Privacy Policy

Last updated: September 6, 2026

Weekbeat is a slow-discovery music app that recommends one artist per week. This policy explains what we collect, why, and the choices you have.

Who is responsible for your data

Weekbeat is operated by Toni Reina, an independent developer based in Spain, who is the data controller for the personal data described in this policy. You can reach us at hello@weekbeat.net.

Information we collect

• Account: when you sign in with Google or Apple, we receive a basic identifier and your email address to create and secure your account. We do not receive your Google or Apple password.
• Streaming data: if you connect a streaming platform (currently Spotify), we access your top artists, followed artists, and artists from your saved albums and liked tracks. We use this only to learn your taste and build recommendations. We store the access tokens needed to do this on your behalf.
• Activity: the artists we recommend, the previews you like or skip during discovery, your weekly selections, and your save/skip verdicts.
• Notifications: if you enable push notifications, we store a device push token so we can deliver weekly reminders and content unlocks.
• Usage analytics: how you move through the app — which of our screens you open (by name, such as “Home” or “History”, never the artist or page you are looking at), when you open and close the app, when you start and finish an elimination round, when a week is revealed, when you save an artist, when you play a preview, when you link a streaming platform, and when you turn notifications on or off. This includes masked screen recordings of your sessions: text and images are hidden before the recording leaves your device, so a recording shows layout and interaction rather than content. So that we can read these figures by group rather than one person at a time, we also attach the week you joined, which streaming service you have linked (if any), and your notification and appearance settings. We do not record your email, your messages, or the names of artists you see. You can turn this off at any time under Profile → Share usage data, and nothing further is collected once you do.
• Waitlist: if you join the waitlist on weekbeat.net, we collect your email address and, if you tell us, which music service you listen on. We use this only to let you know when Weekbeat is available, and every message includes an unsubscribe link.

How we use your information

• To generate your weekly artist recommendation and tailor the discovery flow to your taste.
• To produce and display the editorial content for each weekly artist.
• To send the notifications you’ve opted into.
• To operate, secure, and improve the app.

Legal bases

• Providing the app — your account, the library import you ask for by connecting a streaming platform, and your weekly recommendation — is processed to perform our contract with you (GDPR Art. 6(1)(b)).
• Push notifications and the waitlist rely on your consent (Art. 6(1)(a)), which you can withdraw at any time by disabling notifications in Profile or using the unsubscribe link.
• Usage analytics relies on our legitimate interest in understanding how the app is used so we can improve it (Art. 6(1)(f)). You can object at any time by turning off Share usage data in Profile, which stops collection immediately.
• Keeping the service secure and diagnosing faults relies on our legitimate interest in operating a working, non-abused service (Art. 6(1)(f)).

How your information is shared

• We do not sell your personal information.
• Authentication providers (Google, Apple) and streaming providers (Spotify) process data as needed to sign you in and import your library, under their own privacy policies.
• Service providers help us run the app — push notification delivery (Expo), application hosting, and database hosting. They process data on our behalf.
• Our waitlist is hosted by Kit (kit.com), which stores the email address and music service you give us and delivers the launch announcement, under its own privacy policy.
• Usage analytics and session recordings are processed by PostHog, on their EU infrastructure, on our behalf and under their own privacy policy.
• We use third-party music data sources (such as MusicBrainz and Last.fm) and a large-language-model provider to generate artist information and editorial content. These receive artist metadata, not your personal account or listening data.
• We may disclose information if required by law or to protect the rights, safety, and security of our users and the service.

Where your data is processed

Our servers and database are hosted in the United States, as are our diagnostics, notification delivery, language-model, and waitlist providers, so your data is transferred outside the European Economic Area. Usage analytics is the exception: PostHog processes it on EU infrastructure, so that data does not leave the European Economic Area.

These transfers rely on the safeguards permitted under Chapter V of the GDPR — standard contractual clauses and, where a provider is certified, the EU–US Data Privacy Framework. Email hello@weekbeat.net for a copy of the safeguards that apply.

Data retention and deletion

• Account and activity data is kept for as long as your account exists. Deleting your account from Profile → Delete account removes it, along with your history, saved artists, and streaming tokens, immediately and permanently. This cannot be undone.
• Sign-in sessions expire on their own: access tokens after one hour, refresh tokens after 30 days. Disconnecting a streaming platform deletes the stored tokens for it, push tokens are deleted when you disable notifications, and waitlist emails are kept until you unsubscribe.
• Diagnostic and crash reports are kept only for a short troubleshooting window and then deleted automatically.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a portable copy. Where we rely on your consent, you can withdraw it at any time without affecting processing already carried out.

You can disconnect your streaming platform, toggle notifications, and delete your account directly in the app. For anything else, email hello@weekbeat.net.

You also have the right to complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es); you may also contact the authority where you live.

Security

We take reasonable measures to protect your information, including encrypted transport and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Weekbeat is not directed to children under 14, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above when we do. Continued use of the app after changes take effect constitutes acceptance.

Contact

Questions about this policy? Email hello@weekbeat.net.