Privacy Policy

01Who we are (data controller)

Magic Soundboard is the controller of personal information collected through the Service (as that term is defined under GDPR, the UK GDPR, and the CCPA/CPRA). You can reach us about privacy at [email protected].

02Scope

This Privacy Policy describes what personal information we collect when you use the Magic Soundboard mobile app and related services (the “Service”), how we use it, who we share it with, and the rights you have over it. It does not cover third-party services or websites that we do not operate (for example, the app store, authentication provider, or third-party AI provider referenced below), which have their own privacy policies.

03Information we collect

We collect only the information needed to operate the Service:

• Account identifier. When you sign in with Apple, we receive a stable user identifier and (if you choose to share it) your name and email address, which may be a private relay address provided by Apple. We do not receive your Apple ID password.
• Audio and prompts. Audio files you generate or import, along with the prompts you submit for generation, are stored so that you can play them back across sessions and devices.
• Subscription and purchase state. Purchase events from the app store are mirrored to our backend through our subscription management provider so we can determine whether your account is entitled to Pro features and how many tokens you have. We do not receive your full payment card details or bank details.
• Device and app information. App version, operating-system version, and device type, for compatibility and diagnostics.
• Operational logs. Standard server logs (IP address, request timestamps, error traces) are kept for a short period for security, abuse prevention, and debugging.
• Support correspondence. If you email us, we retain the message and any attachments to respond to you.

The Service is designed to collect only what is needed to provide its core functionality. We do not use the Service to build advertising profiles or to track you across other apps or websites.

04How we use it

• To authenticate you and keep your library in sync;
• To generate sound effects from your prompts and deliver the resulting audio back to your device;
• To enforce subscription entitlements and credit token purchases;
• To provide customer support and respond to your requests;
• To secure the Service, detect and prevent abuse, enforce our Terms, and comply with legal obligations;
• To diagnose crashes and reliability issues, and to improve the Service (using aggregated or de-identified information where feasible).

We may use aggregated or de-identified information derived from the Service to operate, analyse, and improve the Service, including for quality, safety, and reliability purposes. Where information has been aggregated or de-identified so that it cannot reasonably be used to identify you, it is no longer treated as personal information under this policy.

05Legal bases (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases to process your personal information under GDPR / UK GDPR:

• Performance of a contract (Art. 6(1)(b)) — to provide the Service you’ve asked for, including authentication, generation, playback, and subscription management.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, diagnose errors, and improve reliability. Where we rely on legitimate interests, you have the right to object (see “Your rights”).
• Consent (Art. 6(1)(a)) — for optional processing such as push notifications. You can withdraw consent at any time in the app or device settings.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws, regulatory requests, or lawful government demands.

06Service providers

We currently use the following categories of processors to deliver the Service. Each processes personal information only as needed to perform its function under a contract that restricts further use. Specific providers may change from time to time; we will update this policy to reflect material changes.

• Supabase — authentication, relational database, and audio-file storage; receives your account identifier, audio files, prompts, and operational metadata.
• RevenueCat — subscription and purchase mirroring; receives your account identifier and subscription / purchase events from the app store.
• ElevenLabs — AI sound-effect generation; your prompt is transmitted to the provider to produce candidate audio; the provider does not receive your account identifier.
• Backend hosting — receives the network traffic and operational logs associated with your requests.
• The app store — authentication (via Sign in with Apple) and in-app purchase processing. The app store acts as an independent controller of the data it processes in that role.

07App Tracking Transparency

We do not track you across apps or websites owned by other companies. We do not use the Identifier for Advertisers (IDFA), and we do not share personal information with data brokers or advertising networks. For that reason, the app does not present an App Tracking Transparency prompt on iOS.

08Push notifications

If we introduce push notifications, we will request your permission before sending them. You can revoke permission at any time in your device settings. We do not use push notifications to deliver advertising from third parties.

09Retention

We retain personal information for as long as is necessary to provide the Service to you and for legitimate business purposes such as security, fraud prevention, accounting, and compliance with legal obligations. Retention periods vary by data category and may be extended where required or permitted by law.

When you delete your account from within the app, we remove your audio files, generation history, subscription mirror, and profile data from our active systems and instruct our subscription management provider to delete your subscriber record. This action is not reversible. Residual copies may persist in backups and logs for a reasonable period on our providers’ rolling schedules before being overwritten.

10Sharing and sale of information

We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We share data only:

• With the service providers listed above, and only as needed to operate the Service under a contract that restricts further use;
• With law enforcement or other authorities when required by a valid legal process or to protect the rights, safety, or property of Magic Soundboard or its users;
• In connection with a corporate transaction (for example, a merger, acquisition, or sale of assets), subject to appropriate confidentiality and, where applicable, notice.

11Security

Communication between the app and our backend uses TLS. Audio is stored in access-controlled buckets and protected by row-level security tied to your account identifier. Access to production systems is limited to authorised personnel. No system is perfectly secure, but we apply reasonable, industry-standard safeguards.

12Children

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction — for example, 16 in parts of the EEA). We do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete the information promptly.

13Your rights

Depending on where you live, you may have the right to:

• Access, correct, export, or delete your personal information;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Ask us not to use your personal information for automated decision-making that has a legal or similarly significant effect on you (we do not do this today);
• Lodge a complaint with your local data-protection authority. If you are in the EEA, you can find your supervisory authority at edpb.europa.eu. If you are in the UK, contact the Information Commissioner’s Office.

You can delete your account and all associated personal information directly from the app (Settings → Account → Delete account). For other requests, email [email protected] from the email address associated with your account, or include your account identifier so we can verify your identity. We respond to verifiable requests within the timeframes required by applicable law (for GDPR, typically within one month).

We will not discriminate against you for exercising any of these rights.

14California privacy rights

If you are a California resident, the CCPA/CPRA gives you the rights described under “Your rights” above plus the specific rights listed here. In the 12 months preceding this policy, we have collected the following categories of personal information:

• Identifiers (account identifier, email address if provided);
• Internet or other electronic network activity information (operational logs, IP address, app usage);
• Commercial information (subscription and purchase events mirrored from the app store);
• Audio information (audio you generate or import, and the prompts you submit).

We collect these categories from you directly and from the app store and our subscription management provider (for purchase events). We use them for the business purposes described under “How we use it” and disclose them only to the service providers listed under “Service providers”.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes that would trigger the CCPA/CPRA right to limit. For that reason, we do not provide a “Do Not Sell or Share My Personal Information” link; the choice is built into the Service.

California residents may designate an authorised agent to make requests on their behalf. We may require the agent to provide proof of authorisation and the consumer to verify their own identity directly with us.

15International transfers

Your personal information may be processed in countries other than the one in which you live, including in the United States. Those countries may have data-protection laws that differ from the laws of your country. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on lawful transfer mechanisms permitted by applicable law, including the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant) with our service providers, and we apply additional safeguards where necessary.

16Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email where reasonable. The “Last updated” date at the top reflects the most recent revision. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy (to the extent consent is not otherwise required).

17Contact

Questions or privacy requests? Email us at [email protected]. Please include enough information for us to verify your identity and locate your account.