Privacy Policy

For the Rilea app and this website. Last updated 18 October 2026.

1. Controller

2. What Rilea does with your data

Rilea reads the playlists you own in Apple Music, SoundCloud or Spotify, shows them to you and, only after you explicitly confirm in the app, writes a cleaned or expanded playlist back. Your decisions (keep, remove, add) are stored on your device only.

3. Data sent to our backend

For suggestions, cleanup candidates, playlist splits and the chat, the app sends the names of the playlists involved and song metadata (title, artist, album, year, genre, and play counts from your device if available) to the Rilea backend. The backend runs on Vercel Inc. servers in Frankfurt, Germany (region fra1). From there the same data goes to Anthropic, PBC (USA) to generate the suggestions with the Claude language model. Anthropic processes API data under its Commercial Terms, does not use it to train its models, and is certified under the EU-US Data Privacy Framework; the transfer additionally relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: Art. 6(1)(b) GDPR (providing the features you request). No listening history, no name, no email address and no account identifier are sent. The backend keeps request logs for up to 30 days for troubleshooting; the cost log contains token counts and playlist counts, no personal data.

4. Installation identifier

The app generates a random identifier on first launch and sends it with each backend request so that usage limits can be enforced per installation. It is not linked to your name, your device or your music account. Usage counters tied to this identifier are deleted automatically after at most 40 days. Legal basis: Art. 6(1)(f) GDPR (protection against abuse and cost control).

5. Apple Music

Access to Apple Music runs through Apple's MusicKit framework on your device. Rilea asks for your permission via iOS. Apple's processing is governed by Apple's privacy policy. Rilea does not receive your Apple ID.

6. SoundCloud

If you connect SoundCloud, you sign in with SoundCloud in a system browser window. To complete the sign-in, the app sends the one-time authorization code to the Rilea backend, which exchanges it with SoundCloud and returns the tokens to the app; the backend does not store them. The access token and refresh token are stored in the iOS keychain on your device only and are used to read and edit your own sets and likes. All further requests go directly from your device to SoundCloud, which receives your IP address. You can revoke the access at any time in the app (“Disconnect”) or at soundcloud.com under Connected apps. SoundCloud's processing is governed by SoundCloud's privacy policy.

7. Spotify

Spotify is not yet open to everyone. It is available only to the few test accounts we have registered with Spotify. If you connect Spotify, you sign in with Spotify in a system browser window. Rilea receives an access token and a refresh token, which are stored in the iOS keychain on your device only and are used to read and edit your own playlists. You can revoke the access at any time in the app (“Disconnect”) or at spotify.com under Apps. Spotify's processing is governed by Spotify's privacy policy.

7a. Spotify waitlist on this website

If you enter your email address in the waitlist form on rilea.app, your browser sends the address, the page language and the time of sign-up to the Rilea backend (Vercel Inc., Frankfurt, region fra1). We store it in our database at Upstash, Inc. for one purpose only: to write to you once when Rilea works with Spotify. No newsletter, no tracking, no sharing. For abuse protection, the backend counts requests per IP address for one hour; the IP address is not stored with your email address.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by writing to the email address in section 1; we then delete your address. Otherwise we delete it right after that one message, at the latest 24 months after sign-up.

8. Song previews

To play 30-second previews, the app queries Apple's public iTunes Search API with the title, artist or ISRC of a song. Apple receives your IP address in the process. For SoundCloud tracks, the preview is streamed from SoundCloud's servers, which receive your IP address and the access token. Legal basis: Art. 6(1)(b) GDPR.

9. What Rilea does not do

No analytics, no advertising, no tracking, no third-party SDKs, no account. This website sets no cookies and loads no external resources.

10. Retention

Decisions and sessions stay on your device until you delete them or the app. Backend logs: up to 30 days. Usage counters: up to 40 days. Waitlist: until the Spotify message is sent, at most 24 months. Chat history: on your device only.

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Contact us at the address above. You also have the right to lodge a complaint with a supervisory authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

12. Changes

We update this policy when the app changes. The current version is always available at rilea.app/privacy.