Privacy policy

Who is responsible

Symphony Atlas is operated by Yunus Emre Pak, an individual based in Istanbul, Türkiye, who is the controller of your personal data (the “veri sorumlusu” under Türkiye’s KVKK). Write to support@symphonyatlas.com about anything in this policy.

What we keep

• Your account: your e-mail address, your password (stored only as a hash by our database provider) or your Google sign-in, your username, and what you add to your profile: display name, picture, bio, location, website and badge.
• What you do here: the works you listen to (for your history and suggestions), ratings, reviews, replies, likes, lists, private notes, favourites, follows, blocks, messages, reports, and what you send us about timings or recordings. Editors’ applications and edits are kept too.
• Your subscription: its plan, status, store and end date. We never see your card or bank details; the payment provider handles them.
• Technical data: to limit how much one visitor can read, we keep a salted hash of a visitor’s IP address, never the address itself, for two days. When a video fails to play we keep the error code and country. Error reports reach us with e-mail and IP addresses removed.
• Usage statistics: pages viewed and a few steps such as starting a recording or opening the subscription page, counted without cookies and without your e-mail or anything you wrote.

Messages are private between the people in a conversation. We read a conversation only when one of them reports it, and every such reading is logged.

Why we use it

• to run your account and the subscription you asked for (a contract with you);
• to keep the service safe, stop abuse and bulk copying, and fix errors (our legitimate interest);
• to understand which parts of the service are used, from statistics that do not identify you (our legitimate interest);
• to keep records that tax and consumer law require (a legal obligation; mostly kept by the payment provider).

We send e-mail only for your account (such as confirming your address or resetting your password) and to tell you about a new message, which you can turn off in Settings. We send no newsletters or advertising.

Cookies

We use only the cookies that keep you signed in. Your light or dark theme choice is kept in your browser’s storage. There are no advertising or tracking cookies, so there is nothing to accept.

Recordings play in YouTube’s player, loaded from youtube-nocookie.com. When you play a video, YouTube may store data in your browser and collect information under the Google Privacy Policy. The payment window on the web is Paddle’s and works under Paddle’s privacy notice.

Who processes it for us

These companies process data only to provide their service to us:

• Supabase: our database, sign-in and file storage, in Frankfurt (EU)
• Vercel: hosting of the website
• Cloudflare: domain name service and forwarding of e-mail sent to us
• PostHog: usage statistics, in the EU, without cookies
• Sentry: error reports, with e-mail and IP addresses removed
• Resend: sending our e-mail
• Paddle: payment, tax and receipts on the web, as reseller
• RevenueCat: keeping the state of your subscription across web and apps
• Apple and Google: payment in the apps, and sign-in with Google
• Google (YouTube): the video player, and checking that recordings are still available

Some of them process data outside Türkiye and the European Economic Area, for example in the United States. They do so under contracts with safeguards such as the European Commission’s standard contractual clauses.

YouTube API Services

We use YouTube API Services to play recordings and to check every night that they are still available. We do not ask for access to your YouTube or Google account and receive no data about you from YouTube. See the YouTube Terms of Service and the Google Privacy Policy.

How long we keep it

We keep your data while you have an account. When you delete your account, your profile and everything you made here are deleted at once, except changes you made to analyses as an editor, which stay without your name. Database backups that still contain it are overwritten within seven days. Payment records stay with the payment provider as long as tax law requires.

Your rights

You can see, correct, download and delete your data. In Settings you can change your profile, use “Download my data” for one file with everything you made here, and delete your account. For anything else, such as objecting to a use or asking what we hold, write to support@symphonyatlas.com; we answer within 30 days. You can also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EU or UK the authority where you live.

Children

Symphony Atlas is not for children under 13. If we learn that an account belongs to someone younger, we delete it.

Security

Connections are encrypted, every table in our database is closed by default and opened only to the people who should see it, and administration requires two-step sign-in. If you find a weakness, see the security page.

Changes

If we change this policy in a way that matters, we tell members by e-mail or on the site before it applies.