Privacy policy
Shader Bytes · last updated 20 August 2026
We collect what is needed to run a music service and nothing we cannot justify. We never sell your data. Advertising cookies are off until you switch them on. You can take everything with you, or delete all of it, from inside the app.
Contents
The controller of your personal data is Shader Bytes — full details on the legal notice. Reach us about anything on this page at support@stereobox.io. This covers the Stereobox apps and the website at stereobox.io, and the artist studio and administration console on their own subdomains.
If you want the mechanics rather than your rights — who processes data for us, where the servers are, how long things are kept — that is the data policy.
What we collect, and why
Under the GDPR every use of your data needs a lawful basis. Here is ours, line by line.
| What | Why | Lawful basis |
|---|---|---|
| Email address, display name, username, and profile picture if you add one | To create your account and sign you in. Handled by Google Firebase Authentication. Signing in with Google or Apple sends us your name, email and picture from them. | Performance of our contract with you |
| A record that you accepted these terms — the date and time, your IP address, and your device and app version | So we can show, if it is ever questioned, that you were asked and agreed. The law requires us to be able to demonstrate this. | Legal obligation, and our legitimate interest in defending a claim |
| What you play, and how much of each track you hear | To build the charts, to decide what to recommend, and to pay artists. Artists see counts and totals, never who you are. | Performance of our contract, and our legitimate interest in a working chart |
| Likes, playlists, follows, cue points and queue | They are the product. Kept until you delete them. | Performance of our contract |
| Purchases, licences and subscription status | To know what you own and what you may do with it. Card details never reach us — Google, Apple and Stripe take the payment and send us a reference and the result. | Performance of our contract, and a legal obligation to keep records |
| Messages you send other people on Stereobox | To deliver them. We read them only when someone reports one. | Performance of our contract |
| Device push token | To send notifications you asked for. Deleted when you sign out or turn them off. | Consent |
| IP address and basic request logs | To keep the service up, stop abuse and rate-limit attacks. Kept briefly. | Legitimate interest in security |
| Advertising identifiers and cookies | Only if you accept them. See cookies. | Consent |
| What you upload, if you are an artist — audio, artwork, video, and the text you write about it | To publish and sell it, and to pay you. | Performance of our contract |
What we do not do
- We do not sell your personal data. Not to advertisers, not to anyone.
- We do not use your listening history to target advertising. Ads on Stereobox are served by Google AdSense from the page, not from a profile we hand over.
- We do not read your private messages except when one is reported to us.
- We do not use your music or your listening to train machine-learning models, and we do not let anyone else scrape the catalogue to do so.
Advertising
Free listening is paid for by ads, served by Google AdSense. Advertising cookies are denied by default and nothing is loaded until you accept — you can change your mind at any time from cookie settings or the Settings screen in the app. Google's own explanation of what it collects when you do accept is at policies.google.com/technologies/partner-sites.
Your rights
Wherever you are, you can ask us to do all of the following, free of charge, and we answer within one month:
| Right | What it means |
|---|---|
| Access | A copy of everything we hold about you. |
| Rectification | Fix anything wrong. Most of it you can edit yourself. |
| Erasure | Delete your account and its contents — how to. |
| Portability | Your data in a machine-readable file you can take elsewhere. |
| Restriction and objection | Tell us to stop a particular use, including anything we do on the basis of legitimate interest. |
| Withdraw consent | For anything based on consent — ads, notifications — at any time, as easily as you gave it. |
If you are in the EEA or the UK you may complain to the data protection authority of the country you live in — you do not have to use ours, and you do not have to come to us first, though we would rather you did. In India you may complain to the Data Protection Board.
Children
Stereobox is not for children. You must be 16 in the EEA and the UK, 18 in India, and 13 elsewhere. We do not knowingly collect data from anyone younger, and delete it when we find it — tell us at support@stereobox.io if you believe a child has an account.
Automated decisions
Recommendations are automated: what you are shown is chosen by an algorithm from what you have played. It has no legal effect on you and you can ignore it. Nothing else — no account closure, no payout, no moderation outcome — is decided by a machine alone.
Changes
We will tell you in the app and by email before anything material here changes. The date at the top is always the current version.
Contact
support@stereobox.io, or write to the address on the legal notice.