Privacy Policy

This Privacy Policy is provided by MMC Media LLC, doing business as Psalmix ("we," "us," or "our").

Effective Date: June 12, 2026

This policy covers both the Psalmix website (psalmix.com) and the Psalmix mobile applications for iOS and Android.

What changed on July 25, 2026: we added the option of advertising cookies on our website, so we can measure whether our ads work. They are off by default and load only if you opt in — accepting analytics does not accept advertising. They never run inside the app, and we never share your listening history with advertisers. Previously this policy said we used no advertising cookies at all; sections 4, 8 and 12 now describe exactly what we do and how to opt out.

What changed on July 29, 2026: for people who opted in to advertising and arrived by clicking one of our ads, we now report account signups (including via Google or Apple), checkout starts, trial starts and payments to Meta from our own servers as well as from the pixel. This is how we find out which ads bring people who actually subscribe, rather than only which ads bring clicks — a payment is confirmed by our payment provider after you have left the page, and a Google or Apple signup finishes somewhere the pixel is never loaded. What is sent is the ad click identifier, a one-way hashed email address, and, for payments, the amount paid; never your listening history, and never anything if you did not opt in. Section 4 describes it in full.

What changed on August 9, 2026: on our public marketing and signup pages — and only if you opt in to analytics cookies — we now record how the page is used so we can replay it and see where people get stuck. A recording shows mouse movement, clicks and scrolling; all text on the page is masked in your own browser before the recording is sent — both what you type and what the page shows back to you — so we receive a moving wireframe, never readable words. Recording never runs on the pages where you listen, browse your library, or manage your account, and it is never used for advertising. Recordings are stored in the United States and deleted after 30 days. Sections 1, 4, 8, 9, 11, 12 and 13 describe it in full — Section 4 is where PostHog is named as our processor — and "Essential only" in the cookie banner declines it outright.

What changed on August 10, 2026: if you opt in to analytics cookies, we now count a short, fixed list of named steps — being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, starting playback for the first time, and the steps of the signup form itself, such as moving between fields, a validation message, or choosing to sign up with Google or Apple. Some of these run before you have an account — the steps of the signup form, and being shown a price or pressing play on our public marketing pages — while starting checkout and seeing a subscription confirmed can only happen once you are signed in. Nothing is counted on a shared song link you open without an account. They carry nothing about what you listen to: no song, playlist, artist or station is ever attached, and the address of any page inside the app is replaced with a placeholder before it is sent. Where something goes wrong we record a fixed category — for example "that email is already registered" — never the error text itself. We also deliberately do not join the two halves: when you sign in, what you did beforehand is not linked to your account, and the session recording of your visit before signing up cannot be looked up from it. Session recording is unchanged and still never runs on the pages where you listen, browse your library, or manage your account. We also stopped naming Mixpanel as a provider — it was listed but never actually received anything, and leaving it in a list of who gets your data would have been misleading. Section 8 describes all of this in full.

What changed on August 13, 2026: on the same public marketing and signup pages, and under the same analytics opt-in, we now also add up where on a page people click and how far down they scroll, so we can see which parts of a page get used and which get missed. This is the same mouse activity a session recording already captured, counted as positions on the page rather than watched back one visit at a time — it adds no new kind of information about you, and it is not tied to your account. It carries no text: a click is recorded as a position, never as what you clicked on. Like recording, it runs only on those public pages — never on the pages where you listen, browse your library, or manage your account — and choosing "Essential only" declines it outright. Section 8 describes it in full.

1. Information We Collect

2. How We Use Your Information

• To provide and improve our music streaming service
• To verify your age at signup and enforce our minimum age requirement
• To generate personalized recommendations
• To track achievements and progress
• To process subscriptions and manage billing
• To send transactional emails and, if you opt in, push notifications
• To deliver over-the-air updates to the mobile app
• To ensure content remains family-appropriate
• To prevent fraud and abuse

Refund Policy: For our refund policy, see Section 5 of our Terms of Service. Mobile in-app purchases are subject to Apple App Store or Google Play refund policies.

Listening Activity as Sensitive Data

Because our catalogue includes worship and gospel music alongside every other genre, your listening history may reflect religious preferences or beliefs. We treat this as sensitive personal information. We do not sell your listening history. We do not share it with advertisers or advertising networks. It is used only to improve your personal recommendations and service experience.

3. AI-Generated Content

4. Service Providers & Information Sharing

We do not sell, trade, or rent your personal information to third parties. We share information only with the service providers listed below, and only for the purposes described. One of them — Meta, for advertising measurement — receives nothing at all unless you opt in to advertising cookies.

Web Service Providers

• Creem (web payment processing): Processes web subscription checkouts. Receives the information needed to bill you (name, email, payment instrument). We do not store full card numbers. See creem.io/privacy.
• PostHog (product analytics & session replay): Helps us see how visitors move through Psalmix, so we can find where people get stuck. PostHog loads only after you opt in to analytics cookies. It does two separate things, with different limits. Session replay runs only on our public marketing and signup pages, and never on the pages where you listen, browse your library, or manage your account. Product analytics — a short list of named events such as completing signup, viewing a price, starting checkout, and starting playback — runs both on those public pages and inside the app once you are signed in. Those events record that something happened, never what you listened to: no song, playlist, artist, or station is ever included, and the address of any page inside the app is replaced with a placeholder before anything is sent. When you sign in we start a new, unlinked identity, so the events and the recording from before you had an account are not joined to it. It acts as our data processor under a Data Processing Agreement — it processes this information only on our instructions, and does not use it for its own purposes or for advertising. Recordings are hosted in the United States and deleted after 30 days. All text on the page — what you type and what the page displays back to you — is masked in your browser before anything is sent, so PostHog never receives readable content. Withdraw consent anytime in Settings → Privacy. See posthog.com/privacy.
• Google Tag Manager: Manages our analytics scripts using Google Consent Mode. No analytics scripts are loaded until you give consent through our cookie banner. See policies.google.com/privacy.
• Vercel: Hosts our website and processes standard server logs (such as IP address and request data) needed to serve and secure the site. See vercel.com/legal/privacy-policy.
• Meta / Facebook (advertising measurement): If — and only if — you opt in to advertising cookies, the Meta pixel loads on our public marketing pages and tells us whether an ad led to a visit or a signup. Meta receives your IP address, browser information, and the marketing page you viewed. It does not receive your listening history, playlists, or any song data, and it never loads on the pages where you listen, browse your library, or manage your account. Under California law this counts as "sharing" for cross-context behavioral advertising. Withdraw consent anytime in Settings → Privacy. See facebook.com/privacy/policy.
  
  Server-side conversion reporting. Under the same opt-in, and only for people who reached us by clicking one of our ads, we also report account signups (including via Google or Apple), checkout starts, trial starts and payments to Meta directly from our servers. We store that ad's click identifier on your account when you sign up, and when one of those events happens we send Meta that identifier, a one-way hashed (scrambled and unreadable) version of your email address, and, for payments, the amount paid. We do this because the events that matter do not happen in a web page: a payment is confirmed by our payment provider after you have left the site, and a Google or Apple signup completes on a part of our site the pixel is never loaded on. What we do not send: your email address in readable form, your IP address, your device or browser information, and — without exception — anything about what you listen to. If you did not opt in to advertising, nothing is reported from our servers. If you withdraw, the stored click identifier is deleted from your browser immediately, and our servers stop reporting for your account as soon as the withdrawal is connected to it — immediate when you make the change while signed in.

Mobile App Service Providers

• Apple App Store / Apple Sign-In: If you sign in with Apple, Apple shares a unique identifier and (if you choose) your name and email with us. In-app purchases on iOS are processed by Apple under its own privacy policy.
• Google Play / Google Sign-In: If you sign in with Google, Google shares a unique identifier and basic profile information with us. In-app purchases on Android are processed by Google under its own privacy policy.
• RevenueCat: Verifies App Store and Google Play purchase receipts and manages subscription state. RevenueCat receives the receipt and a pseudonymous user identifier — not your payment card. See revenuecat.com/privacy.
• Expo: Used to deliver push notifications and over-the-air updates to the mobile app. Expo receives push tokens (when you opt into notifications) and basic device information needed to deliver updates. See expo.dev/privacy.

Shared Infrastructure (Web and Mobile)

• Supabase: Hosts our application database, authentication, and file storage. Substantially all personal information described in this policy is stored on Supabase's infrastructure on our behalf. See supabase.com/privacy.
• Cloudflare R2: Stores audio files and images we serve to you.
• Resend: We use Resend on our backend to deliver authentication emails (such as one-time verification codes), account notifications, and other transactional emails to both web and mobile users. Resend processes recipient email addresses and message content on our behalf. See resend.com/legal/privacy-policy.

Other Disclosures

• Legal Requirements: When required by law or to protect our rights.
• Business Transfers: In connection with a merger or acquisition (with notice to users).
• With Your Consent: When you explicitly agree to share information.

5. Age Requirements & COPPA Compliance

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Authentication and database access secured through Supabase, with row-level security policies enforcing per-user access
• Regular security audits and monitoring
• Limited access to personal information on a need-to-know basis
• Regular software updates and security patches

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal information
• Correct: Update or correct inaccurate information
• Delete: Request deletion of your personal information
• Portability: Export your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications and disable push notifications
• Restrict: Limit how we use your information

To exercise other privacy rights or for assistance with account deletion, contact us at hello@psalmix.com

8. Cookies and Tracking

On the web we use three kinds of cookies, and you control two of them independently through our cookie banner:

• Essential cookies — to keep you logged in, secure your session, and remember your preferences. These are required for the site to work and are always on.
• Analytics cookies — PostHog, managed via Google Tag Manager with Consent Mode. Off unless you opt in. PostHog records how our public marketing pages are used, and counts a short list of named events describing how far you get through signup and checkout — some on our public pages before you have an account, the rest once you are signed in. Both are described below.
• Advertising cookies — used to measure whether our advertising works, so we can tell which ads brought people to Psalmix and stop paying for the ones that don't. This means the Meta (Facebook) advertising pixel, and the conversion reports our servers send to Meta for people who arrived from one of our ads. Off by default, and only ever on if you opt in — one choice governs both.

Accepting analytics does not accept advertising — they are separate choices, and you can change either at any time in Privacy Settings. For full details and controls, see our Cookie Policy.

Session recording, and its limits. If you opt in to analytics cookies, PostHog records how our public marketing and signup pages are used and lets us replay it — mouse movement, clicks, scrolling, and moving between pages — so we can see where people get stuck before they ever create an account. This is web only; there is no session recording in the mobile app.

Heatmaps, and why they are the same promise. Under the same opt-in and on exactly the same public pages, we also add up where people click and how far they scroll, across everyone, into a heatmap. A recording answers "what did this one visit do"; a heatmap answers "which part of this page does everyone use" — the same mouse activity, counted rather than watched. A click is stored as a position on the page, never as what sits at that position, so no button label, link text, or any other words are collected. It is not attached to your account even when you are signed in, because it does not run on the pages you see while signed in. Every limit below applies to it unchanged: it never runs on the pages where you listen, browse your library, or manage your account, and if you are on a page whose web address carries anything beyond a campaign tag, nothing is collected there at all.

Named events, and what they are not. Understanding where people give up did not stop being useful the moment you created an account, so if you opt in to analytics cookies we also record a short list of named events: completing signup, being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, and starting playback for the first time. Because the two halves of a visit are deliberately kept apart, pressing play while signed out and again after signing in counts once on each side rather than once overall. Once you are signed in these are tied to your account, so we can tell one person's journey from another's. All of them are recorded by your browser as you go — none of them are sent from our servers, and none of them is a record of a payment. What you actually paid, and when, lives with our payment provider and in your account, described in Section 4.

Some of them run before you have an account. The signup form is the single place where knowing what went wrong matters most, and everyone filling it in is by definition not signed in yet — so the steps of that form are recorded too: opening the page, moving between fields, a validation message such as "that email is already registered", choosing Google or Apple instead, and submitting. These are not tied to any account, because at that point there is not one. Where a step fails we record a fixed category, never the error message itself, and never the address you typed — if we suggest a correction to an obvious typo, only the domain (for example "gmail.com") is counted.

Two practical notes, so this is not overstated. If you sign up with Google or Apple, our server leaves a five-minute first-party cookie called psx_signup_completed on the way back, holding only which provider you used, so your browser can count the signup — the account is created on our server, where the analytics code does not run. It carries no identifier, and if you have not opted in it is discarded without sending anything. Separately, withdrawing consent takes effect immediately in the tab you withdraw it in and on every page load after that; a different tab you already had open may keep its recorder running until you reload or navigate it.

We do not join the two halves, on purpose. The moment you sign in, we start a fresh, unlinked identity in PostHog. What you did before you had an account — including the masked recording of you filling in the signup form — is not attached to your account and cannot be looked up from it. This costs us something real: we cannot follow one person from first visit through to payment as a single path. We would rather lose that measurement than turn a recording made of a stranger into a recording of you.

They are not a record of what you listen to. No song, playlist, artist, or station identifier is ever attached to one of these events — "playback started" says that you pressed play, never what you pressed play on. The web address of any page inside the app is replaced with a placeholder before anything is sent, so the page you were on cannot reveal it either. We hold this line deliberately: our catalogue includes worship and gospel music, and a listening history could suggest something about your religious beliefs. That is information we have chosen not to collect at all rather than promise to handle carefully. Session recording still never runs on these pages.

What a recording can never contain — and these are hard limits, not intentions:

• Readable text of any kind. Every piece of text on the page is replaced with a placeholder in your own browser before the recording is sent — not only what you type into a form, but any text the page displays back to you, such as an email address shown on a confirmation screen. A recording is a moving wireframe: layout, cursor, clicks and scrolling, with blocks where the words were. The words themselves never leave your device, so neither we nor PostHog can recover them.
• Anything you do in the app. Recording runs only on our public marketing and signup pages — the ones anyone can read without an account, like this one. It never runs on the pages where you listen, browse your library, or manage your account, so a recording contains no listening history, no playlists, and no song data.
• A recording is never used for advertising, and is never sent to an advertising network. PostHog is our processor, not an advertiser.

Recordings are stored in the United States and deleted after 30 days. Choose "Essential only" in the cookie banner to decline recording entirely, turn analytics off later in Privacy Settings, or send a Global Privacy Control signal — any of the three stops it.

Two limits we place on advertising, deliberately. Advertising cookies run only on our public marketing pages — the ones anyone can read without an account — and never on the pages where you listen, browse your library, or manage your account. And we never send what you listen to, or any song or playlist information, to an advertising network. Advertising measurement can see that a visit, a signup, a trial or a payment happened; it cannot see what music was involved. That second limit holds for the conversion reports our servers send as well as for the pixel — there is no field in them that could carry a song, artist, playlist or genre.

We honor Global Privacy Control (GPC) browser signals. When a GPC signal is detected, analytics cookies are disabled unless you have explicitly opted in — and advertising cookies are disabled outright, even if you previously opted in, because under California law a GPC signal is itself a valid opt-out of sharing.

We do not use third-party analytics or advertising trackers in the mobile app. If this changes, we will update this policy and provide an in-app consent mechanism.

9. International Transfers

Psalmix is operated from the United States and is intended primarily for users in the United States. If you use Psalmix from another country, your information will be transferred to and processed in the United States, where our service providers (such as Supabase, Cloudflare and RevenueCat) operate. Our analytics processor, PostHog, processes this information in the United States. Where our service providers' data processing agreements include Standard Contractual Clauses (SCCs) or equivalent safeguards for EU and UK personal data, we rely on those safeguards.

Session recordings from our public marketing pages are stored in the United States by PostHog, our analytics processor, wherever in the world you happen to be reading from.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide 30 days' advance notice by email and by posting the updated policy on our website and in the mobile app. Continued use after that period constitutes acceptance. When you create an account, we record your acceptance of these terms and the date accepted.

11. European Union & United Kingdom Privacy Rights (GDPR)

12. California Privacy Rights (CCPA/CPRA)

13. Data Retention

We retain your information only as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained until account deletion, then permanently removed within 30 days
• Push notification tokens: Retained while valid; removed when you disable notifications, uninstall the app, or delete your account
• Consent records: Retained for 7 years for legal compliance
• Payment and subscription records: Retained for 7 years for tax and legal requirements
• Listening history: Retained until account deletion
• Session recordings (public marketing pages, analytics opt-in only): Retained for 30 days, then automatically deleted
• Named analytics events (analytics opt-in only): Kept for no longer than 12 months, after which our analytics provider deletes them on the retention setting we have configured with them. Twelve months is what a signup-and-checkout funnel needs in order to be compared against the same season a year earlier; we have no use for them beyond that. Events recorded before you had an account are not linked to any account and are not retrievable by you or by us as "your" data. Events recorded while you are signed in are keyed to your account, and are deleted along with your account — see below
• Audit logs: Retained for 90 days
• AI support chat logs: Retained for up to 90 days, then automatically deleted

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: