DIVE MUSIC DISCOVERY
Privacy Policy
Controller: Dive Music Discovery (“DMD”, “Dive”, “we”), operated by its developer, an individual based in Brazil, who is responsible for the service and is the controller of the personal data processed in it.
Privacy and data subject requests: support@divemusicdiscovery.com
Related documents: Terms of Use · Community Guidelines · Delete your account
When the service is transferred to a company, we will publish a new version of this document with its legal name, registration number and address, and tell you in the app. Until then, any request — including about personal data — is handled at the contact address above.
In short (the full text below is what applies):
- We collect what the account and the features you use need: email, username, date of birth (only for the minimum age), what you publish and log, and app usage data.
- We do not sell data, have no ads and do not track you across other apps or websites.
- You choose what is public: a private profile, private listens and private lists stay with you.
- You can turn analytics off, download a copy of your data and delete your account from inside the app.
- We use providers such as Supabase and Cloudflare, and some data is processed outside Brazil, with safeguards.
- For any request about your data: support@divemusicdiscovery.com. We answer within 15 days.
1. What this Policy covers
1.1. This Policy explains how Dive Music Discovery (DMD) collects, uses, shares, protects and deletes personal data in its iPhone and Android apps and on the pages at divemusicdiscovery.com.
1.2. It applies to visitors of the public pages, to account holders and to anyone who contacts support. Part of what we describe depends on the feature used, the platform and your settings.
1.3. DMD does not host or play music. When you open a link to another service, that service’s privacy policy applies.
1.4. This Policy is transparency, not a blanket consent. Where the law requires specific consent, we will ask for it separately and give you a simple way to withdraw it.
1.5. This Policy exists in Portuguese and English. If the versions differ, the Portuguese version prevails, without prejudice to rights the law of your country gives you.
2. Who the controller is and how to reach us
2.1. The controller is the developer of Dive Music Discovery, an individual based in Brazil.
2.2. Requests for access, correction, deletion, portability, objection and the other data subject rights can be made at support@divemusicdiscovery.com. It is the same address as support, and it serves both purposes.
2.3. DMD is a small-scale processing agent and, as Brazilian data protection authority (ANPD) Resolution CD/ANPD No. 2/2022 allows, does not appoint a data protection officer; the channel for data subjects is the address above, handled by the controller directly. If that changes, the officer will be named here.
3. Data you give us
3.1. Account: account identifier and sign-in email. When you sign in with Apple or Google, we receive the account identifier and the email from the provider (with Apple, this may be the private relay address) and, when the provider sends them, a name and a photo. DMD does not create or store a password.
3.2. Date of birth: the date you declare when you create your account, used only to confirm the minimum age of 16 — including for accounts created before the app started asking for it. It is kept in a table only you can read: it does not appear on your profile, in the feed, in search, in statistics or in any social feature, and it is not used for personalisation, advertising or recommendations. It is deleted with your account and included in “Download my data”.
3.3. Profile: username, display name and, if you provide them, bio, photo, favourite genres, favourite album, profile appearance and personalisation items.
3.4. Music content: ratings, reviews, highlights, favourite tracks, lists and their items (including the private Listen Later list), likes, logged listens and their dates, physical collection, raffle exclusions and discovery preferences, such as your preferred music service.
3.5. Social: who you follow, who you block, reports you make or receive, and the data needed for moderation.
3.6. Support: the text of support requests opened in the app, their category and the item they refer to, and, attached to the request so the problem can be reproduced, the app version and build, operating system, device model, interface language and the screen it was opened from. Messages sent to support@divemusicdiscovery.com reach the developer’s mailbox. Do not send passwords, sign-in codes, bank details or other unnecessary information.
4. Data generated by use
4.1. Participation: Album of the Day views, mission progress, XP, levels, streaks, titles, badges, rewards and statistics derived from what you log.
4.2. Compatibility and recommendations: scores calculated from ratings, shared listens and preferences, for features such as taste compatibility, taste neighbours, charts and suggestions.
4.3. Premium: DMD sells nothing today and receives no payment or purchase data. If DMD granted Premium to your account, we keep the plan, its state and its duration.
4.4. Technical and security: account and session identifiers, platform, app version, timestamps and operation or failure events. IP addresses and request data are processed by infrastructure providers to deliver the service, protect against abuse, rate-limit and keep technical logs.
4.5. App usage (analytics): we record, linked to your account, events such as opening the app, opening an album or a list, opening an album in a music service (without recording which), using the raffle and generating a collage, with the platform and app version, to learn what to improve. These events are deleted after 180 days. You can turn this collection off in Settings → Analytics; once off, the server stops recording it. Test and automated accounts are left out of the counts.
4.6. Search: the text you type into search is added, per day, to a count with no owner — it tells us what people look for most and what the catalogue cannot find — and that count is deleted within 365 days. The per-person record keeps that a search happened, but not the text. In catalogue search we also record, linked to the account, a code derived from the term (not the text) and how many results came back, for 90 days, to run search and the addition of new albums to the catalogue.
4.7. Searching outside the catalogue: when you look for an album or artist DMD’s catalogue does not have yet, the app queries MusicBrainz, run by the MetaBrainz Foundation, directly, sending the search term; the covers for those results come from the Cover Art Archive, run by the Internet Archive. These services receive the term and technical connection data, such as the IP address, but not your account.
4.8. Public web pages: when a share page is opened, we record the event type, the platform, whether the visit looks automated, the referring domain and an encrypted key for the item. We do not record IP addresses or identify the person in these metrics, and the site sets no cookies.
4.9. Anti-bot check: when you sign in or create an account by email, the app shows Cloudflare’s Turnstile check, which analyses technical signals from the device and browser to tell people from bots. DMD only receives the result of the check.
4.10. On your device: catalogue, list and listen caches, local search history, language, theme and music service preferences, local raffle history and temporary images. This data stays on the device. On Android, app backup is disabled; on iPhone, it may be included in the device backup, depending on your system settings.
5. Why we use data, and on what legal basis
| Purpose | Data | Legal basis (Brazilian LGPD) |
|---|---|---|
| Create, authenticate and maintain the account | email, identifiers, session, required profile | Performance of a contract (art. 7, V) |
| Confirm the minimum age | declared date of birth | Performance of a contract (art. 7, V) and compliance with legal obligations to protect children and adolescents (art. 7, II) |
| Lists, listens, ratings, XP, statistics and the support you ask for | activity and settings | Performance of a contract (art. 7, V) |
| Show the profile and content you made public | profile, ratings, reviews, lists, shared listens | Performance of a contract, according to your visibility choices |
| Security, abuse prevention and moderation | technical logs, reports, sanctions | Legitimate interest (art. 7, IX) and, where applicable, compliance with a legal obligation |
| Premium granted by DMD | plan, state and duration | Performance of a contract (art. 7, V) |
| Improving the app (analytics) | usage events, aggregated searches | Legitimate interest (art. 7, IX), minimised, with an off switch in Settings |
| Handling support requests with help from an AI assistant | request content | Performance of a contract and legitimate interest |
| Personalised advertising and marketing | — | We do not do it |
5.1. We do not rely on consent for what is essential to the service, and we do not use performance of a contract to justify collection that is not necessary.
5.2. Music preferences can, in some contexts, allow inferences about personal characteristics. We do not classify people by sensitive attributes and do not make such inferences.
6. What other people can see
6.1. Public profile: others can see your username, display name, bio, photo, appearance, profile items, ratings, reviews, public lists, shared listens, counts and social interactions.
6.2. Listens: sharing starts on. Before your first listen is logged, the app tells you and offers, right there, to keep listens private; the listen is only published after you answer. You can change this in Settings → Listening Privacy. Shared listens appear in the feed and on your profile, and up to three recent listens appear in the public web preview of your profile.
6.3. Private profile: your profile and everything on it is visible only to you, throughout the Service — app, feed, search, album pages and shared links. People you follow can see that you follow them, with your name, username and photo. Aggregate album averages and counts may include your ratings without identifying you.
6.4. Lists: you choose each list’s visibility; only public lists appear on public web pages. The Listen Later list is always private.
6.5. Public links: previews of public profiles and lists can be opened by anyone with the link. These pages ask search engines not to index them, which does not prevent screenshots or republication by others. Artist and album pages are indexable.
6.6. Profile photo: the photo file has a random address, which DMD only hands out to people who can see your profile. Anyone who already has that address can open the photo directly while it exists, even if the profile later becomes private. Changing or removing the photo deletes the previous file.
6.7. Your date of birth, your email and your settings are never shown to other people.
7. Who data is shared with
We do not sell personal data, show ads or share data for advertising. The services below process data on DMD’s behalf, as processors, or take part in the service because you chose them.
7.1. Supabase: authentication, database, profile photo storage and server functions, including sync and account deletion.
7.2. Cloudflare: public pages, delivery of the catalogue and images (catalogue covers and artist photos are served from our own addresses), share page metrics, forwarding of the support email and the Turnstile anti-bot check.
7.3. Resend: sending sign-in emails (sign-in link or code), from auth@divemusicdiscovery.com.
7.4. Microsoft: hosts the mailbox the support address forwards to.
7.5. Anthropic: provides the artificial intelligence assistant that helps triage and draft answers to support requests. It processes only the request content and the data needed to answer it; we do not allow that content to be used to train models.
7.6. Apple and Google: take part in sign-in when you choose them. On iPhone, when you choose to sign in with Google, sign-in uses Google’s official kit, which, according to Google’s own privacy declaration, may collect name, email, identifiers, phone number, approximate location, device identifier and usage data, to run sign-in and for Google’s analytics, under Google’s privacy policy. DMD receives from Google only the account identifier, the email and, when sent, name and photo.
7.7. Services the app contacts directly: MusicBrainz and the Cover Art Archive when searching outside the catalogue (section 4.7), and YouTube, from Google, for video thumbnails on artist pages. When you open a listening link (Apple Music, Spotify, YouTube Music, Deezer and others), the destination service receives browsing data under its own policy.
7.8. Authorised people at DMD access only what is needed for support, security and moderation, with access limited by role and logged.
7.9. We may share data when the law or an order from a competent authority requires it, or to defend rights in legal proceedings.
8. International transfers
8.1. Supabase’s database and backups are in São Paulo, Brazil. Supabase processes technical logs in the European Union and transfers data to Singapore and the United States under standard contractual clauses. Cloudflare, Resend, Microsoft, Anthropic, Apple and Google operate on global networks or in the United States.
8.2. We also keep our own encrypted database backups, stored with Cloudflare and on an archive disk kept by the developer.
8.3. Transfers subject to the LGPD follow its article 33 and, where needed, the standard clauses of ANPD Resolution CD/ANPD No. 19/2024 or equivalent provider mechanisms.
9. How long we keep data
| Data | Period |
|---|---|
| Account, profile, date of birth, content, followers, support requests, acceptances and consent choices | For as long as the account exists |
| Removed listen and deleted list | Disappear everywhere immediately; only a record flagged as removed remains, shown nowhere, so your other devices learn about the removal, until the account is deleted |
| Usage events (analytics) | 180 days |
| Catalogue search record linked to the account (term code, no text) | 90 days |
| Daily count of searched terms, with no owner | 365 days |
| Album of the Day views | 90 days |
| Feed activity | The 150 most recent per person |
| Window to cancel a deletion | 30 days, unless you bring it forward |
| Record that an account was deleted, and of deletion requests received by email | The account identifier is replaced by an irreversible code 90 days after completion; only the fact and the dates remain |
| Technical file-removal queue | 180 days after removal |
| Database backups | Supabase: 7 days. Our own encrypted copies: up to about 5 weeks in the cloud and up to about 12 weeks on an archive disk. Deleted data leaves the backups at the end of these periods |
| Messages sent to the support email | For as long as needed to handle the request and show that it was handled |
| Provider technical logs and caches | According to each provider’s retention |
9.1. Records needed to meet a legal obligation, protect rights or prevent fraud may be kept after deletion when justified, with restricted access and a proportionate period.
10. Deletion
10.1. You can delete your account in Settings → Delete Account, or through divemusicdiscovery.com/delete-account if you no longer have the app. The request hides the account immediately and opens 30 days to change your mind; after that, the account and the data linked to it are erased from the database, and the profile photo is erased from storage. We do not keep anonymised reviews.
10.2. You can also delete parts of your data without deleting the account — ratings and reviews, lists, listens and photo. The divemusicdiscovery.com/delete-account page describes each path and what remains.
10.3. Data stored on your own device is not erased by the server, because it never left the device. You can clear it in Settings → Clear All Data, and uninstalling the app removes it too.
10.4. Accounts that performed auditable administrative actions may need an assisted procedure; support handles the request.
11. Your rights
11.1. Under the LGPD, you can ask for confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or non-compliant data, portability, information on who we share it with, deletion of data processed on the basis of consent, withdrawal of consent, objection and review of automated decisions, as the law provides.
11.2. Much of this is in the app itself: edit your profile and content, change visibility, turn analytics off in Settings → Analytics, download a copy of everything you created in Settings → Your data → Download my data, and delete your account. For anything else, write to support@divemusicdiscovery.com.
11.3. We may ask for proportionate identity verification before handing over data or deleting an account — as a rule, that the request comes from the account’s email or that you confirm through it. We never ask for a password.
11.4. We answer within 15 days and explain any limitation. You do not need Premium to exercise data protection rights.
11.5. You can also lodge a complaint with Brazil’s data protection authority (ANPD) or the authority where you live.
12. Security and incidents
12.1. We use technical and administrative controls to limit improper access, such as authentication, row-level access policies in the database, separation of duties, encrypted connections and logging of administrative operations. No internet-connected service is perfectly secure.
12.2. We regularly review database permissions and what is public, and fix the flaws we find.
12.3. If a security incident involving personal data may cause relevant risk or harm, we will notify the ANPD and the people affected, as the law and ANPD Resolution CD/ANPD No. 15/2024 require.
13. Children and adolescents
13.1. DMD is for people aged 16 or over and is not directed at children. Age is checked against the date of birth declared at sign-up, and sign-up does not complete below that age. If app stores start offering an age range signal, we may use it as well, and will update this Policy first.
13.2. If we identify an account below the minimum age, access is ended and the data is deleted, except what the law requires us to keep. If you know of such an account, write to support@divemusicdiscovery.com.
13.3. The date used to check age is limited to what is necessary, protected and not reused for other purposes.
14. Cookies, permissions and tracking
14.1. The site sets no cookies, and DMD has no advertising SDK and does not track you across other companies’ apps and websites. Infrastructure providers still process IP addresses and connection data to deliver the pages.
14.2. The app asks for permission only when it needs it: to choose a profile photo (through the system picker) and to save collages to your photo library. You can say no.
14.3. DMD does not collect location, contacts, camera, microphone, health data or an advertising identifier (what Google’s sign-in kit handles is in section 7.6).
15. Changes to this Policy
15.1. Each version has its own date and a permanent address; the current one is at divemusicdiscovery.com/privacy. Relevant changes to collection, purposes, sharing or your rights will be announced in advance where the law requires it.
15.2. Where necessary, we will ask for specific consent; continuing to use the app is not consent to optional purposes.
16. Contact
Controller: the developer of Dive Music Discovery, an individual based in Brazil.
Privacy and support: support@divemusicdiscovery.com
Website: divemusicdiscovery.com