Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account and identity information: your email address (used for sign-in verification codes), phone number and country calling code when you use phone replacement or recovery, display name, and, for artists, profile details such as biography, artwork, banner images, and photos.
• Authentication credentials: passkey (WebAuthn) public key credentials, which are cryptographic keys, not biometric data — your device, not Audestra, verifies your fingerprint, face, or PIN. Native listener apps also send Apple App Attest or Google Play Integrity signals so we can tell a genuine app from automated traffic.
• Payment information: when you subscribe or send Extra Support on https://listen.audestra.com, Stripe processes the payment. We receive subscription, Extra Support, and payout records needed to operate the Service. Card numbers stay with Stripe. Native iOS and Android apps do not collect cards.
• NFC join-tag information: tag identifiers, password material, and optional notes when you write or manage artist join tags from a supported phone.
• Listening and usage activity: playback starts, completions, skips, and failures, which artists see in aggregate through Studio analytics; app version and platform information; and general diagnostic information if crash reporting is enabled on a device. We do not ship a third-party crash SDK in the listener apps today.
• Catalog reports: if you report published artist content, we store the target, reason, optional note, and your account id for admin review. Artists do not see reporter identity in analytics.
• Offline download metadata: which tracks and assets are downloaded to a device and their storage size, so we can enforce storage allowances and invalidate downloads when access changes.
• Device and session information: device identifiers, session tokens, and IP address, used for authentication, security, and abuse prevention.
• Bot-protection signals: when you request a sign-in or recovery code from Studio or the listener website, Cloudflare Turnstile may collect technical signals such as IP address and browser characteristics to distinguish human visitors from automated traffic. Native listener apps use Apple App Attest or Google Play Integrity instead of Turnstile.
• Notification tokens: if you enable notifications, a token used to deliver them.

2. How We Use Information

We use the information described above to:

• Authenticate you and keep your account secure, including detecting and preventing fraud or abuse.
• Operate core Service features: streaming, offline downloads, catalog synchronization, and artist analytics.
• Communicate with you about your account, security notices, and material changes to the Service or these policies.
• Maintain, troubleshoot, and improve the Service, including through aggregated or de-identified usage analysis.
• Moderate User Content and enforce our Terms and Conditions, including by removing content we deem inappropriate for any reason.
• Comply with legal obligations.

3. How We Share Information

We do not sell your personal information. We share information only as follows:

• With infrastructure and communications providers (for example, cloud hosting, email delivery, and bot-protection vendors) who process information on our behalf under contractual confidentiality and security obligations.
• With artists you follow, limited to aggregate or account-scoped listening metrics shown in Studio analytics — artists do not receive your email address or raw device identifiers through the Service.
• When required to comply with a legal obligation, protect the rights and safety of Audestra or others, or investigate suspected fraud or abuse.
• In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy continuing to apply to the information transferred.

4. Cloudflare Turnstile

Studio and the listener website use Cloudflare Turnstile in invisible mode when you request a sign-in or recovery code. Turnstile runs in the background and does not show a checkbox. As a condition of that mode, we reference Cloudflare's Turnstile Privacy Addendum, which describes how Cloudflare processes the technical signals it collects: https://www.cloudflare.com/turnstile-privacy-policy/.

5. Data Storage and Security

The Service is hosted on cloud infrastructure located in the United States. We use encryption in transit for all API and media traffic, and we do not store verification codes or passkey private keys — passkey private keys never leave your device.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

6. Data Retention

We retain account and usage information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. After a listener deletes an account we tombstone contact identities, revoke sessions, disable push endpoints, delete NFC tags owned by that account, and cancel membership. We may retain billing journals, security events, and aggregated or de-identified analytics. We may also delete User Content that we remove under our Terms and Conditions.

7. Your Choices and Rights

You can review and update your profile information, manage passkeys, and review active sessions from within the Service. Signed-in listeners can delete their account from Profile in the iOS app, the Android app, or the listener website. The same instructions are published at https://audestra.com/delete-account.html without requiring sign-in. To request access to, correction of, or deletion of your personal information if you cannot use in-app deletion, contact us at audestra@ajilus.com; we will verify your identity before acting on the request and respond within a reasonable time.

Depending on where you live, you may have additional rights under applicable privacy law, such as the right to data portability or to lodge a complaint with a supervisory authority. Contact us to exercise these rights.

8. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at audestra@ajilus.com so we can delete it.

9. International Users

The Service is operated from and primarily intended for users in the United States. If you access the Service from outside the United States, your information will be processed in the United States, which may have different data protection laws than your country of residence.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the effective date above and, for material changes, provide reasonable notice through the Service.

11. Contact

Questions about this Privacy Policy can be sent to audestra@ajilus.com.