Privacy Policy

1. Who is responsible for your data

The controller of the personal data collected through lrplay.stream is:

• Lucas Romano
• Address: Autonomous City of Buenos Aires, Argentina
• Support and privacy contact email: [email protected]

Hereinafter, “we” or “LRplay”.

2. What LRplay is

LRplay is a web application to upload, listen to, organize and comment on audio mixes and masters in progress, and share them with collaborators. Anyone 18 or older can create an account, which starts on the Free plan at no cost; paid plans are available. What you upload is private: only you and the people you invite to each project can see it.

3. What data we collect

3.1. Account and identification data

• Email address, obtained when you sign in with Google or Apple. It's the only profile data we ask for and store: we don't request your name, photo or any other data. If you also connect Google Calendar, see section 3.6. If you sign in with Apple and choose to hide your email, Apple gives us a relay address (ending in @privaterelay.appleid.com) instead of your real email, and emails we send you reach you through that Apple service. See section 3.7.
• Username you choose when creating your account (lowercase letters, numbers and underscores only). It's shown to other people with access to the same project as the signature on your comments.
• Record of acceptance of the Terms and this Policy: which version you accepted, when, and the IP address and browser you did it from. We keep it to be able to prove the acceptance took place.
• Your plan (Free or paid) and, where applicable, your account's specific limits.

3.2. Content you upload or create

• Audio files, reference videos, covers and stems you upload.
• Titles, dates, key, song order and associated metadata.
• Time-stamped notes and reviews you leave on songs.
• Folders you create to organize your view (private per user).

3.3. Activity data inside the app

• Play log: which song and version was played, in which project, when and with which associated email. It's used to let project members know someone listened to a song and to mark reviews as pending.
• Log of new version uploads, for the same notification purpose.
• Notification preferences: days chosen for the email digest, storage alerts, push notification activation.
• If you turn on push notifications, we store the identifier (endpoint) and the cryptographic keys your browser generates for that device. You can turn it off at any time from Settings.

3.4. Subscription and payment data

• If you subscribe to a paid plan we store: the subscription status, the payment provider you chose, the subscription identifier that provider gives us, the currency, the next renewal date and, if a charge fails, since when.
• If you use the free Pro trial we store when it started and when it ends. We don't ask for a payment method for the trial.
• We also log which emails we sent you about your plan (failed charge, move to Free, storage almost full, end of the free trial), so we don't repeat them.
• We don't store card numbers or bank details. You enter them directly with Mercado Pago or PayPal, which process that data as independent controllers under their own privacy policies.

3.5. Infrastructure technical data

Our hosting and database providers automatically log technical data needed to operate and protect the service, such as IP address, browser type and request timestamps. We don't use those logs to profile your behavior.

The country associated with your IP address (reported by our hosting provider) determines the language the site is shown in, Spanish or English, and the currency you see prices in. We don't store it.

3.6. Your Google account data

LRplay uses Google Sign-In and, only if you turn it on, Google Calendar. These are all the permissions we request and what we do with each one:

• Sign-in (openid and email scopes): we get your email address to identify your account. We don't access any other data in your Google account.
• Google Calendar (calendar.app.created scope, optional, Pro plan): requested only when you tap “Connect” in Settings, never at sign-in. With it LRplay creates its own secondary calendar, named “LRplay”, and creates, updates and deletes events there for the due dates you set in the app. This permission doesn't allow seeing, reading or modifying your other calendars or their events, and LRplay doesn't attempt to.

What we store: your email and, if you connected Calendar, a Google access token (stored encrypted, never in plain text), the ID of the “LRplay” calendar and that of each event we create. We don't store the contents of your calendar.

Who it's shared with: no one. Data obtained from Google isn't sold, isn't used for advertising, isn't transferred to third parties and isn't used to train artificial intelligence models.

How to disconnect: from Settings → “Disconnect”. When you do, we revoke the permission with Google and delete the token. You can also remove LRplay's access at myaccount.google.com/permissions. The “LRplay” calendar stays in your Google account and you can delete it yourself.

3.7. Sign in with Apple

If you choose to sign in with Apple, Apple confirms your identity and sends us only your email (or the relay address, if you chose to hide it) and an identifier. We don't ask for your name or any other data from your Apple account. In the iPhone app, verification is done with Face ID, Touch ID or the device passcode: that biometric information is handled by your iPhone and never reaches LRplay. You can stop using Sign in with Apple with LRplay from your Apple account settings (on iPhone: Settings → your name → Sign in with Apple).

4. What we DON'T do

• We don't store your card or bank account details.
• We don't use tracking pixels or third-party cookies inside the app. To know how many visits the site gets we use Cloudflare Web Analytics, which uses no cookies and doesn't identify or follow you across sites: it only counts page views, country, device type and browser, and the site you came from.
• We don't advertise, and we don't sell, rent or hand over your data to third parties for commercial purposes.
• We don't build advertising profiles or make automated decisions with legal effects on you.
• We don't collect your precise location, your contact list or special category data (health, ideology, etc.).

5. What we use data for and on what legal basis

6. Who it's shared with (providers)

We don't sell your data. We only share it with providers that process data on our behalf and under contract, to provide the service:

We may disclose data if the law requires it or to defend our rights against misuse of the service.

7. International transfers

Some of these providers are located or process data outside your country, including the United States. Where applicable law requires it (for example, the GDPR in the European Economic Area or Argentina's Law 25.326), transfers rely on the safeguards provided by those providers, such as standard contractual clauses. By using the app you understand that your content and data are hosted on these providers' infrastructure.

8. How long it's kept

• Account and content: as long as your account exists. Moving from a paid plan to Free doesn't delete anything. Your username stays tied to your email to preserve authorship of your comments, unless you request its deletion.
• A project's content: until its owner deletes it.
• Record of acceptance of the Terms: while your account exists and, afterwards, for the limitation period of any claims that could arise from the contract.
• Activity logs (plays, uploads): kept as long as the associated project exists.
• Subscription and billing data: during the subscription and, afterwards, for as long as applicable tax and accounting rules require (in Argentina, generally 10 years).
• Free Pro trial dates: for as long as your account exists, so the trial can only be used once per account.
• Invite links: expire after 24 hours (or 15 days for extended links).
• Session cookie: up to 30 days, or until you log out.
• Language cookie (only if you pick the language with the ES | EN button): 1 year.
• Providers' technical logs: according to each provider's periods.

9. Your rights

Depending on your country of residence, you can exercise the rights of access, rectification, updating, erasure (“right to be forgotten”), objection, restriction of processing, portability and withdrawal of consent at any time (without retroactive effect).

To exercise them, write to us at [email protected]. We'll respond within the periods set by applicable law (in Argentina, 10 calendar days for access and 5 business days for rectification or erasure).

You can do many of these things yourself: turn off notifications in Settings, log out, leave a project, delete your account from Settings, or ask the project owner to delete content.

10. Security

• The whole app is behind sign-in, and each project is only visible to its owner and the people they invited.
• Files are delivered with signed links that expire within a few hours.
• The session is carried in an httpOnly cookie, cryptographically signed, and only over a secure connection (HTTPS).
• Files are uploaded directly to storage through single-use, expiring signed links.
• Sensitive database tables are only accessible by the service, not by the client.

No system is 100 % foolproof. If you find a security issue, let us know at [email protected].

11. Minors

LRplay is only for people 18 and older: creating an account means declaring you are. We don't knowingly collect data from minors. If you believe a minor gave us data, let us know and we'll delete it.

12. Changes to this policy

We may update this policy. If the change is substantial, we'll let you know inside the app or by email and ask you to accept the new version before you keep using the app. The version and date in the header always reflect the current one.

13. Contact and supervisory authority

Privacy questions: [email protected].

If you believe we didn't handle your request properly, you can file a complaint with your country's supervisory authority. In Argentina it's the Agencia de Acceso a la Información Pública (AAIP) (argentina.gob.ar/aaip). In the European Economic Area, the data protection authority of your Member State of residence.

“THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the supervisory body of Law No. 25.326, has the power to handle complaints and claims filed regarding non-compliance with personal data protection rules.”