Privacy Policy — Backpack of Songs

Version 1.0 — effective September 15, 2026

The short version

We collect what the app needs to work and nothing else. No advertising, no analytics, no tracking, no data brokers, no third-party SDKs that watch you. The one third-party service that runs inside the app is Cloudflare's Turnstile, a check that you are a person and not a bot — see section 3.6.
Your location is used to find songs near you and to place the ones you leave.
Everything you post is held for one hour before anyone else can see it.
If you post anonymously, our server never sends your name, portrait or country with that post. It never leaves the database.
You can delete everything, from inside the app, at any time.

The rest of this document is the precise version.

1. Who is responsible

Leonardo Rodrigues Muller is the controller of your personal data ("we", "us").

Address: Avenida Otto Niemeyer, 809, Unit 612, Porto Alegre, Rio Grande do Sul, Brazil
Data protection contact (encarregado / DPO): Leonardo Rodrigues Muller, data@backpackofsongs.com

2. Where this applies

Wherever you are. We apply the Brazilian LGPD (Lei 13.709/2018) as our baseline, and the GDPR where it applies to you. If your local law gives you more, you get more.

3. What we collect, why, and on what basis

3.1 Account

Data	Where it comes from	Why	Legal basis
Account identifier and email	Apple, Google or Spotify sign-in	To have an account you can come back to, and to contact you about the service	Performance of the contract (LGPD art. 7 V, GDPR 6(1)(b))
First name, last name	You, at sign-up	Shown on the posts where you chose to be identified	Contract
Country	You, at sign-up	The flag shown on your posts, and the country counter in your backpack	Contract
Portrait	You pick one of 58 drawings	Your avatar. It is an illustration, not a photograph — we never ask for one	Contract
Your privacy switches	You	To honour them	Contract
Whether Spotify is connected	Set by our server when you connect it	So the app knows to show the connected state	Contract
The version of the Terms you accepted, and when	Recorded when you accept	So we both have a record of what you agreed to	Legal obligation, legitimate interest

If you sign in with Apple and choose Hide My Email, we only ever see Apple's relay address. That is fine — everything works.

3.2 Location

The app reads your location only while you are using it. There is no background tracking, no location history, and no geofencing.

To draw your radar, your position is used on your device and sent to our server as a query — "what is near this point" — which returns distance and bearing only. We do not keep a log of where you have opened the app.
When you post, the location is stored with the post, rounded to a grid of about 100 metres, together with a place name and a city that you can edit.

We do not derive your home, your workplace, your routine or your movements from this, and we do not sell or share location data with anyone.

Legal basis: your consent, given through your phone's permission prompt (LGPD art. 7 I, GDPR 6(1)(a)). You can withdraw it in your phone's settings at any time; the app then cannot show you anything nearby.

3.3 What you post

The Spotify track id, title, artist and cover-art URL; the note you write, if you write one; whether the post is anonymous; the place, city and country; and the times it was created and became visible.

Legal basis: contract. This is the service.

3.4 What you keep

Which posts you liked, and which posts are in your backpack, with the date.

Legal basis: contract.

3.5 Spotify connection

If you connect Spotify, our server stores the access and refresh tokens Spotify issues, your Spotify user id, and the permissions you granted.

Those tokens are stored server-side and no app, including ours, can read them. The table has row-level security with no policy that grants access to anyone except our own server functions. We use them to search for tracks, to read the track you are currently playing when you ask us to, and — only if you ask — to create a playlist from your backpack.

We never read your listening history, your library, your followers or your playlists otherwise. We never post to your account on our own.

Legal basis: contract, and your consent given in Spotify's own permission screen. You can disconnect in the app, and revoke us at spotify.com/account/apps.

3.6 Technical data

When the app talks to our server, our hosting provider records the usual server log entries: IP address, timestamp, and which request was made. These are used to keep the service running and to investigate abuse, and are deleted on the provider's schedule (see section 5).

Your IP address is also visible to the map provider when your phone downloads map tiles, and to Spotify when the app talks to Spotify. That is unavoidable in the same way it is unavoidable for any website you visit.

Human verification (Cloudflare Turnstile). To keep automated accounts and spam out, creating an account, signing in and asking for a password-reset email can require a short check that you are a person. It is run by Cloudflare: the app loads Cloudflare's Turnstile widget, and Cloudflare receives your IP address and technical signals from your device and how it interacts with the widget (such as browser or device characteristics), which it uses to decide whether the request comes from a person. Cloudflare returns a one-time token, which our server checks with Cloudflare before it lets the request through. We never receive the signals themselves — only the token and the pass or fail result. Cloudflare acts on our instructions as a processor (see section 6). The check is not used for advertising or for tracking you across apps or sites.

Legal basis: legitimate interest in operating and securing the service (LGPD art. 7 IX, GDPR 6(1)(f)).

3.7 Reports and moderation

If you report a post, or someone reports yours, we keep the report, what was reported, and what we did about it.

Legal basis: legitimate interest in keeping the app safe, and legal obligation.

4. What we do not collect

To be explicit, because most apps do collect these:

No advertising identifiers. No advertising, at all.
No analytics or crash-reporting SDK that profiles you.
No cross-app or cross-site tracking. The app never asks for tracking permission because it has nothing to ask for.
No contacts, no photo library, no microphone, no camera, no calendar.
No audio. The app never plays or records anything.
No payment data. There is nothing to buy.
No sensitive data in the sense of LGPD art. 5 II — do not put any in a note.

5. How long we keep things

What	How long
Profile, posts, likes, backpack	Until you delete them, or until you delete your account
Server logs	Up to 7 days, then deleted by our hosting provider
Database backups	Up to 7 days on a rolling schedule, then overwritten
Reports and enforcement records	12 months after the case is closed
Records of consent to the Terms	For as long as the account exists, plus 5 years
Records the law requires us to keep	For the period the law requires

6. Who else touches your data

We use these processors. They act on our instructions and cannot use your data for their own purposes.

Who	What for	Where
Supabase (on AWS)	Database, authentication, server functions	São Paulo, Brazil (AWS sa-east-1)
Apple, Google	Sign-in, and app distribution	Global
Spotify	Track search and playback hand-off, if you connect it	Global
Cloudflare	Human verification (Turnstile) when you create an account, sign in or reset a password	Global
CARTO and OpenStreetMap	Map imagery	Global
GoDaddy	The two inboxes on backpackofsongs.com	United States
GitHub Pages (Microsoft)	The website	Global (CDN)
Buy Me a Coffee	The tip button on the website. Their server sees your IP address and browser details when the button loads, and handles the payment itself if you use it	Global

We do not sell personal data. We do not share it for advertising. We disclose it outside this list only when the law compels us, and only what is compelled.

7. Data leaving Brazil

Some of these providers process data outside Brazil and outside the EU. Where that happens we rely on the transfer mechanisms those providers offer — standard contractual clauses and equivalent instruments (LGPD arts. 33–35, GDPR ch. V).

8. How other people see you

This is the part specific to this app, so it gets its own section.

Nothing you post is visible to anyone for one hour. It is a database trigger, not a setting, and it cannot be turned off — including by us.
Other users can never read the posts table directly. Everything they see arrives through server functions that decide, per post, what may be sent.
On an anonymous post, those functions send no author id, no name, no portrait and no country. The values stay in the database.
If you turn off "share my name", your name is withheld even on posts you did not mark anonymous.
What is always visible on a visible post: the track, the note, the place and city, and roughly how far away and in which direction it is from whoever is looking, within about 1.6 km.

We built it this way deliberately, and there is a test suite that fails if any of it stops being true.

9. Your rights

Under the LGPD and the GDPR you can ask us to:

confirm whether we process your data, and give you a copy of it;
correct anything incomplete or wrong;
delete your data — you can do this yourself, in the app;
restrict or object to processing based on legitimate interest;
receive your data in a portable format;
withdraw consent, at any time, without affecting what was lawful before;
know who we have shared it with;
be told the consequences of refusing consent — for location, the consequence is that the app cannot show you what is nearby.

Write to data@backpackofsongs.com. We answer within 15 days (LGPD) or one month (GDPR). We may ask you to sign in to prove the request is yours.

If you are unhappy with our answer, you may complain to the ANPD (gov.br/anpd) or, in the EEA/UK, to your local supervisory authority.

10. What deleting your account actually does

It removes your profile, your posts, your notes, your likes and your backpack from the database. Your posts also disappear from other people's backpacks and radars.

It does not reach:

copies that left the app — a screenshot someone took, or a track someone added to their own Spotify playlist;
backups, until they age out on the schedule in section 5;
moderation and legal records, for the periods in section 5.

Deletion is immediate and cannot be undone.

11. Children

The app is not for people under 16. We do not knowingly collect data from anyone younger. If you believe a child has an account, write to data@backpackofsongs.com and we will delete it.

12. Security

Data is encrypted in transit and at rest by our hosting provider. Access to the production database is limited to one person, with two-factor authentication. Every table has row-level security, and the rules described in section 8 are covered by an automated test suite that runs on every change.

If a breach happens that puts you at risk, we will tell you and the ANPD, as LGPD art. 48 requires.

13. Changes

We will post any change here with a new version and date, and tell you in the app when it matters. Every previous version is kept — ask at data@backpackofsongs.com if you want to read one.

14. Contact

Leonardo Rodrigues Muller
Avenida Otto Niemeyer, 809, Unit 612
Porto Alegre, Rio Grande do Sul, Brazil
data@backpackofsongs.com