Humelodica privacy policy
Last updated: [date of publication]
1. Who we are
Humelodica (the app and humelodica.app) is run by Ness Grixti Ltd, a company registered in England and Wales (number 15259089), whose registered office is 167–169 Great Portland Street, London W1W 5PF. Under UK and EU data protection law we are the controller of your personal data. [ICO registration number: ZB…]
You can reach us about anything in this policy at hello@humelodica.app.
2. What we collect, and why
The "legal basis" column is the reason the law lets us use your data. Contract means we need it to give you the app you asked for. Legitimate interests means it's needed to run a working, secure service, and it doesn't override your rights. Legal obligation means the law requires it.
| What | When | Why | Legal basis |
|---|---|---|---|
| Your voice while recording (hums and vocal takes) | Only between you tapping record and stop | To turn your hum into notes on your device, and to play and export your songs | Contract |
| Your songs: notes, arrangement, song names, settings | Kept on your device; copied to our servers only when you're signed in | To save your work | Contract |
| Your recordings, backed up | Automatically, whenever you're signed in | So your work survives a lost or new device | Contract |
| Your email address | When you create an account | To sign you in with a one-time code, and to send messages about your account | Contract |
| Your artist name (optional) | If you add one | Shown in the app and saved with your songs | Contract |
| Your plan (free or paid) and purchase history | If you buy a plan | To unlock what you paid for and restore purchases | Contract |
| Basic technical data (IP address, device and browser type) | When the app downloads its sounds, when you sign in, or when you visit humelodica.app | To deliver the app and keep it secure | Legitimate interests |
| Error reports | When something in the app goes wrong | So we can find and fix the problem. A report says what went wrong, the app's version, the screen and the device type, never your account, songs or recordings | Legitimate interests |
| Emails you send us | When you contact us | To answer you, and to keep a record of complaints | Legitimate interests; legal obligation (complaints) |
| Anonymous usage counts: daily totals such as "songs built today", "shares today" or "first songs made within 10 minutes of opening the app", with the app's version and whether it's the app or the website | While you use the app, unless you turn them off in Profile → Help improve Humelodica → Anonymous usage counts → Off | To learn which features help and where people get stuck, so we can improve the app. The counts carry no account, device ID, song names or content, so they can't say who you are or what you made | Legitimate interests |
| Feedback you send from the app | When you tap Profile → Help improve Humelodica → Send feedback | To read it, reply to you and improve the app. Your email is sent with it so we can reply: your account's email, or, if you are not signed in, the address you type | Legitimate interests |
You don't have to give us your email. Without an account you can still make music on your device, one song at a time, and you can share one MP3 of it; backing up, WAV, stems, MIDI, loops, more songs and plans need a free account.
The microphone is a setting on your device, not something you sign up to with us. You can turn it off at any time in your device's settings.
What we don't do:
- no advertising, and no tracking across other apps or websites;
- no tracking tools and no outside analytics companies in the app. The only usage information we collect is the anonymous counts above, kept in our own database in London. Apple shows us overall download numbers, and RevenueCat shows us overall subscription numbers, but neither tells us what you do in the app;
- no profiling, and no decisions about you are made by automated means;
- no location, contacts or photos;
- we don't sell or share your personal information, and we don't use it for targeted advertising.
3. Your voice and recordings
- Pitch detection happens on your device. Your voice isn't sent anywhere to be analysed.
- Recordings are stored on your device and, while you're signed in, automatically in your own private storage in your account. Other users can't see or hear them.
- We don't create voiceprints or use your voice to recognise who you are.
- We never use your recordings or songs to train AI or machine-learning models, and we never license them to anyone who does.
- Hum uses your device's microphone only after you tap it and allow it. Your hum is a recording kept with your song on your device and, while you're signed in, backed up automatically to your own private storage in your account. Other users can't see or hear it.
4. Your songs are yours
We only use your songs to store, sync, back up, play and export them for you. We don't publish them, use them in our marketing, or show them to anyone.
We can technically reach the songs and recordings backed up to your account, but we don't browse them. We only open a song when:
- you ask us to (for example, to fix a problem with it);
- we need to, to find and fix a fault or a security problem that affects it;
- we're looking into a report that it breaks the law or our Terms;
- the law requires it.
Songs kept only on your device never reach us, so we can't see them at all. When you share a song, it goes straight from your device to the app you choose (for example WhatsApp or Instagram), and that app's own privacy policy applies. Who owns your music is covered in our Terms.
5. Who helps us run Humelodica
These companies process data on our behalf, only as we instruct:
| Company | What they do | Where |
|---|---|---|
| Supabase (Supabase Pte Ltd) | Accounts, backup of songs and recordings, the anonymous usage counts, and feedback you send from the app | Data stored in London (UK); support staff may access it from elsewhere |
| Cloudflare | Hosts the app's sounds and humelodica.app; forwards email sent to us | US company; global network |
| RevenueCat | Keeps track of subscriptions bought through the App Store | United States |
| Resend (Resend, Inc.) | Sends your sign-in codes, and our emails to you | Emails sent from Ireland (EU); account records and delivery logs kept in the United States |
These companies make their own decisions about data, under their own privacy policies:
| Company | Why |
|---|---|
| Apple | Runs the App Store and takes payment for plans [and Sign in with Apple, if you use it]. We never see your card details. |
| Google (Gmail) | Our mailbox is hosted on Gmail, so emails you send us are stored there. |
We may also share data if the law requires it, or to protect people's safety or our legal rights. If the company is ever sold, your data would move with it, still under this policy, and we'd tell you.
6. Data sent outside the UK
Your songs and recordings are stored in London. Some data is handled outside the UK:
| Who | Where | Safeguard |
|---|---|---|
| Supabase | Singapore company; staff may access from the US and elsewhere | Standard contractual clauses with the UK Addendum |
| RevenueCat | United States | Standard contractual clauses with the UK Addendum |
| Cloudflare | United States | The UK–US "data bridge" (Cloudflare is certified) |
| Resend | United States | The UK–US "data bridge" (Resend is certified), with standard contractual clauses as a back-up |
Email us for a copy of these safeguards. If you live in the EU, the EU recognises the UK as giving data adequate protection, which covers sending your data to us.
7. How long we keep things
| Data | Kept for |
|---|---|
| Account, songs, recordings | Until you delete them or your account |
| A song you delete | Its contents are deleted straight away. A small marker (the song's ID and the date) stays until you delete your account, so your other devices know to delete it too. |
| After you delete your account | Deleted from our live systems straight away, including your subscription record at RevenueCat. Copies in our providers' backups and security logs are overwritten within 30 days. |
| Your purchase history (RevenueCat) | While you have an account, then deleted, unless we need it for a dispute |
| Our own accounts | Apple's payment reports are kept for 6 years (UK tax law). They don't name you. |
| Emails with us and complaints | 2 years |
| Feedback sent from the app | 2 years |
| Anonymous usage counts | Kept as daily totals to compare over time. They contain no personal data. |
| Error reports | 90 days |
| Server logs (IP address, device type) | Up to 7 days in our database provider's logs (Supabase); Cloudflare keeps short-lived request logs for security under its own privacy policy |
Anything stored only on your device stays there until you delete it or the app. Your device's own cloud or computer backup may include it; that's controlled by you and your device's maker.
8. Your rights
You have the right to:
- get a copy of your data;
- correct it;
- delete it: delete songs one by one (in the Studio, swipe a song left and tap the bin), or delete your account in Profile → Delete account. Deleting your account doesn't cancel an App Store subscription; cancel it first (Profile → Pro → Cancel Pro, or your device's Settings → [your name] → Subscriptions);
- take it with you: email us and we'll send your songs and account data as a file. You can also export songs as audio in the app (the Share key on a song);
- object to anything we do because of legitimate interests, or ask us to restrict it.
Email hello@humelodica.app to use any of these. We'll reply within one month (a little longer for complex requests, and we'll tell you if so). It's free.
9. Complaints
If you're unhappy with how we've handled your data, email hello@humelodica.app. We'll confirm we've received your complaint within 30 days, look into it, and tell you what we found.
You can also complain to the UK regulator, the Information Commissioner's Office: ico.org.uk, 0303 123 1113. If you live in the EU, you can complain to your local data protection authority.
10. Children
We apply the UK Children's Code to everyone: privacy-protective settings by default, no ads, no profiling, no tracking and no pressure to buy.
If you're under 13, you can use Humelodica on your device without an account. Humelodica isn't aimed at children under 13, and we don't knowingly collect personal data from children under 13. If you're a parent and think your child under 13 has given us personal data, email us and we'll delete it.
If you're 13 to 17, please check with a parent or guardian before creating an account or buying anything.
11. Security
We protect your data with encryption in transit (HTTPS), access controls so that only you can reach your songs, and private storage for your recordings. No system is perfectly secure. If something went wrong that put you at risk, we'd tell you and the regulator, as the law requires.
12. Changes to this policy
If we change this policy in a way that matters, we'll tell you at least 30 days before it takes effect: in the app, and by email if you have an account. The date at the top shows the latest version.
Humelodica is a product of Ness Grixti Ltd, registered in England and Wales, company number 15259089. Registered office: 167–169 Great Portland Street, London W1W 5PF. Email: hello@humelodica.app.