Privacy Policy

Effective date: October 15, 2026
Last updated: October 15, 2026

This Privacy Policy explains how SUMMA TECHNOLOGIES LLC ("we", "us") collects, uses, and shares information when you use the Decibel mobile app, this website, and related services (together, "Decibel"). We are responsible for (the "controller" of) that information. Decibel is a place to rate, review, and discuss music and to share collections with other listeners.

If you have questions, contact us at contact@stan-official.app.

1. Information we collect

Information you give us

  • Account details. Your email address and/or mobile phone number, your password (we store only a salted hash, never the password itself), and your username and display name.
  • Profile details. Anything you choose to add to your profile, such as a profile picture, banner image, bio, pronouns, links to your social accounts, and profile widgets.
  • Content you post. Ratings, reviews, discussions, comments, mentions of other users, likes, collections, and the artists, albums, and tracks you save to your library, plus any images or other media you upload.
  • Social connections. The accounts you follow and the accounts you block.
  • Reports. If you report a post, comment, or user, we keep the report, the reason you gave, and any details you added.
  • Messages to us. If you contact us, we keep the message and our reply.

Information from sign-in providers

If you choose Sign in with Apple or Sign in with Google, we receive your account identifier from that provider and, depending on what you allow, your name and email address. We also store the sign-in tokens the provider issues so that we can keep you signed in. Apple's "Hide My Email" relay addresses work normally with Decibel.

Information collected automatically

  • Session and security data. When you sign in, we record the IP address and device/browser information (user agent) associated with your session, and when the session expires.
  • Server logs. Our servers log technical details of requests, such as IP address, time, and the endpoint requested. We use them to keep the service running, prevent abuse, and limit request rates.
  • Push notification tokens. If you allow notifications, we store your device's push token and platform (iOS or Android) so that we can send them.

What we don't collect

  • We don't use advertising or analytics SDKs, and we don't track you across other companies' apps or websites.
  • We don't access your contacts, location, microphone, or photo library, except for a photo you deliberately choose to upload.
  • We don't keep a per-account history of your music searches. Searches are processed to return results, and we cache catalog results without tying them to you.
  • We don't ask for sensitive information, such as health, racial or ethnic origin, religious or political beliefs, or sexual orientation. Please don't include it in your profile or posts unless you're comfortable making it public.

2. Text messages (SMS)

If you sign up or sign in with a phone number, we text you one-time verification codes: for example, to confirm your number, to send a sign-in code, or to reset your password. Each text is sent only when you request it, one per request. Codes expire after 5 minutes.

  • Message and data rates may apply.
  • Reply STOP to opt out of texts, or HELP for help. If you opt out, we can't send you codes by text. You can still use email to sign in or recover your account if you've added one.
  • We don't use your phone number for marketing, and we don't sell or share it for anyone else's marketing. If we ever offer marketing texts, we'll ask for your separate, explicit consent first.
  • We only send codes to phone numbers in supported countries.

3. How we use information

We use information to:

  • create and secure your account, verify your email or phone, and sign you in;
  • show your profile and posts to other users according to your settings;
  • run features such as following, comments, mentions, collections, and notifications;
  • send service messages: verification codes, password-reset codes, and notifications you've enabled;
  • moderate content, review reports, and enforce our Terms of Service;
  • prevent fraud, spam, and abuse, including SMS fraud;
  • keep the service reliable, debug problems, and improve features; and
  • comply with legal obligations.

4. What other users can see

Your username, display name, profile picture, banner, bio, pronouns, social links, profile widgets, followers and following, and the posts you make public are visible to other Decibel users. Some posts can be marked non-public, and those aren't shown publicly. Your email address, phone number, and password are never shown to other users.

5. How we share information

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share information only:

  • With service providers who process it on our behalf under contract:
    • Twilio: SMS delivery of verification codes.
    • Amazon Web Services: application and database hosting in the United States, email delivery (Amazon SES), and file storage (Amazon S3).
    • Resend: email delivery.
    • Cloudflare: network and content delivery.
    • Apple and Google: sign-in, and push notifications via APNs and Firebase Cloud Messaging.
  • With other users, as described in section 4.
  • For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, safety, or property of our users, the public, or us.
  • In a business transfer, such as a merger or acquisition, subject to this policy.

Music catalog sources. Decibel's catalog information (artists, albums, tracks, artwork, and descriptions) comes from Apple Music, Deezer, Spotify, MusicBrainz, Wikidata, and Wikipedia. Our servers query these sources for catalog data only. We don't send them your personal information or your activity on Decibel.

6. How long we keep information

  • Verification codes expire after 5 minutes and are deleted once used, expired, or replaced.
  • Account information and content are kept for as long as your account exists.
  • Sessions expire automatically, and are removed when you sign out or delete your account.
  • Server logs are kept for 30 days.
  • Deleted accounts. When you delete your account, we delete your profile, posts, comments, collections, follows, push tokens, verification records, and uploaded media from our live systems. Mentions of you in other people's comments are removed. Copies may remain in backups for up to 30 days before they're overwritten.
  • We may keep limited information longer when the law requires it, or to resolve disputes and enforce our agreements.

7. Deleting your account

You can delete your account and its associated data in the app: open Settings and choose to delete your account. If you can't sign in, email contact@stan-official.app from the email address on your account, or include your username and the phone number on your account, and we'll verify the request and confirm when deletion is complete. Section 6 explains what's deleted, and what may remain in backups for up to 30 days.

8. Your choices and rights

  • Access and correction. You can view and edit most profile information in the app. For anything else, contact us.
  • Deletion. Delete your account in the app's settings. See section 7.
  • Notifications. You can turn off push notifications in the app or in your device settings.
  • Text messages. Reply STOP to any text from us.

Depending on where you live (for example California, the EEA, or the UK), you may have additional rights. These can include the right to access, correct, delete, or receive a portable copy of your information; to object to or restrict certain processing; and to withdraw consent. To exercise them, contact us at contact@stan-official.app. We won't discriminate against you for exercising your rights. If you're in the EEA or UK, you can also lodge a complaint with your local data protection authority.

Where the GDPR applies, we rely on these legal bases:

  • Performance of our contract with you: running your account and the service.
  • Legitimate interests: security, abuse prevention, and improving the service.
  • Consent: for example, push notifications.
  • Legal obligation: where the law requires processing.

9. Children

Decibel is not intended for anyone under 16, and we don't knowingly collect personal information from children under 16. If you believe someone under 16 has created an account, contact us and we'll delete it.

10. Security

We use measures such as encrypted connections (HTTPS), hashed passwords, expiring one-time codes, rate limiting, and restricted access to production systems. No system is perfectly secure, so please use a strong, unique password.

11. International transfers

We're based in the United States, where we host Decibel, and our service providers may process information in other countries. Where required, we use appropriate safeguards for those transfers.

12. Changes to this policy

We'll update the "Last updated" date when we change this policy. If a change is material, we'll give notice in the app or by email before it takes effect.

13. Contact

SUMMA TECHNOLOGIES LLC
contact@stan-official.app