Privacy Policy for Vibelist

Effective Date: August 22, 2026

Welcome to Vibelist. This Privacy Policy explains how we collect, use, and share information when you use our mobile application ("Vibelist" or the "App"). By using Vibelist, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.A Information You Provide Directly

Mood and Preferences: When you enter text, select a mood, genre, tempo, or any other atmospheric details to generate a playlist, we process this data locally or via our generative engine to curate your music experience.
Voice Input: Vibelist lets you describe your mood/vibe by voice instead of typing — useful when you're driving or otherwise unable to type. When you use this feature, your speech is processed by your device's speech-to-text service to convert it into text, which is then used the same way as typed input described above. We do not retain a copy of the raw audio after it has been converted to text.

1.B Information Received via Third-Party Services

Vibelist integrates with third-party services that may collect information used to identify you:

Spotify API: To create and queue playlists, Vibelist requires connection to your Spotify account. We access your Spotify identifying information strictly to authenticate your session, read your profile (e.g., display name, country), and modify your playlists/library on your behalf. We do not store your Spotify username or passwords on our servers.
Google Sign-In & Firebase Authentication: If you choose to sign in with your Google account, we use Firebase Authentication to manage your session. This allows us to identify your account across devices.
Firebase Firestore: We use Firestore to securely sync your cassette balance and playlist history across your devices when you are signed in.
Firebase Crashlytics & Analytics: We use these services to collect crash reports and app usage/diagnostic data to help us find and fix bugs and improve the App.
Google Play Age Signals API: To comply with applicable app store age-verification requirements (such as Texas SB 2420), the App may query Google Play for an age-range signal associated with your Play Store account. This signal is used only to determine age-appropriate access and is not stored on our servers.
Google Play Services: Used for app operations and handling in-app purchases (Vibe Plus) via Google Play Billing.
Google AdMob: We use Google AdMob to serve advertisements. AdMob may collect and use advertising identifiers (such as the Android Advertising ID) and other device information to show relevant ads. Where required by law (e.g., for users in the EEA, UK, and Switzerland), we collect your consent for personalized advertising using Google's User Messaging Platform (UMP) before any such ads are requested. You can review or change your ad privacy choices at any time from the Profile screen in the App.

1.C Automatically Collected Information

The App may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique ID, the IP address of your mobile device, your mobile operating system, and diagnostic data (such as crash logs provided by standard Android services and Firebase Crashlytics).

2. How We Use Your Information

We use the collected data for various purposes:

To provide and maintain the core functionalities of Vibelist (e.g., AI-driven playlist generation, voice-to-text mood input).
To manage your connection to Spotify securely.
To sign you in and sync your data (cassette balance, playlist history) across your devices via Firebase.
To process safe in-app purchases (Vibe Plus) via Google Play Billing.
To show relevant advertisements (if you are a free user) so we can maintain the app, in accordance with your consent choices.
To verify age-appropriate access where required by law.
To detect, prevent, and address technical issues or app crashes.

3. Permissions

The following device permissions are requested and are each tied directly to a core feature of the app:

Microphone (RECORD_AUDIO): required for the voice-input feature described in Section 1.A — describing your mood/vibe by speaking instead of typing (e.g., while driving).
Internet (INTERNET) & Network State (ACCESS_NETWORK_STATE): required to connect to Spotify, sync data via Firebase, process purchases via Google Play Billing, and serve advertisements.

Vibelist does not request access to your contacts, location, camera, photos, files, call logs, or SMS.

4. Data Storage and Security

Vibelist is primarily a client-side application. Most of your generated playlists (History) are saved locally on your device using Android's DataStore/Room libraries, with optional cloud sync via Firebase Firestore when you are signed in. We value your trust in providing us with your personal information and strive to use commercially acceptable means to protect it. However, remember that no method of transmission over the internet, or method of electronic storage is 100% secure. Data exchanged with the third-party services described in Section 1.B is transmitted using industry-standard encryption (HTTPS/TLS).

5. Third-Party Privacy Policies

Vibelist relies on third-party services, and their use of your data is governed by their respective Privacy Policies:

Service	Purpose	Privacy Policy
Spotify	Playlist creation, queueing, profile authentication	spotify.com/us/legal/privacy-policy
Google Play Services, Firebase & Google	Sign-in, sync, crash reporting, analytics, billing, age signals	policies.google.com/privacy
Google AdMob & Partner Sites	Advertising	policies.google.com/technologies/partner-sites

6. Your Privacy Rights

6.1 Ad Personalization (All Users)

You can review and change your advertising consent preferences at any time from the Profile screen in the App. Regardless of your location, you can also control ad personalization at the device level via Android Settings → Privacy → Ads → "Delete advertising ID" or "Opt out of Ads Personalization."

6.2 GDPR (European Economic Area / UK)

If you are located in the EEA or UK, you have the right to: access, correct, or delete your personal data; restrict or object to processing; data portability; and to withdraw consent at any time (including for personalized advertising, via the Profile screen) without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection authority.

6.3 CCPA/CPRA (California, USA)

If you are a California resident, you have the right to: know what personal information is collected about you; request deletion of personal information; and opt out of the "sale" or "sharing" of personal information (as those terms are defined under CCPA/CPRA). We do not sell your personal information. Advertising identifiers may be considered "shared" for cross-context behavioral advertising purposes under CPRA; you can limit this using the ad personalization controls described in Section 6.1, or via Global Privacy Control (GPC) signals where supported.

6.4 Other Jurisdictions

If you reside in a jurisdiction with similar data protection laws (e.g., Brazil's LGPD, Canada's PIPEDA), you may have comparable rights. Please contact us using the details in Section 9 to exercise any applicable rights.

6.5 Signed-In Account Data

If you signed in with your Google account, you can request access to, correction of, or deletion of the account data we hold (cassette balance, playlist history synced via Firestore) by contacting us at the email address in Section 9. Data associated with third-party services (Google/Firebase, AdMob) can also be managed directly through your Google Account privacy settings at myaccount.google.com/data-and-privacy.

7. Data Retention

Locally stored playlist history and settings remain on your device until you delete them or uninstall the app.
If you are signed in, your cassette balance and playlist history are retained in Firebase Firestore for as long as your account remains active, so they can sync across your devices. You can request deletion at any time (see Section 6.5).
Voice input is converted to text and discarded after conversion — we do not retain a copy of your raw voice recordings.
Diagnostic, crash, and analytics data collected by Firebase is retained according to Google/Firebase's standard retention periods, as described in Firebase's own documentation and privacy policy.
If you purchase Vibe Plus and later cancel, your entitlement status is retained only as long as necessary to reflect your current access, consistent with Google Play Billing's own data practices.

8. Age Restrictions and Children's Privacy

Vibelist is intended for use by adults and is not directed to children. Use of the App is restricted to users who are 18 years of age or older. We do not knowingly collect personally identifiable information from anyone under the age of 18. If we discover that a person under 18 has provided us with personal information, we will take steps to delete this information from our servers.

9. Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at:

Email: mind1060@gmail.com

10. International Data Transfers

Some of the third-party services we use (see Section 1.B and Section 5) may process and store data on servers located outside your country of residence, including in the United States. These third parties maintain appropriate safeguards (such as Standard Contractual Clauses, where applicable) to protect your information in accordance with applicable data protection laws.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. We will notify you of any changes by publishing the new Privacy Policy on this page. These changes are effective immediately after they are posted.