Privacy Policy

1. Introduction

Welcome to Jam Room ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Austrian and European Union data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Jam Room (the "App").

2. Data Controller

The data controller responsible for your personal data is:

Daria Lazepko
Jam Room
Seyringer Straße 1/2/269
1210 Wien
Austria
Contact: support@jamroom.eu

3. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Authentication credentials (managed securely through Apple Sign-In, Google Sign-In, or email/password)

User Content

When you use the App, you may create and store:

• Song projects including lyrics, chords, and song metadata
• Voice recordings and audio memos
• Project folders and organizational data

Subscription Data

• Subscription status (Free or Pro)
• Feature usage limits (transcription minutes, AI suggestion count)

Device Identifier

If you sign in to an account, we generate a random device identifier (stored in your device's Keychain) and register it to your account. This is used solely to enforce the Free plan's one-device sync limit and to let you see and manage which device is currently syncing. It is not used for tracking or advertising.

Within the App itself, we do not collect analytics, tracking data, or location data. Our marketing website (jamroom.eu) uses optional analytics cookies only if you consent — see Section 15: Cookies & Website Analytics.

4. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b)): To provide the App's core functionality — storing your projects, syncing data, managing your account, subscription, and your device's sync slot.
• Consent (Art. 6(1)(a)): For optional features such as AI-powered voice transcription, line suggestions, and rhyme generation, which send your audio or lyrics content to third-party AI providers for processing. You activate these features voluntarily.
• Legitimate interest (Art. 6(1)(f)): To maintain security, enforce fair-use limits, prevent abuse of our servers and AI features, and improve the App.

5. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App
• Back up and sync your content — one device for Free accounts, unlimited devices for Pro subscribers
• Process voice recordings you submit for AI transcription
• Provide AI-powered features such as line suggestions and rhyme finding
• Look up song artwork and metadata when you search for a song structure
• Manage your account and subscription
• Send transactional emails (e.g., email confirmation on sign-up)

6. Voice Recordings & AI Processing

When you turn on AI transcription for a voice memo, the recording is uploaded to our transcription provider, Gladia, through our own Cloudflare Worker gateway — your device never holds Gladia's credentials directly. Gladia converts the audio to text and returns it to the App; the resulting text is then stored as part of your project data like any other lyrics, and synced to our servers if you are signed in. If AI transcription is left off, voice memos are never sent anywhere for transcription.

AI-powered features (line suggestions, AI rhymes) send your lyrics text through the same gateway to third-party AI providers — Google (Gemini) and Groq — for processing. This data is used solely to generate the suggestion you requested and is not used to train AI models. We additionally rate-limit these requests per user to prevent automated abuse; see Section 9 of our Terms of Service for the related fair-use limits on Pro's "unlimited" AI features.

7. Data Storage & Security

Your data is stored securely using industry-standard practices:

• Local storage: Data is always stored on your device first, using Apple's SwiftData framework. Using the App requires a free account, but data does not leave your device unless you are signed in and backup/sync is active.
• Cloud storage: Once you sign in, your data is backed up and synced (one device on Free, unlimited devices on Pro), stored encrypted at rest and in transit:
  • Your projects, lyrics, chords, and account information are stored on Supabase servers located in the European Union (Stockholm, Sweden).
  • Voice recordings are stored on Cloudflare R2 object storage located in Eastern Europe (EU).
• Authentication: Handled through secure third-party providers (Apple, Google) or encrypted credential storage via Supabase Auth.
• Email service: Transactional emails are sent via Resend, which processes your email address to deliver confirmation emails.
• API gateway: Requests to our AI and transcription providers are proxied through our own Cloudflare Worker, which applies per-user rate limits and keeps provider API keys off your device.

8. Third-Party Services & Data Processors

We use the following third-party services to operate the App. Each acts as a data processor under GDPR:

Service	Purpose	Data Shared	Location
Supabase	Cloud database, authentication	Email, projects, lyrics, chords	EU (Stockholm)
Cloudflare R2	Voice recording storage	Voice recordings	EU (Eastern Europe)
Apple Sign-In	Authentication	Email (if shared by user)	Global
Google Sign-In	Authentication	Email	Global
Cloudflare Workers	API gateway, rate limiting, rhyme dictionary	Lyrics text, audio, request metadata (in transit, not stored by the gateway)	EU-routed, global network
Gladia	Voice memo transcription (when you turn it on)	Audio recording (per request)	EU
Google (Gemini)	AI line suggestions, AI rhymes	Lyrics text (per request, not stored)	USA
Groq	AI line suggestions, AI rhymes	Lyrics text (per request, not stored)	USA
Spotify	Song artwork and metadata lookup	Song title you search for	USA/EU
Resend	Transactional emails	Email address	USA
Apple (StoreKit)	Subscription payments	Managed by Apple, not accessible to us	Global

Data Processing Agreements (DPAs) are in place with Supabase, Cloudflare, Gladia, and Resend. For transfers outside the EU (Google, Groq, Resend), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Apple, Google, and Spotify operate under their own GDPR compliance frameworks, including SCCs and approved transfer mechanisms for international data transfers.

9. Data Sharing

We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:

• With your consent: When you choose to share a project via link with collaborators.
• Service providers: With the third-party processors listed above, solely to operate the App.
• Legal requirements: When required by law, court order, or to protect our legal rights.

10. User Content Confidentiality

The content you create in the App — including lyrics, voice recordings, chord data, and song projects — is private and confidential. It belongs to you.

Our team does not view, access, or use your User Content, except where you explicitly request technical support that requires us to do so. The only routine exceptions are our AI-powered features (voice transcription, line suggestions, and rhyme generation): when you use them, the relevant audio or lyrics text is sent to our processors (Gladia, Google, Groq) solely to generate the output you requested, and for no other purpose. Your content is never used to train AI models or for advertising.

If you sign in, answers and entries you save in Creative Tools (Check-In reflections, mood check-ins, and exercise drafts you choose to keep in the Archive) are backed up and synced like the rest of your project data, under the same confidentiality terms as your lyrics.

11. Your Rights Under GDPR

As a user in the European Union, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data. You can delete your account directly in the App under Settings → Delete Account. This permanently removes all your data from our servers.
• Right to restriction (Art. 18): Request that we limit how we process your data.
• Right to data portability (Art. 20): Request your data in a structured, machine-readable format. You can export your projects' lyrics as text and your voice memos as audio files from within the App.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7): Withdraw consent at any time for consent-based processing (e.g., stop using AI features).

To exercise any of these rights, contact us at support@jamroom.eu. We will respond within 30 days.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): www.dsb.gv.at

12. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• All personal data, projects, voice recordings, and associated content are permanently deleted from our live servers within 30 days.
• Local data on your device is cleared immediately.
• Residual copies of your data may persist in our infrastructure provider's (Supabase) automated encrypted backups for a limited period. These backups are not accessed in normal operations and are overwritten on a rolling schedule — typically within 7 to 30 days, depending on our hosting plan — after which the data is permanently gone.

13. Automated Decision-Making

The App does not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). AI-powered features (line suggestions, rhyme finder) provide creative suggestions only and do not make decisions on your behalf.

14. Children's Privacy

The App is not intended for children under the age of 14 (as set by the Austrian Datenschutzgesetz, implementing GDPR Art. 8). We do not knowingly collect personal information from children under 14. If we become aware that we have collected data from a child under 14, we will take steps to delete that information promptly.

15. Cookies & Website Analytics

This section applies to our marketing website (jamroom.eu), not the App. The App itself does not use cookies.

Strictly necessary

Our website uses no strictly necessary cookies. To remember your cookie choice, we store a single value in your browser's local storage (jamroom-cookie-consent); this is not a cookie and is not used for tracking.

Analytics cookies (consent required)

If you click "Accept" on our cookie banner, we load Google Analytics 4 to understand how visitors find and use our website (e.g. page views, traffic sources, country, device type). These cookies are not set unless you accept, and you can change or withdraw your choice at any time via the "Cookie settings" link in the website footer. We enable IP anonymization.

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique visitors	2 years
_ga_<ID>	Google Analytics	Maintains session state	2 years

Legal basis: Consent (Art. 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act 2021 / ePrivacy). Google Analytics may transfer data to the United States; such transfers rely on Google's Standard Contractual Clauses and the EU–US Data Privacy Framework. You can read Google's practices at policies.google.com/privacy.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the App and updating the "Last updated" date above. Where changes affect processing based on your consent, we will seek your renewed consent before applying those changes.

17. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us at:

support@jamroom.eu

For information about content ownership and intellectual property rights, please see our Terms of Service.