Privacy Policy

Last updated: September 15, 2026

Roji Labs LLC, an Illinois limited liability company doing business as trakd ("trakd", "we", "our", or "us"), operates the trakd mobile application and website (collectively, the "Service") and is the controller of personal information processed through the Service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Information We Collect

We collect information in the following ways:

• Account Information: When you create an account, we collect your email address, username, and display name. If you sign in with Apple or Google, we receive your name and email address from the respective provider.
• Profile Photos: If you upload a profile photo, we access your device camera or photo library (with your permission) and store the image on our servers.
• Audio Data: When you start track identification or Record a Set, trakd captures short sound samples from your microphone while the feature is active. On supported Apple devices, the first attempt uses Apple's on-device music recognition framework, which converts the audio into a one-way signature on your device; Apple states that raw audio is not shared with Apple and the signature cannot be inverted. If that attempt does not return a match, the short sample is transmitted securely to our music recognition providers and compared against their catalogs. Unless you separately choose Keep hunting and notify me after a failed identification, trakd does not retain the recording after the live request. If you make that choice, trakd stores the short recording used for that attempt, which is no longer than approximately 15 seconds, in private storage, links it to your account and failed search, and uses it only to retry identification, compare repeated opted-in misses, investigate identification quality, and notify you if the track is found. A recording may incidentally include nearby voices; trakd does not use it to transcribe speech, identify speakers, create voiceprints, infer sensitive traits, advertise, or train unrelated models. If you are offline during Record a Set, samples remain in protected, backup-excluded app storage only until they can sync or expire after 24 hours.
• Approved Broadcast Monitoring Data: Separately from in-app microphone recognition, trakd may monitor a limited set of official public streams or broadcasts for which we have documented a rights-holder or other lawful monitoring basis. A music recognition provider analyzes the stream to group recurring unidentified content. trakd stores derived information such as fingerprints, timestamps, recurrence counts, source references, labels, and review decisions. trakd does not download or store recording clips from this program by default, and user microphone samples are never used in it.
• Usage Data: We automatically collect information about how you interact with the app, including sets viewed, tracks saved, contributions, and social interactions (follows, likes).
• Device Information: We collect device type, operating system version, and anonymous crash/performance data to improve the app.
• Website Advertising Data: If you choose to allow advertising cookies on our website, the TikTok Pixel may receive page views, the page URL and referring page, browser and device details, IP-derived location, cookie or advertising identifiers, and conversion events that we configure. We do not load the TikTok Pixel before you allow it.
• Spotify Data: If you connect your Spotify account, we access your profile information and the ability to create and modify playlists on your behalf. Your Spotify credentials are stored securely on your device and are never sent to our servers.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the trakd Service
• Identify music tracks using audio fingerprinting
• With your separate permission, retry a failed identification, compare it with other opted-in misses, and notify you if the track is later found
• Detect recurring unidentified music in approved public or authorized broadcasts so it can be researched and credited
• Personalize your experience and deliver relevant content
• Measure the effectiveness of TikTok advertising and, when you allow it, build or reach advertising audiences
• Send you updates, marketing communications, and other information related to the Service (you may opt out at any time)
• Monitor and fix bugs, crashes, and performance issues
• Respond to your comments, questions, and support requests

Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contractual Necessity: Processing your account information and usage data is necessary to provide you with the trakd Service as described in our Terms of Service.
• Legitimate Interest: We process device information, crash reports, and usage analytics to improve our Service, detect bugs, and ensure platform security.
• Legitimate Interest or Authorization: We process derived monitoring metadata from selected official public or rights-holder-authorized broadcasts to research recurring unidentified music, improve catalog coverage, and support attribution. We document the source and monitoring basis before activation, limit the program to approved sources, and provide a way for stream operators or rights holders to object.
• Consent: We rely on your consent for marketing communications and for microphone access for track identification or Record a Set. Retaining a failed-identification recording requires a separate per-hunt choice; declining does not affect normal live identification. You can withdraw that consent and delete a saved clip from Audio Hunts at any time.
• Website Advertising Consent: We load the TikTok Pixel and its advertising cookies only after you choose Allow. You can decline or withdraw that choice at any time through Privacy choices on the website.

Third-Party Services

We rely on service providers to run trakd. They act on our instructions, are bound by contract to protect your data at least as well as this policy describes, and may use it only to provide their services to us. The categories below describe what each receives. A current list of the providers behind each category is available on request at privacy@trakthat.app.

• Cloud hosting, database, authentication, and file storage: Your account data, profile photo, usage data, and, if you opt in to Keep hunting and notify me, the retained recording are stored with cloud infrastructure providers in the United States. Retained recordings live in a separate private bucket with a fixed deletion deadline and are never made public.
• Music recognition: When a live identification runs, a short sound sample is sent to our music recognition providers and compared against their catalogs. If you choose Keep hunting and notify me after a miss, the retained recording may be sent again for retry identification until it is found, you delete it, or it expires. The same category of provider analyzes the approved broadcast streams described above; that path never uses user microphone samples.
• Crash and performance monitoring: Anonymous crash reports and performance data, with no account details, so we can find and fix bugs.
• Email delivery: Your email address and display name, so we can send account and service emails such as a welcome message. You can opt out of marketing email at any time.
• Subscription management: Your purchase history, subscription status, and a pseudonymous app user ID, so we can manage in-app subscriptions. This provider does not receive your name or email address.
• App update delivery: Your device may contact our update service to check for over-the-air app updates. No account data is sent with that check.
• AI-assisted catalog tools: We use third-party AI models to help organize the music catalog, for example to parse set tracklists and to draft replies to public comments for our team to review. These tools may process set titles, tracklists, and the text of public comments. They do not receive your email address, account credentials, private messages, or audio.
• Spotify: If you connect your Spotify account, we access your profile information and create or modify playlists on your behalf through the Spotify API. Your Spotify credentials stay on your device and are never sent to our servers. Spotify Privacy Policy
• Apple Music: We use the Apple Music API for track metadata, album artwork, and audio previews, and, with your permission, to export saved track IDs to a playlist on your Apple Music account. Apple Privacy Policy
• Apple Sign-In: If you sign in with Apple, we receive your name and email address (or Apple's private relay email) as authorized by you. Apple Privacy Policy
• Google Sign-In: If you sign in with Google, we receive your name, email address, and profile photo from your Google account. Google Privacy Policy
• TikTok: Advertising measurement on our website only. If you choose Allow, the TikTok Pixel receives website and browser data so we can measure campaigns and use TikTok advertising features. TikTok may use cookies and other identifiers under its own terms. TikTok Privacy Policy

Advertising Cookies and Your Choices

The TikTok Pixel is optional. On your first visit, you can choose Allow or Decline. If you allow it, we store that choice in your browser and load the Pixel; if you decline, we do not load it. Use the Privacy choices control on the website to change your decision later. Withdrawing consent stops future TikTok Pixel collection from our website, but does not delete data TikTok previously received. You may also contact privacy@trakthat.app with a privacy request.

International Data Transfers

Your data may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from your jurisdiction. When we transfer data outside the European Economic Area, we rely on Standard Contractual Clauses and our service providers' compliance with recognized data protection frameworks to ensure appropriate safeguards are in place.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. An opted-in failed-identification recording is deleted within 24 hours after a verified match, within 24 hours after you delete it or withdraw consent, or no later than 30 days after capture if it remains unresolved. Account deletion also queues linked recordings for deletion within 24 hours. Temporary processing files follow the same or a shorter schedule; inaccessible disaster-recovery copies, if any, expire within 35 days. Limited consent and deletion records without audio may be retained for up to 24 months to document the request and our response. You can delete your account at any time from Settings. Some anonymized or aggregated data may be retained for analytics only when it cannot reasonably identify you. Derived broadcast-monitoring metadata is retained while needed to investigate repeated unknown content, maintain attribution and review history, respond to rights-holder concerns, or meet legal obligations; trakd does not retain the monitored stream audio or provider recording clips by default. If an in-app deletion control is unavailable, contact privacy@trakthat.app.

Broadcast Source Requests

If you operate a monitored stream, represent a rights holder, or believe a source should not be included in our approved broadcast-monitoring program, contact privacy@trakthat.app. Please identify the stream and your relationship to it. We will review the request, pause monitoring when appropriate, and work with our recognition provider on deletion or restriction requests that apply to data held within its service.

Data Security

We implement technical and organizational measures including encryption in transit, encryption at rest for retained audio, private storage separated from ordinary analytics, narrowly authorized automated access, and access and deletion logging. Retained recordings and playable links are not placed in analytics, crash reports, support messages, or agent prompts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your data
• The right to restrict processing of your data
• The right to object to processing based on legitimate interest
• The right to data portability
• The right to withdraw consent at any time
• The right to opt out of marketing communications
• The right to lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@trakthat.app.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information for money. Some state laws may treat advertising data sent through the TikTok Pixel as sharing for cross-context behavioral advertising. Decline or withdraw advertising consent through Privacy choices to opt out.
• Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at privacy@trakthat.app. We will respond within 45 days.

Browser Privacy Signals: Our Service does not currently respond to the legacy "Do Not Track" signal. When the browser exposes Global Privacy Control, our website treats it as a decision to decline advertising cookies.

Children's Privacy

trakd is not intended for use by children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@trakthat.app. We will take steps to delete such information from our servers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Roji Labs LLC (doing business as trakd)
privacy@trakthat.app