✦ LEGAL

Privacy Policy

Your privacy is important to us. Learn how we collect, use, and protect your information.

Last updated: June 9, 2026

This Privacy Policy is provided by MMC Media LLC, doing business as Psalmix ("we," "us," or "our").

Effective Date: June 9, 2026

This policy covers both the Psalmix website (psalmix.com) and the Psalmix mobile applications for iOS and Android.

Privacy at a Glance

We only collect what's necessary for the service

Your data is encrypted and secure

We share your data only with the service providers listed in this policy. We do not sell your personal information.

1. Information We Collect

Account Information

Name and email address
Email address you provide if you join our pre-launch waitlist (used to contact you about availability; you can unsubscribe anytime)
Date of birth (used to verify you meet our minimum age requirement)
Password or, if you sign in with Apple or Google, the unique identifier those providers return to us
Profile preferences and settings
Family member profiles (names and ages, where applicable)
Subscription and purchase records (handled by our payment processors — see Section 4)

Usage Information

Songs listened to, playlists created, and listening history
Achievement progress and activity logs
Device information (model, operating system version, app version)
IP address and approximate location derived from it

Mobile-Specific Information

Push notification tokens: If you enable notifications, we store the device token issued by Apple or Google so we can send you alerts (new music, account activity, reminders). You can revoke this at any time in your device settings.
In-app purchase receipts: When you subscribe through the App Store or Google Play, we receive a purchase receipt from RevenueCat to verify and provision your subscription. We do not see your payment card.
Crash and diagnostic data: Anonymous crash reports and performance metrics may be collected to help us fix bugs.

Content You Create

Playlists and favorites
Profile customizations

2. How We Use Your Information

To provide and improve our music streaming service
To verify your age at signup and enforce our minimum age requirement
To generate personalized recommendations
To track achievements and progress
To process subscriptions and manage billing
To send transactional emails and, if you opt in, push notifications
To deliver over-the-air updates to the mobile app
To ensure content remains family-appropriate
To prevent fraud and abuse

Refund Policy: For our refund policy, see Section 5 of our Terms of Service. Mobile in-app purchases are subject to Apple App Store or Google Play refund policies.

Listening Activity as Sensitive Data

Because Psalmix is a faith-based music service, your listening history may reflect religious preferences or beliefs. We treat this as sensitive personal information. We do not sell your listening history. We do not share it with advertisers or advertising networks. It is used only to improve your personal recommendations and service experience.

3. AI-Generated Content

Important Disclosure: All music on Psalmix is generated using artificial intelligence technology. We want to be transparent about how this works and what data is involved.

AI Music Generation Process

Our music is created using AI models, including OpenAI's API and other AI music generation services. The AI generates original music based on:

Musical themes and genre preferences
Lyrical concepts and topics
Style and mood parameters
Content safety and values-alignment guidelines

Data Sent to AI Services

We do NOT send any personal user data to AI services. Only song generation parameters are processed:

What IS sent: Musical themes, genre specifications, lyrical concepts, style parameters
What is NOT sent: Your name, email, listening history, personal information, or any data that identifies you

These services receive only the creative parameters needed to generate music. They do not receive or store any information about individual users. This is true regardless of whether you use Psalmix on the web or mobile.

AI Service Providers

We use the following AI services for content generation:

OpenAI API: For lyric generation, theme development, and content safety analysis
Suno AI: For music production and audio generation

These services operate under their own privacy policies and terms of service. They only receive anonymized creative parameters from us, never your personal information.

4. Service Providers & Information Sharing

We do not sell, trade, or rent your personal information to third parties. We share information only with the service providers listed below, and only for the purposes described.

Web Service Providers

Creem (web payment processing): Processes web subscription checkouts. Receives the information needed to bill you (name, email, payment instrument). We do not store full card numbers. See creem.io/privacy.
Mixpanel (product analytics): Helps us understand how features are used on the web. Mixpanel loads only after you opt in through our cookie banner and receives usage events tied to a pseudonymous identifier. You can withdraw consent anytime in Settings → Privacy or opt out at mixpanel.com/optout. See mixpanel.com/legal/privacy-policy.
Google Tag Manager: Manages our analytics scripts using Google Consent Mode. No analytics scripts are loaded until you give consent through our cookie banner. See policies.google.com/privacy.
Vercel: Hosts our website and processes standard server logs (such as IP address and request data) needed to serve and secure the site. See vercel.com/legal/privacy-policy.

Mobile App Service Providers

Apple App Store / Apple Sign-In: If you sign in with Apple, Apple shares a unique identifier and (if you choose) your name and email with us. In-app purchases on iOS are processed by Apple under its own privacy policy.
Google Play / Google Sign-In: If you sign in with Google, Google shares a unique identifier and basic profile information with us. In-app purchases on Android are processed by Google under its own privacy policy.
RevenueCat: Verifies App Store and Google Play purchase receipts and manages subscription state. RevenueCat receives the receipt and a pseudonymous user identifier — not your payment card. See revenuecat.com/privacy.
Expo: Used to deliver push notifications and over-the-air updates to the mobile app. Expo receives push tokens (when you opt into notifications) and basic device information needed to deliver updates. See expo.dev/privacy.

Shared Infrastructure (Web and Mobile)

Supabase: Hosts our application database, authentication, and file storage. Substantially all personal information described in this policy is stored on Supabase's infrastructure on our behalf. See supabase.com/privacy.
Cloudflare R2: Stores audio files and images we serve to you.
Resend: We use Resend on our backend to deliver authentication emails (such as one-time verification codes), account notifications, and other transactional emails to both web and mobile users. Resend processes recipient email addresses and message content on our behalf. See resend.com/legal/privacy-policy.

Other Disclosures

Legal Requirements: When required by law or to protect our rights.
Business Transfers: In connection with a merger or acquisition (with notice to users).
With Your Consent: When you explicitly agree to share information.

Third-Party AI Services: Your personal information (name, email, listening history, etc.) is NEVER sent to AI services like OpenAI or Suno. Only anonymized creative parameters are processed to generate music content.

5. Age Requirements & COPPA Compliance

Psalmix is intended for users 13 years of age or older. We are committed to complying with the Children's Online Privacy Protection Act (COPPA).

Minimum Age Requirement

Psalmix is intended for users 13 years of age or older. We collect date of birth at signup to verify this. Users who indicate they are under 13 are blocked from creating an account and directed to a parent. If we become aware that we have inadvertently collected information from a child under 13, we will delete it promptly. To report a concern, contact hello@psalmix.com.

No Child Accounts

We do not offer child accounts. Psalmix is for users 13 and older. Family plans allow up to 6 household members, all of whom must be 13 or older.

6. Data Security

We implement industry-standard security measures to protect your information:

Encryption of data in transit (HTTPS/TLS) and at rest
Authentication and database access secured through Supabase, with row-level security policies enforcing per-user access
Regular security audits and monitoring
Limited access to personal information on a need-to-know basis
Regular software updates and security patches

7. Your Privacy Rights

You have the right to:

Access: Request a copy of your personal information
Correct: Update or correct inaccurate information
Delete: Request deletion of your personal information
Portability: Export your data in a machine-readable format
Opt-out: Unsubscribe from marketing communications and disable push notifications
Restrict: Limit how we use your information

Account Deletion

You can delete your Psalmix account at any time. Here's how:

1. Log in to your Psalmix account (web or mobile)
2. Go to Settings → Account Settings
3. Tap or click "Delete Account" at the bottom of the page
4. Confirm your decision

When you request account deletion, your account enters a 30-day grace period during which you can cancel the request. After the grace period ends, all your personal information, playlists, preferences, and activity history are permanently deleted from our systems and cannot be recovered. If you have an active subscription, it will be cancelled. App Store and Google Play subscriptions must also be cancelled in the respective store to stop future billing.

To exercise other privacy rights or for assistance with account deletion, contact us at hello@psalmix.com

8. Cookies and Tracking

On the web, we use essential cookies (to keep you logged in, secure your session, and remember your preferences) and, only if you opt in through our cookie banner, analytics cookies (Mixpanel, managed via Google Tag Manager with Consent Mode). We do not use advertising or targeting cookies. For full details and controls, see our Cookie Policy.

We honor Global Privacy Control (GPC) browser signals: when a GPC signal is detected, analytics cookies are disabled unless you have explicitly opted in.

We do not use third-party analytics or advertising trackers in the mobile app. If this changes, we will update this policy and provide an in-app consent mechanism.

9. International Transfers

Psalmix is operated from the United States and is intended primarily for users in the United States. If you use Psalmix from another country, your information will be transferred to and processed in the United States, where our service providers (such as Supabase, Cloudflare, and RevenueCat) operate. Where our service providers' data processing agreements include Standard Contractual Clauses (SCCs) or equivalent safeguards for EU and UK personal data, we rely on those safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide 30 days' advance notice by email and by posting the updated policy on our website and in the mobile app. Continued use after that period constitutes acceptance. When you create an account, we record your acceptance of these terms and the date accepted.

11. European Union & United Kingdom Privacy Rights (GDPR)

Applicability: This section applies to users in the European Economic Area (EEA), United Kingdom, and Switzerland.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent: Push notifications and any optional marketing communications
Contract: Providing account services, subscription billing, music streaming
Legitimate Interest: Security, fraud prevention, service improvement
Legal Obligation: Tax, accounting, and age-verification requirements

Your GDPR Rights

Right to Access: View all personal data we hold about you
Right to Rectification: Correct inaccurate or incomplete information
Right to Erasure: Request deletion of your data (30-day grace period applies)
Right to Data Portability: Download your data in machine-readable JSON format
Right to Restrict Processing: Limit how we use your data
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Change your consent preferences anytime in Settings → Privacy
Right to Lodge Complaint: File a complaint with your local Data Protection Authority

How to Exercise Your Rights

Visit Settings → Privacy in your account or email hello@psalmix.com. We will respond within 30 days.

EU Representative

EU and UK users may contact us directly at hello@psalmix.com with any privacy request or question.

12. California Privacy Rights (CCPA/CPRA)

Applicability: This section is written for California residents with reference to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Psalmix may not currently meet the CCPA's applicability thresholds, but we honor the rights described below for all users as a matter of policy.

Categories of Personal Information Collected

Identifiers: Name, email address, account ID, push notification tokens
Demographic Information: Date of birth (for age verification)
Commercial Information: Subscription history, purchase receipts
Internet Activity: Listening history, playlists, app usage
Device Information: IP address, browser type, device type, OS version

We Do NOT Sell Your Personal Information

Psalmix does not sell, rent, or trade your personal information to third parties for monetary consideration, and does not share it for cross-context behavioral advertising.

Your CCPA Rights

Right to Know: What personal information is collected and how it's used
Right to Delete: Request deletion of your personal information
Right to Correct: Correct inaccurate personal information
Right to Opt-Out: Even though we don't sell or share data, you can opt-out of any future sharing
Right to Non-Discrimination: No penalty for exercising your privacy rights

How to Exercise Your Rights

To submit a CCPA/CPRA request, email hello@psalmix.com with subject line "Privacy Request". We will respond to verified requests within 45 days.

Do Not Track & Privacy Signals

Do Not Track: Our website does not currently respond to browser Do Not Track signals. We will update this policy if our practices change.

Global Privacy Control (GPC): We honor Global Privacy Control (GPC) browser signals for all users, not just California residents. When a GPC signal is detected, analytics cookies are disabled unless you have explicitly opted in through our cookie banner.

12-Month Lookback

Upon verified request, we will provide information about personal data collected in the 12 months preceding your request.

13. Data Retention

We retain your information only as long as necessary to provide our services and comply with legal obligations:

Account data: Retained until account deletion, then permanently removed within 30 days
Push notification tokens: Retained while valid; removed when you disable notifications, uninstall the app, or delete your account
Consent records: Retained for 7 years for legal compliance
Payment and subscription records: Retained for 7 years for tax and legal requirements
Listening history: Retained until account deletion
Audit logs: Retained for 90 days

Deletion Process

When you request account deletion, your data enters a 30-day grace period during which you can cancel. After this period, all personal data is permanently deleted from our systems.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Email: hello@psalmix.com

Entity: MMC Media LLC, doing business as Psalmix