Privacy Policy

Effective October 12, 2026 · Retaz LLC · Lewisburg, Greenbrier County, West Virginia, USA
Supersedes the version effective October 9, 2026. Communities. Section 2 now describes Communities, which arrive with an app update in October 2026: the communities you create and join, when you agreed to the guidelines, your posts, and the hearts you give posts (their own records, never counted in La Chispa). It says who can see each of them, that the app never shows who gave a heart to a post, how a flag hides a post and what we keep when an owner removes one, how Discover and Trending use your playlists, the playlists you hearted and the country and region on your profile, that a deleted post is kept out of sight so a report about it can still be checked, and that a deleted community can be restored for 72 hours and is then erased. It also describes the list of a community's members, which anyone signed in can open, and who is counted there but not named. Sections 5, 7 and 8 match. Comments. Section 8 now says that a playlist's owner can remove a comment with a reason, which we keep with the comment for review, and that members who have blocked one another cannot comment on each other's playlists. Sections 5 and 7 match.
The October 9 note follows, unchanged. That version superseded the one effective October 4, 2026. Notifications. Section 2 now lists every notification Retaz can send: your Curator badge, new hearts (at most once a day) and new comments on your playlists, and four La Chispa notices sent to everyone with notifications on. It also says how to turn notifications on and off, that turning them off in Settings deletes your push token at once, and that the app keeps a list of the notices sent to you for 90 days (Sections 5 and 7 match). The earlier wording named only the Curator badge. La Chispa certification. Section 2 now describes two declarations a La Chispa Country Champion may be asked for from November 17, 2026: a legal name for the sanctions screen and any contract, and confirmation of where they live at the close, never an identity document. Section 6 names the independent observer who certifies the result as a recipient of coded La Chispa records only, kept for twelve months after December 1, 2026. Section 7 says that from November 9, 2026, if you have a playlist in La Chispa, the La Chispa record (your declared country and region, birth year, signup date, badge and whether you held a membership, as they stood at the final tally) is kept after you delete your account, so the result can be checked. Section 5 gives the legal basis.
The October 4 note follows, unchanged. That version superseded the one effective October 1, 2026. Our representative in the EU, the EEA and the UK. Retaz LLC's representative under Article 27 of the GDPR and the UK GDPR, and its legal representative under Article 13 of the Digital Services Act, is DataRep (Data Protection Representative Limited), appointed from October 2, 2026. Section 14 and our EU, EEA and UK contacts page give the details. An earlier version of this policy named a representative at an address that was not theirs. If you wrote to that address, please write again using the details in Section 14.
The October 1 note follows, unchanged. That version superseded the one effective September 25, 2026. Fewer messages from Retaz on the free tier. From October 15, importing or exporting a playlist, and publishing your first playlist, are never followed by a message from Retaz, and the free allowance now counts only the playlists you publish (Section 2). Message requests. Section 2 and Section 5 now describe message requests, which the app already offers: members who do not follow each other can still message, as a request the other member can accept or decline. They also say that from October 15, 2026, both members need a membership to send or receive direct messages. Changes to your country or region. Section 2 and Section 7 now say that we keep a record of changes to your country or your state, province or region, including the first time you set them, to review La Chispa eligibility, and delete it with your account. Section 2 also says that your country, and for Ukraine your region, decide whether you can be recognized in La Chispa, and cannot be changed in the app while La Chispa runs. Deleting your account while La Chispa is counted. Section 7 now says that account deletion is paused from November 17, 2026 at 00:00 US Eastern Time until the final La Chispa tally has been captured, normally a few minutes later.
The September 25 note follows, with one correction: memberships are sold in the app from October 15, 2026. That version superseded the one effective August 8, 2026. Memberships are sold in the app from October 15, 2026, and Apple or Google handles every payment. The sections on your membership, payment details, providers and legal bases now say so.
The August 8 note follows, unchanged. That version superseded the one effective August 5, 2026. The minimum age to use Retaz is now 18. It was 16 in earlier versions. Nobody under 18 can hold a Retaz account, so the sections below that described extra protections for 16 and 17 year olds no longer describe anyone, and say so.
The August 5 note follows, unchanged. That version superseded the one effective July 29, 2026. This update is written ahead of two changes that begin on October 15, 2026, so that you read about them before they happen rather than afterwards. First, on the free tier Retaz will start showing you short messages about Retaz itself after your first playlist creation, import and export; the previous version said flatly that we show no ads, which will stop being true even though these are our own messages and involve no advertiser. Section 2 and Section 3 now describe them, and the counters that make the free allowance work. Second, memberships open, so Section 2 now describes what a membership record contains and Section 3 states plainly that your card details never reach us. The July 29 update corrected what we say about crash reporting, and that correction stands unchanged.

The short version

We do not sell your personal information. Ever.
We run no third-party advertising: no ad network, no advertising identifier, and nothing about you shared with advertisers. The only promotions you will ever see here are Retaz's own.
Retaz is an 18-and-over product.
Retaz hosts no music. Playlists are lists of track references, and playback happens in your own streaming service.
Direct messages are stored on our servers and can be read by our safety team. They are not end-to-end encrypted.
You can export your data and delete your account at any time, from inside the app or by email.

This policy explains what Retaz LLC ("Retaz", "we", "us") collects, why, and what your rights are. It covers the Retaz mobile app (pre-launch, entering Early Access) and the retaz.fm website, including the early-access waitlist. Retaz is pre-launch: this policy describes what the product does today, not what it might do later. If we add features that change what we collect, we will update this policy first.

1. Who we are

Retaz LLC is a West Virginia limited liability company headquartered in Lewisburg, Greenbrier County, West Virginia, USA. For anything in this policy, contact [email protected].

2. What we collect in the app

You sign in to Retaz with your Apple or Google account. There is no email-and-password sign-up. When you use the app, we collect:

Email address. Provided by Apple or Google when you sign in. If you use Apple's private relay, we receive the relay address, which is fine with us.
Display name. The name you choose. It is visible to other people in the app. It does not have to be unique.
Unique handle. The @handle other people see. You pick it at sign-up, it is unique to you, and you choose whether your handle or your display name is shown by default.
Account identifier. A random ID that ties your data to your account.
Country, and optionally a state, province or region and a city. Profile fields you pick, not location readings. We do not collect device location. If your country is Ukraine, the app asks for your region. Your country, and for Ukraine your region, decide whether you can be recognized in La Chispa, and you cannot change them in the app while La Chispa runs (La Chispa Rules 7.7).
Changes to your country or region. When you set or change your country or your state, province or region, we keep a record of the old and new values, when it happened, and whether you or we made the change, to review La Chispa eligibility (La Chispa Rules 7.7). You cannot see this record in the app, and it is not in the in-app export; you can ask us for a copy (Section 9). The record is deleted with your account, subject to "What we may retain after deletion" (Section 7).
Social-platform handles. Any usernames you choose to add to your profile for other platforms. These are optional.
Profile avatar. Avatars are built-in artwork. We store the short key of the preset you pick, not an uploaded photo.
Language preferences and locale. So Retaz can speak your language.
Birth year and a minor flag. We ask only your birth year (never your full date of birth) to apply our 18-and-over rule. This is self-declared. We also store a minor flag derived from it. Because the minimum age is 18, that flag should never be set on a live account: we keep it as a safety check so that a wrongly-entered birth year is caught rather than ignored.
Two declarations for La Chispa Country Champions (from November 17, 2026). If your playlist leads its country when La Chispa closes, we may ask you for a written declaration of a legal name for the sanctions screen and any contract, and confirmation of where you live at the close and the date of any move. We send the request after the tally is captured, in the same words to everyone missing the same item, and we never ask for an identity document. We do not give your legal name to the independent observer (see Section 6).
Content you create. Playlists (titles, descriptions, the "why" text, hashtags, track lists, and the visibility setting you choose), comments, communities you create and posts you write in a community (see "Communities" below), your curator bio, feedback you submit, and translation suggestions you offer.
Publish attestation. When you publish a playlist you affirm that you made it yourself. We record the time of that affirmation and the terms version you accepted.
How you interact. Votes (hearts), saved and bookmarked playlists, songs you mark as "not for me", curators you follow, communities you join and the hearts you give community posts, people you block, reports you file, comments you post, and direct messages you send.
Report submissions. If you report content, we store which item you reported and the category you chose from a fixed list of 12. Reports cover playlists, profiles, comments, direct messages, communities, and community posts. The report form has no free-text field.

Direct messages

Retaz includes one-to-one direct messages. If you and another member follow each other when your conversation starts, your messages go straight to them. If you do not, your messages arrive as a message request: the other member sees who sent it and what it says, and can accept it, decline it (you are not told), block you, or report it. A member can turn off new message requests in the app's privacy settings, and when either of two members has blocked the other, neither can message the other. From October 15, 2026, both members need a membership to send or receive direct messages. A message can be between 1 and 4,000 characters.

Please read this part carefully. Your direct messages are stored on our servers in readable form. They are not end-to-end encrypted. Our safety team can read message content when reviewing a report or acting to keep the community safe, and messages are translated automatically into the reader's language (see "Automatic translation" below). Before you start your first conversation, the app shows you a notice that explains this and asks you to agree. You can report a direct message the same way you report anything else (Section 8). If you delete your account, your messages are deleted with it, except for specific material we are legally required to preserve (Section 7 and Section 8).

Communities

Communities arrive with an app update in October 2026. We are telling you before they start, not after.

A community is a group a member creates around the music they love, with a feed of posts. Anyone signed in to Retaz can look around a community without joining. From October 15, 2026, creating a community, joining one, posting and giving a heart to a post need a membership. When you use Communities, we store:

Communities you create. The name, the avatar you pick from the Retaz library, the description, any house rules, the primary genre, up to three hashtags, the language, and the anchor playlist (one of your own public playlists), with when you created it. You are shown as its owner wherever it appears.
Your memberships. Which communities you belong to and whether you own each one; when you joined; when you agreed to the Retaz guidelines that every community follows, and to the community's house rules, which everyone must do to join or create a community; and when you last posted or gave a heart there, so the app can show your most recent communities first.
Posts. A post is one song from the Retaz catalog and a caption of up to 250 characters, with no links. We store the caption, the song, who wrote it and when.
Hearts on posts. One per member per post: which post, and when. A heart on a post is its own record. It is not a heart on a playlist, and it never counts in La Chispa.

Who can see what. Everyone signed in to Retaz can see a community's name, avatar, description, house rules, genre, hashtags, language, anchor playlist, owner and number of members, and can read its posts. Each post shows its author's display name or handle and avatar, when it was posted, its song and its number of hearts. The app never shows who gave a heart to a post, not even to the community's owner; it shows you only whether you gave one. Anyone signed in can also open a community's list of members, which shows each member's display name or handle and marks the community's owner. Members whose profile is private, and members you have blocked or who have blocked you, are counted but not named. The list of communities you belong to is shown only to you. Communities are not shown to anyone who is not signed in. When either of two members has blocked the other, neither sees the other's posts or the communities the other owns.

Flags and removals. Anyone who can see a community or a post can flag it, and a flag is a report (Section 8). When three different members have flagged the same post, it is hidden from everyone but its author until our safety team has reviewed it; a flagged community stays visible while we review it. A community's owner can remove any post in their community, and must give a reason to remove someone else's. We keep that reason, who removed the post and when, and a record of each time an owner deletes or restores their community, so that our team can review how owners use these tools. The reason is not shown in the app.

Leaving and deleting. You can leave any community you joined; your posts and hearts there stay, and you can still delete your posts. A deleted post disappears from the community at once, whether its author deleted it or the owner removed it, and we keep it out of sight, so that a report about it can still be checked, until the community is erased or its author deletes their account. An owner cannot leave their own community but can delete it: it disappears for everyone at once, and the owner can restore it from My Corner for 72 hours. When the 72 hours are up, it is erased within the hour, with its memberships, posts, hearts on posts and the record of owner actions. Reports about it or its posts stay with our safety team (Section 8). If you delete your account, the communities you own are erased at once with everything in them, including other members' posts, and your memberships, posts and hearts in other communities are deleted with the rest of your data, subject to "What we may retain after deletion" (Section 7).

Discover and Trending. Discover's "Your genres" list shows communities whose genre or hashtags match the hashtags on your own playlists and on the playlists you have hearted, and names the hashtag that matched; it does not use your listening history. Trending lists the communities with the most joins, posts and hearts on posts in the last 48 hours. Its "Your Country" and "Your Area" lists compare the country, and the state, province or region, on your profile with those on each community owner's profile, so if you create a community, members whose profile names the same country, or the same region, can find it there, even when your profile is private. Both lists are worked out each time you open them, and are not stored.

Posts, community names, descriptions and house rules are shown as written: they are not sent for automatic translation. Invites and shares go through your phone's share sheet: they carry the community's name and a link to Retaz in the App Store or Google Play, and we are not told who you send them to. Your communities, memberships, posts and hearts on posts are not in the in-app export yet; you can ask us for a copy (Section 9).

Automatic translation

Comments and direct messages are translated automatically into the reader's language. Only the text is sent for translation, never your name or account details; Section 6 names the two services that do this. Translations are stored so the same text is not translated twice, and they are deleted when the original comment or message is deleted.

Notifications

Retaz can send you these notifications: when you earn your Curator badge; when your playlists get new hearts, at most once a day and never saying who hearted; when someone comments on one of your playlists, with the commenter's handle and how many comments are new; and four La Chispa notices, sent to everyone with notifications on: when La Chispa opens (October 17, 2026), three days and one day before it closes (November 13 and 15, 2026), and when the Global Champion is announced (December 1, 2026). Notifications are off unless you turn them on, with "Notify me when I earn it" on the Curator badge card or with the Push notifications switch in Settings, and then allow notifications when your phone asks. Nothing is sent to your phone, and no notification address is stored, until you do both.

When you turn them on, we store a push token for your device. A push token is an address your phone's notification service gives us so a message can reach that device. It is not a name, an email, or a location, and it cannot be used to read anything on your phone. We store one per account and use it only to send you the notifications listed above. We never use it to advertise anything else, we never sell it, and we share it only with Expo to deliver those notifications (Section 6). Turning the Push notifications switch off in Settings deletes it from our servers at once. If you turn notifications off in your phone's settings, the address stops working and we delete it the next time we try to use it. It is deleted with the rest of your data if you delete your account.

The app also keeps a list of the notifications we have sent you, under Notifications in Mail. Notices about your badge, your hearts, comments on your playlists and changes to this policy appear there even if notifications are off on your phone. Each entry holds what the notice says and when it was sent, and is deleted after 90 days, or with your account.

Crash and performance reports

When the app crashes or hits an error, we receive a technical report so we can fix it. A report contains the error itself, where in the app it happened, and basic device information such as the model and operating system version. We also sample a small share of sessions (about one in ten) for performance timings, so we can find what is slow.

These reports are configured NOT to include personal identifiers: no IP address, no account identifier, and no request headers or cookies, so a sign-in token can never travel with one. They are technical diagnostics about the software, not a record of what you listened to or who you talked to.

Your listening activity (Last Spin and Tuned In)

When you open a playlist to play it, we record that you opened it (we call this a spin). Your own spin history is private to you. We use it to show you Last Spin (your recent listening) and to power Tuned In, which surfaces playlists that other people have put together. This is our own product data. We do not send it to any outside analytics or advertising service, and it is never used to target ads.

Messages from Retaz about Retaz

This describes something that begins on October 15, 2026. We are telling you before it starts, not after.

Retaz has a free tier and a paid membership. From October 15, on the free tier, importing or exporting a playlist is never followed by a message from Retaz, and neither is the first playlist you publish; after that, each time you publish another playlist, we show you a short message about Retaz once it has been published. The action always completes first: the message never blocks it, and you can dismiss it after three seconds.

This is Retaz talking to you about Retaz. There is no advertiser, no ad network and no advertising software involved, nothing about you is sent anywhere, and no advertising identifier exists in the app. The message depends only on the fact that you just published a playlist.

To make the free allowance work, we keep a small count on our own servers of how many playlists you have published. It is a counter attached to your account, nothing more, and we keep it on our servers rather than on your phone so that reinstalling the app does not quietly reset it. Paid members are not counted at all. The count is deleted with your account.

Your membership

Memberships are sold in the app from October 15, 2026, through the App Store and Google Play.

We never see your card. Apple or Google handles every payment for a membership bought in the app, through the store you buy from. Your card number does not reach Retaz, and we could not store it if we wanted to.

What we do keep is a record of the membership itself: that you have one, when it starts and ends, how it was acquired (a purchase, a Founders place, a referral, or a benefit you earned), the price tier and the amount charged in the currency you were charged in, and the transaction identifier the store gives us. We use it to know whether your membership is active, to recognise a renewal or a refund, and to reconcile our own figures against what the stores report. It is deleted with your account, except where tax and accounting law requires us to keep a record of a transaction.

3. What we do not collect

Location. No device location, ever. Your profile country, and any state, province, or city, are fields you pick yourself.
Contacts, photos, or audio. The app does not read your contacts, upload photos, or record audio.
Music files. Retaz hosts no audio. Full tracks play only through your own Apple Music subscription, and short previews are provided by Apple. Playback happens through links into your own streaming service.
Card and payment details. Retaz never sees them. Apple or Google handles every payment for a membership bought in the app. What we keep is the membership record described in Section 2 under "Your membership", never a card number.
Advertising or tracking identifiers, third-party analytics, or advertising profiles. The app sends none of these, and we use no advertising identifier. (We do keep a private record of the playlists you open, described in Section 2. It stays on our own systems and is never used for advertising.) We do use a crash-reporting service, named in Section 6 and described in Section 2; it is not an advertising or analytics tool and it receives no advertising identifier.
Anything for an advertiser. There is no ad network in Retaz and no advertising software from anyone else. Retaz does show you messages about Retaz itself, described in Section 2 under "Messages from Retaz about Retaz". Those are chosen by what you just did in the app, never by building a picture of who you are, and no one outside Retaz is involved in showing them to you.

4. The retaz.fm website and waitlist

If you joined the waitlist on retaz.fm before it closed in October 2026, we hold your email address and, if you used the extended signup form, the country, primary music platform, and "how did you hear about us" answer you chose. We use this only to send you news about Retaz's launch and the app. No spam, and we never sell or share the list. To be removed, email [email protected] and we will delete your entry.

Like any website, retaz.fm is served through hosting infrastructure (Cloudflare) that processes visitor IP addresses to deliver pages and protect against abuse. The site also loads fonts and emoji images from content delivery networks (Google Fonts, jsDelivr), which receive standard web requests from your browser. To show pricing for your region, the site uses the country that Cloudflare derives from your network address when it delivers the page; no outside lookup service is asked, the country is used only to pick which prices to display and is not stored, and you can change the region manually on the page. We do not run advertising or cross-site tracking on retaz.fm.

5. Why we use your data (purposes and legal bases)

Purpose	Data involved	GDPR legal basis
Provide your account and the core service (playlists, votes, saves, translation)	Account data, content, interactions	Performance of a contract (Art. 6(1)(b))
Apply the 18-and-over rule, and catch a wrongly-entered birth year	Birth year, minor flag	Legal obligation and legitimate interests (Art. 6(1)(c), (f))
Check that a La Chispa Country Champion is eligible, and have the result certified independently	Legal name, residence confirmation; coded La Chispa records	Legitimate interests (Art. 6(1)(f))
Safety, moderation, and community integrity (reviewing reports, enforcing guidelines, keeping voting honest)	Content, reports, blocks, account data	Legitimate interests (Art. 6(1)(f)); legal obligation where reporting is required by law
Waitlist and early-access communication	Waitlist email and signup answers	Consent (Art. 6(1)(a)); withdraw any time
Delivering direct messages and message requests between members	Message content, sender and recipient	Performance of a contract (Art. 6(1)(b))
Running Communities: creating, joining and leaving communities, posting, hearts on posts, and restoring a deleted community	Community details, memberships and when you agreed to the guidelines, posts, hearts on posts	Performance of a contract (Art. 6(1)(b))
Keeping Communities safe: hiding a post that three members have flagged until we review it, keeping deleted posts so that a report can still be checked, and reviewing how owners remove posts	Flags, posts, the owner's reason and the record of owner actions	Legitimate interests (Art. 6(1)(f)) in a safe community; legal obligation where the law requires us to preserve material
Reviewing how playlist owners remove comments	The removed comment, who removed it, when, and the reason	Legitimate interests (Art. 6(1)(f)) in a safe community
Showing you Discover's "Your genres" list and Trending's "Your Country" and "Your Area" lists	Hashtags on your playlists and on the playlists you hearted; the country and region on your profile and on each community owner's profile; recent joins, posts and hearts on posts	Legitimate interests (Art. 6(1)(f)) in helping members find communities
Showing you Last Spin and Tuned In from your own listening activity	Playlist-open (spin) records	Legitimate interests (Art. 6(1)(f))
Sending you notifications: your Curator badge, new hearts and new comments on your playlists, and the four La Chispa notices	Push token; what each notice says	Consent (Art. 6(1)(a)); withdraw any time with the Push notifications switch in Settings or in your phone's settings
Keeping the list of your notifications in the app	What each notice says and when it was sent	Performance of a contract (Art. 6(1)(b))
Diagnosing crashes and performance problems	Error reports and device type; no personal identifiers	Legitimate interests (Art. 6(1)(f)) in a working, secure app
Running your membership: knowing it is active, and recognising a renewal or a refund	Membership record (Section 2, "Your membership")	Performance of a contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c))
Responding to your requests and legal compliance	Whatever the request involves	Legal obligation and legitimate interests

6. Who processes data for us

We use a small number of service providers, and only to run Retaz. Where a provider processes personal information on our behalf, it does so under a data processing agreement:

Supabase: our backend infrastructure and database, hosted in the European Union (eu-west-1). Supabase is a service provider under a data processing agreement; it does not use your data for its own purposes.
Apple and Google: sign-in, app distribution, and payment for memberships bought in the app. Their own privacy policies govern what they collect on their side.
Songlink/Odesli: resolves track links across streaming services. It receives track URLs, not your personal information.
Cloudflare: hosts the retaz.fm website.
Sentry: receives the crash and performance reports described in Section 2. It is a service provider under a data processing agreement, and it receives technical diagnostics only, with personal identifiers switched off.
Expo: delivers notifications, and only if you turned them on. Expo passes our message and your push token to Apple's or Google's notification service, which delivers it to your device. Expo receives the push token and the text of the notification, not your account data.
Amazon Web Services (Amazon Bedrock, in the European Union): runs the Claude model that translates comments and direct messages. It receives only the text being translated.
Microsoft (Azure AI Translator): our backup translation service, used only when a first translation fails our quality checks. It receives only the text being translated.

Direct messages are stored on the same Supabase infrastructure as the rest of your account data; no separate third-party messaging provider is involved. Their text reaches Amazon Web Services, and Microsoft if needed, only to be translated.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose data only to these providers, when the law compels us, or to protect people from serious harm (see Section 8).

La Chispa certification. An independent observer who certifies the La Chispa result, and anyone assisting them, receives La Chispa records in coded form only: account and playlist identifiers are replaced by codes, and no name, handle, display name, email address or message content is included. We keep the table that matches each code to a member, and we do the checks that need a name ourselves and give the observer only the method and the result. The observer keeps its copy for twelve months after the result is announced (December 1, 2026) and then deletes it.

7. How long we keep data

Account data and content: kept while your account is active.
When you delete your account: deleting in the app removes your account and its data immediately and permanently, apart from the La Chispa record described below. The one exception: from November 17, 2026 at 00:00 US Eastern Time (2026-11-17T05:00:00Z) until the final La Chispa tally has been captured, normally a few minutes later, account deletion is paused; try again once it has been captured (La Chispa Rules, Section 1.6). If you request deletion by email instead, we complete it within 30 days. See our account deletion page for the exact steps.
What we may retain after deletion: records we are legally required to keep (for example tax, accounting, or legal-process records), records needed to resolve an active dispute or enforce our terms, and safety-related material we are required by law to preserve, kept only as long as the law requires.
The La Chispa record (from November 9, 2026): if you have a playlist in La Chispa, the La Chispa record keeps your declared country and region, birth year, signup date, badge and whether you held a membership, as they stood when the tally was captured, and keeps them after you delete your account, so the result can be checked.
Direct messages: kept while both accounts remain active and until either party deletes their account, except for messages preserved for an active safety report or a legal preservation duty.
Communities, posts and hearts on posts: a community is kept until its owner deletes it, or deletes their account. A deleted community can be restored for 72 hours and is then erased within the hour, with its memberships, posts, hearts on posts and the record of owner actions. Your memberships, posts and hearts are kept while your account is active and the community exists. A deleted post is kept out of sight until the community is erased or its author deletes their account. Deleting your account erases the communities you own, with everything in them, and your memberships, posts and hearts everywhere else.
Comments a playlist's owner removed: kept out of sight, with the record of the removal, until the playlist is deleted or the comment's author deletes their account.
Spin history (Last Spin, Tuned In): kept while your account is active, and deleted with the rest of your account data.
Changes to your country or region: kept while your account exists, deleted with it, subject to "What we may retain after deletion" above and to the La Chispa record below.
Push token: kept while notifications are on, deleted when the address stops working or when you delete your account.
Your notifications list: each entry is deleted after 90 days, and all of them with your account.
Waitlist emails: kept until launch communication ends or you ask to be removed, whichever comes first.

8. Moderation and safety reports

When you report content, the report goes into a restricted queue that only authorized staff can read, and a human reviews it. Reports are stored with the category you chose (one of 12: covering playlists, profiles, comments, direct messages, communities, and community posts) and the content you flagged. A flag in Communities is a report: when three different members have flagged the same community post, it is hidden from everyone but its author until we have reviewed it. We aim to review reports involving an immediate safety risk within 24 hours, other reports within 72 hours, and to resolve the remainder within 7 days. To reach our safety team directly, email [email protected]. If we find material depicting child sexual abuse, we preserve and report it to the authorities as United States law requires; that material is not deleted on account deletion while a legal preservation duty applies.

A playlist's owner can remove a comment someone else left on it, and must give a reason. The comment is then hidden from everyone, its author included, and we keep it, with who removed it, why and when, so that our team can review the removal, until the playlist is deleted or the comment's author deletes their account. When either of two members has blocked the other, neither can comment on the other's playlists.

9. Your rights

Exercising a right never costs you anything and never results in worse service.

Export your data any time from inside the app (Settings > Account).
Delete your account any time from inside the app, or by email. Details: retaz.fm/delete-account.
If you are in the EU/EEA or UK (GDPR): you can access, correct, delete, and receive a portable copy of your data; restrict or object to processing; withdraw consent at any time; and complain to your supervisory authority.
If you are in California or another US state with a privacy law: you can know what we collect, delete it, and correct it. We do not sell or share personal information as those laws define it, and we will never discriminate against you for exercising a right.

To exercise any right, email [email protected] from the address associated with your account. We respond within 30 days.

10. Age policy: 18 and over

You must be at least 18 years old to create an account or use Retaz, everywhere we operate, or older where your country sets a higher age of majority. We ask for your birth year at sign-up; this is self-declared, which means we rely on you telling us the truth rather than verifying it. If we learn that an account belongs to someone under 18, we close the account and delete its data. Earlier versions of this policy set the minimum at 16 and described extra protections for members aged 16 and 17; with the minimum at 18 there are no such members.

11. International transfers

Retaz is a United States company. App data is stored with Supabase in the European Union, and we access it from the United States to operate the service. Where data crosses borders, we rely on our providers' data processing agreements and the safeguards they incorporate, such as standard contractual clauses where applicable.

12. Security

Data moves between the app and our backend over encrypted connections (HTTPS/TLS), and access to production data is restricted. Direct messages are encrypted in transit and at rest on our servers, but they are not end-to-end encrypted: our safety team can access message content as described in Section 2. No online service can promise perfect security, and we will not pretend otherwise; if a breach ever affects your data, we will notify you as the law requires.

13. Changes to this policy

When we change this policy, we will post the new version here with a new effective date. For material changes we will give you notice in the app or by email before the change takes effect. This policy has not yet been reviewed by outside counsel; it describes our actual practices honestly and will be refined as Retaz grows.

14. Contact

Retaz LLC, Lewisburg, Greenbrier County, West Virginia, USA.
Privacy questions, requests, and complaints: [email protected]
Safety reports: [email protected]
Representative in the EU, the EEA and the UK (Article 27 of the GDPR and the UK GDPR), and legal representative under Article 13 of the Digital Services Act: Data Protection Representative Limited, trading as DataRep. Email [email protected] and write "Retaz LLC" in the subject line, or use the form at www.datarep.com/data-request. By post, write to DataRep at the address for your country on our EU, EEA and UK contacts page. Address letters to DataRep, not to Retaz LLC, or they may not reach it. For questions about your account or membership, write to [email protected].
EU Digital Services Act single point of contact (Articles 11 and 12): [email protected], in English or Spanish.