Privacy Policy

Effective date: [Effective date pending]

These terms are being finalized. A few specifics — such as the effective date, mailing address, and certain retention periods — will be completed shortly.

1. Who this is and what it covers #

PocketDJ is a music library and DJ app for iPhone, iPad, Mac, and Apple Vision Pro. It is built and operated by [Publisher] ("we", "us"), a solo development effort. This policy covers the PocketDJ apps and the backend we call PocketDJ cloud services — the servers and storage that process audio you send us and serve the public catalog.

It also covers the jukebox guest page: a web page your guests open when you host a request line. If you arrived here from that page, skip to §9 — it is the only section about you.

We are the data controller for what this policy describes. Contact: contact@pocket-dj.com.

2. The short version #

• Your music library lives on your device and in your own storage. We do not upload it wholesale.
• Audio you choose to process — an upload, a file you import, a recording from your own analog source — is sent to PocketDJ cloud services to be converted, analyzed, and made available back to you. That is the main thing that leaves your device, and it only happens when you ask for it.
• We have no advertising, no analytics, no crash-reporting, and no attribution SDKs. None. The app ships exactly one third-party library (ZIPFoundation, for reading and writing zip files) and it does not touch the network.
• We do not sell your data, share it with data brokers, or use it for tracking as the App Store defines tracking.
• Speech transcription runs on your device. Audio for the karaoke transcript never reaches Apple's servers or ours. See §8 — there is a second, cloud-based lyrics feature and the difference matters.
• Apple Music is playback and library management only. No audio is copied out of Apple Music by PocketDJ, ever.

3. What stays on your device #

These never leave your device unless you personally export or share them.

One important exception. Microphone recordings and recorded mixes stay on your device unless you ask PocketDJ to separate one into stems. Stem separation runs in the cloud, so choosing it uploads that recording. PocketDJ will tell you before it does, and will not do it silently.

4. What goes to PocketDJ cloud services #

4.1 Audio you ask us to process #

When you upload a file, import audio you already have, or digitize one of your own analog sources, that audio is sent to PocketDJ cloud services. We use it to:

• convert it to a streamable format and store it so you can play it offline and load it into the Mix decks;
• separate it into stems (vocals, drums, bass, other) when you ask;
• analyze it for tempo, musical key, Camelot key, beat grid, and waveform, so beat-matching and key-matching work;
• transcribe lyrics when you ask (§8).

Audio you send us is received by an intake server we operate, which stores it and hands the work off to our worker machines and to managed AWS services. Stem separation and analysis run there. All of it is our own infrastructure in the United States. We do not send your audio to any outside company for AI processing — the transcription and separation models run on machines we operate.

You must hold the rights to any audio you upload, import, or digitize from your own sources. That is a condition of using the service, not a privacy matter, but it is worth saying here too: we process what you send us on the basis that you are entitled to send it.

4.2 Where your audio is stored, and who can reach it #

Your audio, your stems, your analysis files, and your transcripts are stored in your own private storage namespace. They are served to you over an authenticated connection, and PocketDJ has no feature for distributing them to other people.

4.3 The public catalog is metadata only #

PocketDJ publishes a browsable catalog so people can see collections, tracklists, and setlists for inspiration. The catalog documents contain metadata only — titles, artists, albums, genres, tempo, key, beat grids, waveform images, cover art, and lyric text. They contain no audio, and they are not a way to obtain audio. Playback always resolves through your own subscription or your own copies.

4.4 Search #

• Discover search sends the words you type to PocketDJ cloud services, which forwards them to Apple's public iTunes Search API to find a match. No user identifier is attached. We do not keep the search terms.
• Online catalog search is off by default and opt-in. When on, your query goes to our managed search service. We do not associate queries with your profile.

4.5 Server logs #

Our servers keep operational logs — request timing, errors, song ids, and for the jukebox, the text of guest requests. IP addresses reaching the jukebox are used for rate limiting. See §11 for retention.

5. What goes to Apple #

5.1 iCloud sync (CloudKit) #

If you are signed in to iCloud and sync is on, PocketDJ syncs these documents to your own private iCloud database:

your profile · collections (pockets, playlists, setlists) · your edits · favorites · play stats · play history · mix sessions · your current playback session · mix deck state · Discover adds · imported songs

Each synced record also carries the name of the device that pushed it, so the app can show you which device synced last. Your device name may identify you — many are of the form "<your first name>'s iPhone".

This data sits in your Apple Account's private database, governed by Apple's privacy policy. We cannot read it. PocketDJ uses only CloudKit's private database — never a public or shared database, and never CloudKit sharing. Turn sync off in Settings ▸ Sync.

A note on how we classify this: because a CloudKit private database is not readable by us, we take the position that it is not "collected" by the developer for App Store nutrition-label purposes. We are stating that position openly rather than leaving it implicit, so you can disagree with it if you want to.

5.2 Apple Music #

If you connect an Apple Music subscription, PocketDJ:

• plays full-length tracks through MusicKit;
• reads your library's playlist list, so collections you converted from an Apple Music playlist stay in step with their source;
• writes to your library only when you ask it to — adding a song or album you chose to add, or adding a song to one of your playlists.

No audio is copied, captured, recorded, or downloaded out of Apple Music by PocketDJ.

Favorites. Your ♥ in PocketDJ is local and syncs to your private iCloud database. Two-way sync with your Apple Music account is currently restricted to the developer's own account and is off for everyone else. If that ever opens up, you should know before you turn it on: adding a song to Apple Music's Favorite Songs cannot be undone by any app — Apple provides no removal API for it. The "loved" rating is reversible; the Favorite Songs entry is not. We will not enable this for anyone without an explicit, informed opt-in.

5.3 Song recognition (ShazamKit) #

When you use song recognition, your device listens through the microphone and computes an acoustic signature — a compact mathematical fingerprint. The signature is what gets sent to Apple's Shazam service. Your raw microphone audio is not transmitted, and no PocketDJ server is involved in the recognition itself. Governed by Apple's privacy policy. We keep the match result (title, artist, catalog id) locally.

Acting on a match is a separate step, and it is not local. If you choose to add a recognized song and have PocketDJ process it, the title, artist, and Apple Music catalog id are sent to PocketDJ cloud services to create that item. Recognition is private; acting on it is an upload request like any other in §4.1.

6. Other services in the path #

That is the complete list of outside parties in the app's request path. PocketDJ includes no third-party analytics, advertising, attribution, A/B-testing, or crash-reporting SDKs. The only third-party code in the binary is ZIPFoundation (MIT), which has no network access.

Metadata in the public catalog was assembled with help from public sources including Discogs, MusicBrainz, and Wikipedia. Those are developer-side tools that shaped the published catalog; the app does not call them at runtime, and they receive nothing from you.

7. Microphone #

PocketDJ asks for microphone access for exactly two things:

1. Recording samples and takes in Studio. These stay on your device (§3) unless you choose to separate one into stems, which uploads that recording.
2. Song recognition. ShazamKit takes over the microphone, derives a signature, and sends only the signature (§5.3).

PocketDJ does not listen in the background, does not record without an explicit action from you, and has no ambient-listening feature.

8. Two transcription engines, and why the difference matters #

PocketDJ has one karaoke feature and two engines behind it. They have very different privacy properties and we are not going to blur them.

On-device transcription (Apple Speech). When PocketDJ transcribes audio for the synced word-by-word overlay, it forces on-device recognition and refuses to run at all if the device cannot do it locally. There is no server fallback. The audio never leaves your device and Apple never receives it. This is a real, structural guarantee — not a policy promise — and it is the strongest privacy property in the app.

Cloud lyrics transcription. Separately, you can ask PocketDJ to generate lyrics from a track in the cloud. This uploads the audio (specifically the isolated vocal stem) to PocketDJ cloud services, where a machine-learning transcription model produces timed lyrics. The model runs on our own machines; no outside AI company receives your audio.

This is a distinct, opt-in action and PocketDJ will tell you what it does before it runs. If you want lyrics without uploading anything, use the on-device transcription instead.

9. Jukebox hosting and the guest request line #

Jukebox lets you run a request line at an event you are hosting. Guests scan a code, see what is playing, and send requests. It is built for private events you host. If you play music for an audience, any performance licensing your venue or event requires is your responsibility — the app does not provide it.

9.1 If you are the host #

While a session is live, PocketDJ publishes to the guest page: your DJ display name, the current track, your upcoming queue, recently played tracks, and the request list with your accept/deny decisions. Your play activity is otherwise private — this is the one time it goes anywhere but your own iCloud database.

Sessions are token-gated by default, capped to a limited number of listeners, and expire automatically. Sessions are not listed, enumerable, or search-indexable.

9.2 If you are a guest — what we collect from you #

You do not need an account, and we do not ask for your name, email, or phone number.

What we receive when you send a request:

• the song title and artist you type;
• a random identifier your browser generates and stores locally, so we can pace requests fairly;
• your IP address, as with any web request — used to operate the service and to stop abuse.

What the host sees: the text of your request. Not your IP address.

What other guests see: the request text on the queue. Nothing that identifies you.

How long: see §11.

Lawful basis (EU/UK): legitimate interests — running a request line you chose to use, and keeping it secure and abuse-free. You can object; see §12.

The guest page carries a short version of this notice at the point you type your request.

9.3 Listen-along #

A host can optionally let guests hear the current track on their own phones. It is off by default and only the host can turn it on. When it is on, guests stream the host's own copy of the track for the duration of the session. This is for people physically present at the event you are hosting. The Terms of Service prohibit using PocketDJ to broadcast, webcast, simulcast, or otherwise transmit music to people who are not present at your event; listen-along is not a broadcast service, and the audience limits in §9.1 apply to it.

10. What we do not do #

• We do not sell your personal data.
• We do not share it with data brokers or advertisers.
• We do not track you across other companies' apps and websites. The app declares no tracking and no tracking domains, and requests no tracking permission.
• We do not run ads.
• We do not collect your location, contacts, health, financial, or browsing data.
• We do not auto-upload diagnostics or crash reports to ourselves.
• We do not read your iCloud private database.
• We do not copy audio out of Apple Music.
• We do not sell or share your personal information as those terms are defined by California law. See §12.3.

11. How long we keep things #

12. Your rights and your controls #

Controls built into the app, wherever you live:

• Settings ▸ Sync — turn iCloud sync off, or pull/push on demand.
• Settings ▸ Storage — delete downloaded audio and recordings by artist, by collection, or all of it; set a storage cap.
• Export — take your collections, playlists, and library out as a file at any time. That is your data portability route and it does not require asking us.
• Microphone and Apple Music permissions — revocable at any time in iOS/macOS Settings.
• Online search — off unless you turn it on.

Legal rights. Depending on where you live — including under the EU GDPR, the UK GDPR, and US state privacy laws — you may have the right to access, correct, delete, export, or restrict our processing of your personal data, to object to processing based on legitimate interests, and to lodge a complaint with your data protection authority. Most of your data is on your device or in your own iCloud account, so you already control it directly. For anything we hold, write to contact@pocket-dj.com and we will respond within [period].

12.1 The categories of personal data we process #

GDPR Art. 13/14 asks for these in list form:

• Identifiers — your profile identifier (a random UUID), your DJ display name, and for jukebox guests an IP address and a random browser identifier.
• User content — audio you upload, import, or digitize; stems, analysis, and transcripts derived from it; your collections, playlists, setlists, and edits; jukebox request text.
• Usage data — play history and play stats, and the now-playing/queue state published while a jukebox session is live.
• Search data — Discover search terms and, if you turn it on, online catalog queries.
• Device data — the device name attached to each synced record, and operational request metadata in server logs.

We process no special-category data (Art. 9), no location, no contacts, no health or financial data, and no browsing history.

Whether you have to provide it (Art. 13(2)(e)). None of this is a statutory requirement. Providing audio, a display name, or a jukebox request is a contractual necessity only in the narrow sense that the specific feature cannot function without it — if you do not upload audio, the cloud features simply do not run, and the rest of the app works. There is no consequence to declining beyond the loss of that feature.

Automated decision-making (Art. 13(2)(f)). There is none. PocketDJ does no profiling and makes no automated decision producing legal or similarly significant effects about you. Tempo, key, and beat-grid analysis are measurements of an audio file, not evaluations of a person.

12.2 Our lawful bases (EU/UK) #

12.3 California and other US state privacy rights #

If you are a California resident, you have rights to know, delete, correct, and opt out of sale or sharing of your personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for purposes requiring a right to limit. We will not discriminate against you for exercising any of these rights. To make a request, write to contact@pocket-dj.com.

12.4 If there is a data breach #

If personal data we hold is breached in a way that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where the risk is high, notify you directly.

12.5 The other documents #

This policy is one of three. See also the Terms of Service and the Copyright / DMCA Policy.

13. Deleting your data and your account #

PocketDJ does not require you to create an account with us. It creates a profile — a randomly generated identifier and a display name you choose — so your library can sync across your devices and so guests know whose jukebox they are in.

To delete your profile and everything associated with it: Settings ▸ Profile ▸ Delete Profile. This deletes, in one action: your profile record and display name, your synced documents in your private iCloud database, any audio and derived files stored for you by PocketDJ cloud services, and any jukebox sessions you created. It cannot be undone.

If you delete the app without deleting your profile, your device copies go with it. Your private iCloud data stays in your Apple Account until you remove it (iOS Settings ▸ your name ▸ iCloud ▸ Manage Storage), and anything stored for you by PocketDJ cloud services stays until you ask us to delete it.

Either way, you can email contact@pocket-dj.com and ask us to delete everything we hold. We will.

14. Children #

PocketDJ is not directed to children under 13, and we do not knowingly collect personal information from them. The app is not in the App Store Kids Category, does not carry a kids age band, and has never been designated as made for kids.

The App Store age rating is [age rating pending], computed by Apple from our content questionnaire. The rating reflects that recorded music and album artwork can contain mature themes, references to alcohol, tobacco or drugs, and profanity — not anything in the app itself.

If you believe a child under 13 has provided us personal information, email contact@pocket-dj.com and we will delete it. In practice the only way a child's data could reach us is by sending a jukebox request as a guest (§9.2), which collects no identifying details beyond an IP address and a random browser identifier.

If you are in the EU or UK, the age of consent for information-society services is 13 to 16 depending on your country. We do not offer PocketDJ to users below the applicable age in their country.

15. Where your data goes, internationally #

Our servers and storage are in the United States. If you use PocketDJ from outside the US — including from the EU or UK — the data described in §4 and §9 is transferred to and processed in the United States.

Transfer mechanism: [to be specified].

Data you sync through iCloud is handled by Apple under Apple's own arrangements, not ours.

EU/UK representative and Data Protection Officer: [to be confirmed]

16. Security #

We use HTTPS for everything, store credentials in the system Keychain, and serve your stored audio over authenticated, short-lived links.

No system is perfectly secure. If you find a vulnerability, please report it to security@pocket-dj.com.

17. Changes to this policy #

We will post any change here and update the effective date at the top.

If a change materially expands what we collect, how we use it, or who receives it, we will tell you in the app before the change takes effect and — where the law requires consent — ask for it rather than assume it. We will not apply a materially different use to data we already hold without asking you first.

Past versions are kept in the project's public repository history so you can see exactly what changed and when.

18. Contact #

Privacy questions, access requests, deletion requests: contact@pocket-dj.com

Everything else: support@pocket-dj.com

Postal: [Mailing address]

We aim to respond within [period].

If you are in the EU or UK and are not satisfied with our response, you may complain to your national data protection authority.

Appendix A — Data flow summary #

Read this as the one-page version of §3 through §9.

PocketDJ is built by one person. This policy is written to be read, not to be impenetrable. If something in it is unclear or looks wrong, write to contact@pocket-dj.com and it will get fixed.