Privacy Policy

Last updated: 2026-09-26

PoyoMusic is a music app focused on the music of Sierra Leone, available on the web and as a mobile app. PoyoMusic is operated by its owner ("we", "us"). This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

You can browse and search music without an account. If you create an account we store:

• Account details: a username, your email address, and an optional display name.
• Password (if you sign up with a password): stored only as a salted scrypt hash, never in readable form.
• Social sign-in: if you sign in with Google, Facebook or Apple, we receive your name and email address (where the provider shares it) and the provider's account identifier, and we store the identifier so we can recognise you next time. We do not receive or store your social account password. Facebook may not share an email address; in that case we create a placeholder address for the account.
• Your library: playlists you create, songs you like, and the tracks you add to playlists.
• Session data: a login session record linked to your account so you stay signed in.

Information stored on your device

Some features work on your device rather than on our servers, for example listening history, downloaded tracks for offline listening, and settings such as Data saver. This information stays on your device and is removed when you clear the app's data or uninstall it.

How we use information

We do not sell your personal data, we do not show advertising, and we do not use your data for advertising or profiling.

• To provide your account, sign you in, and keep your playlists and likes.
• To send account emails you trigger, such as email verification and password reset links (sent through our email delivery provider).
• To secure the service, prevent abuse and fix problems.

Music sources and third parties

Music and metadata come from several sources: YouTube (played through YouTube's embedded player, which is subject to YouTube's own terms and privacy policy), Jamendo (freely licensed music), iTunes (track and album metadata and artwork), and tracks hosted by PoyoMusic that were uploaded with the artist's consent. When you play a YouTube track, YouTube may collect data about your viewing under its own policy.

If you use Google, Facebook or Apple to sign in, that provider handles your sign-in under its own privacy policy. Our email delivery provider processes your email address only to deliver the messages described above.

Logs, analytics and cookies

We do not use third-party analytics, advertising trackers or third-party error-reporting services. Our server keeps standard operational logs (request method, path, response status and timing, and error messages) to run and debug the service; these do not include your passwords or request contents.

We use a single essential session cookie to keep you signed in. It is HTTP-only, sent over HTTPS, and lasts up to 30 days. We do not use advertising or tracking cookies.

Anonymous error reports

When the app or website crashes or hits an error, it can send a short anonymous error report to our own server (not to any third party). A report contains: the error message and technical stack trace (with email addresses, phone numbers, tokens and web-address query strings removed before sending), the app version and build, the operating system version, a coarse device model (for example the phone model), the screen or page where it happened, and a random session identifier generated on your device that is not linked to your account, name or email. Reports do not contain your name, email address, username, playlists or listening history.

We use these reports only to find and fix bugs. Reports are deleted automatically after 30 days. You can turn them off at any time: in the mobile app under Settings ("Send anonymous crash reports") and on the website under Account ("Send anonymous error reports"). The website also respects your browser's Do Not Track setting.

Anonymous play counts and charts

To build the Sierra Leone chart, when you listen to a track for a meaningful amount of time (about 30 seconds) we record an anonymous play event: the track, the time, and a salted one-way hash of your account or app-install identifier. The hash is used only to avoid counting the same listener twice and to block abuse; it cannot be reversed to identify you, and we do not keep a listening history tied to your identity or show it to anyone. Charts show only aggregate counts of unique listeners per track.

Play events are deleted automatically after 180 days.

Where your data is stored

Account and library data is stored in a PostgreSQL database hosted on Railway. Hosted audio files are stored with our cloud storage provider. Data may therefore be processed outside Sierra Leone.

Retention and deletion

We keep your account data until you delete your account. You can delete your account and its data at any time, from the app or by email. See our User Data Deletion page (/data-deletion) for the steps.

Children

PoyoMusic is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Artists and takedown requests

Tracks hosted by PoyoMusic are added only with the artist's consent, and we record that consent. Artists or rights holders can ask us to remove a track at any time by emailing us; we act on valid requests promptly. Tracks played through YouTube or Jamendo are controlled by those services.

Security

We use HTTPS, hashed passwords and HTTP-only cookies, and limit who can access the database. No online service is perfectly secure, so we cannot guarantee absolute security.

Changes to this policy

If we change this policy we will update the date at the top of this page.

Contact

Questions or requests about your data: [email protected]