Privacy Notice
This is a draft. It describes how Beathex works and what this document will need to cover, but the wording has not been settled or reviewed. It does not create any obligation and should not be relied on.
What is collected
Account: email address, username, display name, optional biography, optional avatar, optional country and locale. Security: IP address and user-agent are recorded against sessions, login attempts and credential requests. Listening: play events with a track, a timestamp, a duration and a source. Commerce: orders, entitlements and, for sellers, ledger entries and payouts.
[LEGAL_TEXT_REQUIRED: What is collected]
Why it is collected
Running an account, delivering purchased licences, counting qualified plays, detecting credential abuse, and keeping an audit record of administrative and financial actions.
[LEGAL_TEXT_REQUIRED: Why it is collected]
Cookies
One cookie is set: the refresh token, httpOnly, SameSite=Lax, scoped to the authentication path. It exists to keep somebody signed in. **There is no analytics, advertising or third-party tracking anywhere in this application** — verified by inspection.
[LEGAL_TEXT_REQUIRED: Cookies]
Who else sees it
Object storage holds uploaded media. Email is delivered through an SMTP provider the operator configures. A payment provider has not been selected. No analytics provider is used.
[LEGAL_TEXT_REQUIRED: Who else sees it]
How long it is kept
Records use soft deletion, so rows persist after removal. Audit logs are append-only and currently have no retention policy. Both facts must be stated accurately rather than softened.
[LEGAL_TEXT_REQUIRED: How long it is kept]
Your rights, and the gap in them
**There is currently no self-service account deletion or data export.** Under the Digital Personal Data Protection Act 2023 a request would have to be handled manually. Whether that is sufficient is a question for counsel, and closing the gap is engineering work that has not been scheduled.
[LEGAL_TEXT_REQUIRED: Your rights, and the gap in them]
Contact for privacy questions
Requires a real monitored address supplied by the owner.
[LEGAL_TEXT_REQUIRED: Contact for privacy questions]
Contact
A monitored address for questions about this document has not been configured.
[LEGAL_TEXT_REQUIRED: contact address]