Privacy Policy

Information We Collect

We collect the following categories of information in order to operate NoteBoxd:

• Account Information: NoteBoxd uses Sign in with Apple as its only sign-in method. We receive the email address and a stable user identifier Apple provides when you authenticate. We never collect or store a password.
• Profile Information: your display name, username/handle, bio, and profile picture. Your profile picture is chosen through the system Photos picker — we only receive the single image you select and never gain access to your broader photo library.
• User-Generated Content: album reviews and ratings, comments (including threaded replies), community lists (with their names, descriptions, items, and comments on those lists), and @mentions of other users.
• Social Connections: who you follow, who follows you, accounts you block, and any content or account reports you file.
• Push Notification Data: a device push token (via Apple Push Notification service and Firebase Cloud Messaging) used solely to deliver notifications such as new followers, comments, replies, mentions, likes, and daily task reminders.
• In-App Currency (“Notes”): an append-only record of Notes you earn by completing free daily tasks and spend on cosmetic profile items (Vinyls/Artists). No real money is ever involved.
• Event RSVPs: which user-submitted concerts or events you’ve indicated you’re attending. Event details (venue, date, artist) are free text entered by the person who posts the event — we never access or collect your device’s location.
• Usage Timestamps: basic timestamps such as when you were last active and when content was created or updated, used only for ordinary app functionality like sorting and “last seen” — not for analytics or advertising.

What We Don’t Do

• No advertising, ad networks, or third-party trackers, and no App Tracking Transparency prompt — we don’t track you across other companies’ apps or websites.
• No selling or sharing your personal information with data brokers.
• No real-money payments or in-app purchases anywhere in NoteBoxd.
• No device location access or location tracking of any kind.
• No knowing collection of data from anyone under 16 years old.

How We Use Your Information

We use the information described above to:

• Create, authenticate, and secure your account via Sign in with Apple.
• Provide core functionality: posting reviews and ratings, following and blocking other users, commenting and replying, building and sharing lists, and RSVPing to events.
• Deliver push notifications you’d expect from a social app, like new followers, comments, replies, mentions, and likes.
• Track your Notes balance so you can earn and spend it on cosmetic profile items.
• Monitor, investigate, and enforce our Terms of Service, including reviewing reports and blocks.
• Maintain, secure, and troubleshoot the app.

How Your Information Is Shared

NoteBoxd is a social app, so certain information is visible to other users by design: your username, profile picture, bio, reviews, comments, lists, and follower/following lists are visible to others, subject to any blocking you apply. Beyond that, we share information only with the service providers below, each of which processes data on our behalf:

• Apple — provides Sign in with Apple, our sole authentication method.
• Supabase — our backend provider (Postgres database, authentication, and file storage). Supabase stores essentially all of the data described above on our behalf as our data processor.
• Google Firebase Cloud Messaging — delivers push notifications and receives your device’s push token for that purpose only.
• Our own backend (hosted on Google Cloud Run) — a service we operate ourselves to power music search and album metadata (album art, artist names, release info). It receives your search queries but never your account or identity information. It retrieves this metadata from the Spotify Web API.

Following, Blocking & Reporting

NoteBoxd gives you control over your interactions with other users. Following another account lets you see their reviews and activity. Blocking an account prevents that user from viewing your profile and content, following you, or interacting with your reviews, lists, and comments. You can also report accounts or content you believe violate our Terms of Service; we review reports under our internal moderation procedures and take action against objectionable content or abusive accounts, up to and including suspension or termination.

Data Retention

We retain your account information and content for as long as your account remains active. Account deletion is fully self-service: from your Profile → Delete Account, after typing a confirmation, your account and the personal data and content associated with it are permanently deleted from our systems, except where we’re required to retain certain records to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Children’s Privacy

NoteBoxd is not directed to anyone under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that someone under 16 has provided us with personal information, we will delete it.

Your Rights & Choices

You can access, update, or delete your profile information at any time from within the app, and you can delete your account entirely as described under Data Retention above. Depending on where you live, you may also have rights under applicable data protection law — including, for UK and EEA users, the right to access, correct, delete, or restrict our use of your personal data, to receive a copy of it, and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). To exercise any of these rights or ask a question, contact us using the details below.

Data Security

We rely on our infrastructure providers’ technical and organizational safeguards, and apply reasonable measures of our own, to protect your information from unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we can’t guarantee absolute security.

Third-Party Music Data

Album artwork, artist names, and release information shown in NoteBoxd are retrieved from the Spotify Web API through our own backend. Spotify operates under its own privacy policy, and NoteBoxd is not responsible for its data practices.

International Data Transfers

Our service providers, including Supabase and Google, may store and process information in countries other than your own. Where this occurs, we rely on those providers’ own safeguards for cross-border data transfers.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. If we make material changes, we’ll notify you within the app or by other reasonable means before they take effect, and we’ll always reflect the current version on this page.