Privacy Policy

For the Rilea app and this website. Last updated 10 September 2026.

1. Controller

2. What Rilea does with your data

Rilea reads the playlists you own in Apple Music or Spotify, shows them to you and, only after you explicitly confirm in the app, writes a cleaned or expanded playlist back. Your decisions (keep, remove, add) are stored on your device only.

3. Data sent to our backend

For suggestions, cleanup candidates, playlist splits and the chat, the app sends the names of the playlists involved and song metadata (title, artist, album, year, genre, and play counts from your device if available) to the Rilea backend. The backend runs on Vercel Inc. servers in Frankfurt, Germany (region fra1). From there the same data goes to Anthropic, PBC (USA) to generate the suggestions with the Claude language model. Anthropic processes API data under its Commercial Terms, does not use it to train its models, and is certified under the EU-US Data Privacy Framework; the transfer additionally relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: Art. 6(1)(b) GDPR (providing the features you request). No listening history, no name, no email address and no account identifier are sent. The backend keeps request logs for up to 30 days for troubleshooting; the cost log contains token counts and playlist counts, no personal data.

4. Installation identifier

The app generates a random identifier on first launch and sends it with each backend request so that usage limits can be enforced per installation. It is not linked to your name, your device or your music account. Usage counters tied to this identifier are deleted automatically after at most 40 days. Legal basis: Art. 6(1)(f) GDPR (protection against abuse and cost control).

5. Apple Music

Access to Apple Music runs through Apple's MusicKit framework on your device. Rilea asks for your permission via iOS. Apple's processing is governed by Apple's privacy policy. Rilea does not receive your Apple ID.

6. Spotify

If you connect Spotify, you sign in with Spotify in a system browser window. Rilea receives an access token and a refresh token, which are stored in the iOS keychain on your device only and are used to read and edit your own playlists. You can revoke the access at any time in the app (“Disconnect”) or at spotify.com under Apps. Spotify's processing is governed by Spotify's privacy policy.

7. Song previews

To play 30-second previews, the app queries Apple's public iTunes Search API with the title, artist or ISRC of a song. Apple receives your IP address in the process. Legal basis: Art. 6(1)(b) GDPR.

8. What Rilea does not do

No analytics, no advertising, no tracking, no third-party SDKs, no account. This website sets no cookies and loads no external resources.

9. Retention

Decisions and sessions stay on your device until you delete them or the app. Backend logs: up to 30 days. Usage counters: up to 40 days. Chat history: on your device only.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Contact us at the address above. You also have the right to lodge a complaint with a supervisory authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

11. Changes

We update this policy when the app changes. The current version is always available at rilea.app/privacy.