Privacy Policy

1. Information we collect

• Account information — your email address and a securely hashed password.
• Service connections — when you link a music service (e.g. Spotify, YouTube, and others) we store the OAuth access and refresh tokens that authorize the sync, the connected account’s identifier, and the permission scopes you granted. Tokens are encrypted at rest.
• Music data — the playlists and track metadata (titles, artists, identifiers) we read from your connected services to perform the syncs you configure.
• Technical data — basic logs (e.g. IP address, timestamps, error traces) needed to operate, secure, and debug the Service.

2. How we use your information

We use your information only to provide and operate the Service: to perform the playlist syncs you set up, to maintain and secure your account, to provide support, and to comply with legal obligations. We do not sell your personal data, and we do not use it for advertising.

3. Google user data

When you connect a Google/YouTube account, we access your YouTube playlists and their items solely to read and write the playlists involved in a sync you configure. SyncIt Music’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not share it except as needed to provide the Service or where required by law.

4. Sharing and third parties

We share data only with the services needed to run SyncIt Music:

• The music services you connect (e.g. Spotify, Google/YouTube, and others) — to read and write the playlists you sync.
• Infrastructure providers — hosting and database providers that store data on our behalf under their own security obligations.

We may disclose information if required by law or to protect the rights, safety, and security of our users and the Service. We do not sell personal data.

5. Retention and deletion

Disconnecting a music service deletes the stored tokens for that connection. Deleting your account removes your account data and connected-service data from our systems within 30 days, except where we must retain limited records to meet legal obligations. You can disconnect a service or delete your account at any time from within the app.

6. Security

Connection tokens are encrypted at rest and transmitted over encrypted connections. No system is perfectly secure, but we take reasonable measures to protect your information.

7. Your rights

Depending on where you live (e.g. under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. To exercise these rights, contact us at the address below; you can also action most requests directly in the app.

8. International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated in the app.

11. Contact

Questions about this policy or your data? Email privacy@bigapp.io.