Legal · Privacy
Your data,
plainly.
What Riddim collects, why we need it, how long we keep it and how to get it removed. No dark patterns, no pre-ticked consent.
What we collect
We collect three kinds of data, and very little of it is required to listen:
- Account data — name, email, sign-in provider and, if you subscribe, billing country. Payment card details go directly to the payment processor and never reach Riddim servers.
- Listening data — tracks played, saves, follows, queue and resume position. This is what makes the product work; it is also the data most people want control over.
- Technical data — device type, browser, approximate region, IP address and error logs. We use these to keep the service up and to detect abuse.
How we use it
We use personal data to authenticate you, stream and download audio, sync your library, pay creators correctly, prevent fraud and improve the product. We also use aggregate listening data to compile charts — but a chart never identifies an individual listener.
We do not sell personal data. We do not use your private listening history to target advertising outside Riddim. Editorial decisions are made by people, not by an advertiser's media plan.
Legal bases
Where GDPR or similar law applies, we rely on: performance of a contract (running your account and subscription), legitimate interests (security, product improvement, aggregate charts), consent (marketing email, optional analytics) and legal obligation (tax and payment records).
Who we share with
- Payment processors for subscriptions and marketplace licences.
- Cloud hosting, media delivery and error monitoring providers acting on our instructions.
- Producers and rights holders, only for the transaction you initiated — never your full listening history.
- Authorities where we are legally required to respond, and then only to the extent required.
Processors are bound by data-processing terms. International transfers use appropriate safeguards.
How long we keep it
Account and listening data are kept while your account is open. Delete the account and we remove or anonymise it within 30 days, except records we must keep for tax, fraud prevention or legal claims. Server logs are kept for 90 days.
Your rights
You can access, correct, export or delete your data, object to certain processing, and withdraw consent for marketing at any time. In the app, use Settings → Privacy. Outside the app, email privacy@riddim.life. We reply within 30 days.
If you are in Nigeria, you may also contact the Nigeria Data Protection Commission. If you are in the UK or EEA, you may complain to your local supervisory authority.
Cookies
We use strictly necessary cookies for sign-in and security. Optional analytics cookies are off until you turn them on. We do not use advertising cookies or third-party trackers for cross-site profiling. You can clear cookies in your browser at any time; you will be signed out.
Security
Traffic is encrypted in transit. Passwords, where used, are hashed. Access to production data is limited, logged and reviewed. If a breach affects your rights, we will notify you and the relevant authority as required.
Children
Riddim is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
Changes
When this policy changes materially, we will email account holders and show a notice in the product before the change takes effect. The date at the top always reflects the current version.
Contact
Privacy questions: privacy@riddim.life. General support: Help & Support. Postal address available on request.