privacy

01 — who we are

slipcue is made by ARJL LTD

slipcue is a product of ARJL LTD ("we", "us"), registered in England and Wales. we're the controller of your personal data under UK GDPR, and you can reach us any time at [email protected].

02 — what we collect

what we hold, and why

• sign-in. apple or google only. from your provider we get a subject id and your email address — that's how we know it's you. we never see or hold a password.
• your profile. your @handle, a display name, an optional avatar (stored in our database and served publicly, for example on the links you send), and your device locale (a BCP-47 language tag, so anything we send speaks your language).
• what you send. the songs you send (track details and streaming links), the notes and replies you write, and whether each one was opened or listened to.
• push tokens. one per signed-in device (via Expo), so we can notify you when a real person does something — a reply, a listen, an invite. never "we miss you".

03 — connected music apps

apple music, tidal and spotify — only if you connect them

if you connect apple music, we store a music token — encrypted at rest with AES-256-GCM, never in plain text. we use it in two ways, both narrow: to check your recently-played on apple's servers so we can mark a song a friend sent you as listened, and — if you ask slipcue to keep a mixtape — to create that playlist in your library, once. nothing else is written to your account. we don't keep a history of what you listen to beyond that, and you can disconnect apple music at any time.

if you connect tidal or spotify to keep mixtapes, we store their sign-in tokens the same way (encrypted at rest) and use them only to create the playlists you ask for; disconnect any time in the app.

04 — contacts

your contacts stay on your phone

if you let slipcue see your contacts, we use them only on your device to help you pick who to invite. your address book is never uploaded — this is enforced, not just promised. on Android the build doesn't even hold the contacts-write permission, and nothing in the app transmits your contacts to us or anyone else.

05 — opened and listened

yours to switch off

when a song you sent is opened or played we mark it, quietly, for you — and listened only ever means a real listen, never a guess. it's yours to switch off: with read-receipts off, your opens and listens are never reported to anyone, on any song.

06 — analytics

what we measure, and what we never do

we use PostHog (on an EU-hosted project) for product analytics — which features get used, so we can make the app better. before you sign in, the app counts itself with a random id generated on your device: it holds nothing about you, it never leaves PostHog, and signing out replaces it. our public song pages also log basic view and tap events, with no identity attached at all.

if the app crashes, a crash report goes to Sentry (also EU-hosted) — a stack trace and the device model, with no account identity attached — so we can fix what broke. we don't run ads, we don't build advertising profiles, and we don't sell any of it.

07 — where it lives

london, on servers we rent

your data is stored on DigitalOcean (London) and served through Cloudflare. we don't sell your data, and we never will.

08 — your rights

export it, or delete all of it

both of these live in the app, under your account:

• export my data. gives you a JSON file with your profile (handle, display name, email, primary service, whether read-receipts are on, and when you joined), how many friends and threads you have, every song you've sent (the track, your note, and when), and every reply you've written (the text and when).
• delete my account. we tombstone your identity: your apple and google sign-in ids, your email, your avatar, your push tokens, and any connected-service tokens are wiped; your display name becomes "deleted" and your @handle is replaced with a random one, so you're no longer identifiable or searchable. your friendships and any invites you sent that hadn't been redeemed are deleted outright.

one honest caveat: songs and replies you already sent stay in your friends' threads — the same way an email or a text you sent still sits in someone else's inbox after you delete your own account. we keep those so your friends' conversations don't fall apart, but they're no longer tied to an identifiable you.

no longer have the app installed? email [email protected] from the address on your account and we'll run the same deletion for you — no reinstall needed.

under UK GDPR you also have the right to access, correct, or object to how we use your data, and to complain to the ICO (ico.org.uk) if you think we've got it wrong — though we'd rather you told us first.

09 — changes

if this page changes

if we change something that matters, we'll flag it in the app rather than quietly editing this page. the date at the top always tells you the current version.