We will consider and respond to requests within the timeframes required by applicable law. Rights may be subject to exceptions, such as records we must retain to meet legal obligations.

Appeals and concerns

If we decline a request and you have a right to appeal under applicable law, email [email protected]. We will explain our decision and any action taken in writing. If your appeal is denied, you may contact the relevant state attorney general or other applicable privacy regulator. You may also raise a privacy concern with us or your applicable privacy regulator.

10. Additional information for US residents

US state privacy rights depend on your state of residence and whether the relevant law applies to Disc. This section supplements the information and request process above.

Categories of information

The table identifies categories relevant to Disc. Examples for categories marked “Yes” describe information we process. Categories marked “No” include illustrative examples for clarity.

We collect information from you, your use of Disc, and the providers described in section 1. The purposes are listed in section 2. Categories A, B, D, F, H, and L may be disclosed to the providers in section 4 as needed for their functions.

Account and credential information follows account retention and deletion; uploaded audio and artwork follow library deletion and the recovery rule; listening statistics remain until cleared or the account is deleted. Subscription and operational records follow the purpose-based criteria and exceptions in section 6.

We use sensitive account credentials for authentication and security, not to infer characteristics about you. We do not sell personal information or share it for cross-context behavioral advertising.

State privacy rights

Where provided by applicable state law, you may have the right to:

• Know whether we process personal information about you, access it, and obtain a copy.
• Correct inaccurate information and request deletion.
• Exercise your rights without discrimination.
• Opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling used for decisions with legal or similarly significant effects.
• Access the categories of personal information processed and obtain categories or, where applicable, specific identities of third parties to which information was disclosed or sold.
• Review, understand, question, and where applicable correct how personal information has been profiled.
• Limit the use or disclosure of sensitive personal information or opt out of its collection, including information collected through voice or facial recognition, where the relevant state law provides those rights.

These rights do not mean Disc carries out every activity listed. Use the privacy-request process to exercise a right or ask how it applies to your information. That section also explains verification, authorized agents, and appeals.

California “Shine the Light” requests

California Civil Code section 1798.83 permits California residents to request certain information, once a year and free of charge, about disclosures of personal information to third parties for their direct marketing during the preceding calendar year. Submit any such request using the contact details below.

11. Changes to this policy

We may update this policy to reflect changes to Disc, our practices, or applicable law. The “Last updated” date above identifies the latest revision. We will provide notice of material changes and obtain consent where required by applicable law.

12. Contact us

Our Privacy Officer is responsible for our privacy practices and handles privacy requests and complaints. For questions or concerns about this policy, contact the Privacy Officer at Replicode, Inc.:

• Email: [email protected]
• Online: privacy-request form