Privacy

Controller

hiss is a non-profit personal project run by an individual living in Spain. There is no company or association behind it yet.

For any privacy matter, write to the email on the contact page. If you need the controller's full identity (for example, to file a complaint), ask for it there and we will provide it.

What data we keep

Your email, your username and, if you use email and password, an encrypted hash of the password; we never store it in plain text.

What you publish: scores, listens, reviews, track scores, favorites and the likes you give (people see how many a review has, not who gave them). Your profile is public by default: anyone can see your username, reviews, scores, favorites, who you follow and who follows you.

Your “To listen” list is public too, like the rest of your profile. It is deleted with your account.

What we don't publish: the genres you choose and what you say about each album the first time (not for me, like it, love it, haven't listened to it). They are only used to recommend music and don't appear on your profile.

If you sign in with Google, we receive the name and email of your Google account. We access nothing else.

If you sign in with Apple, we receive your Apple ID email (or an Apple relay address, if you choose to hide it) and, only the first time, your name if you choose to share it. We access nothing else.

If you upload a profile photo, we store it in Vercel's storage and it is public, like the rest of your profile. We don't use the photo from your Google account. You crop it in your browser before uploading, which also removes hidden image data (location, camera). You can remove it any time and it is deleted when you delete your account.

For security, your session stores the IP address and browser you signed in with.

If you report a review or a profile, we keep the report linked to your account so we can review it. The reported person does not learn who reported them.

If you send feedback on the beta, we keep that text linked to your account. Only the administrators read it, and it's deleted with your account.

If you share or download a Stories card, we record the card type and the date to know whether the feature gets used. We don't keep the image or where you post it, and it is deleted with your account.

If you turn on notifications in the iPhone app, we store that phone's notification identifier (an Expo code, without your name) to tell you when someone follows you or likes one of your reviews. You can turn them off in the app's Settings or in iOS; when you do, when you sign out or when you delete your account, we delete it. We send no advertising and no notifications at night (23:00 to 08:00, Madrid time).

The iPhone app

The app uses the same account and keeps the same data as the website. Your session is stored encrypted in the iPhone keychain.

If you pick a profile photo, the app only accesses the photo you choose; it crops it on the phone before uploading and does not read the rest of your library.

To get improvements without going through the App Store, the app downloads updates from Expo's servers (650 Industries, USA), which receive your IP address and technical device data (model, system and app version). They do not receive your account or what you do on hiss.

The app shows no ads, does not track you across other companies' apps or websites and does not share data with third parties for commercial purposes.

What we use it for

To provide the service (your record diary, reviews and cards), keep it secure, and moderate reported content. We don't sell it and don't use it for advertising or profiling.

Legal basis

Your account, what you post, your public profile, recommendations and cards: we process them because they are the service you ask for when you sign up (performance of a contract, Art. 6(1)(b) GDPR).

Security (sessions, rate limits against abuse), handling reports and counting shared cards: our legitimate interest in keeping hiss working and safe and knowing what gets used (Art. 6(1)(f)). You can object by writing to us.

Beta feedback: you send it voluntarily and can ask us to delete it.

Who it is shared with

We use providers that process data on our behalf: Vercel (web hosting and storage of profile photos), Neon (database, EU region), Google (only if you choose to sign in with Google), Apple (only if you choose to sign in with Apple) and Expo (updates for the iPhone app).

To search music and recommend albums, our server queries the Apple (iTunes) and Deezer catalogues with your search text or an artist name, and Wikipedia for album descriptions, without sending anything that identifies you. Cover images load from Apple's and Deezer's image servers, so your browser reaches them with your IP address, as with any website that shows their images.

The website and database run in the European Union (Frankfurt). Vercel, Google, Apple and Expo are US companies and may process data there; such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses included in their terms.

Cookies

We only use necessary cookies: the session cookie (to keep you signed in) and our own hiss_seen, which only remembers that you saw the welcome page. While you score an album track by track, that progress is kept in your browser's storage until you publish, and if you tap "Not now" on a prompt, that is remembered there for a week. There are no advertising or analytics cookies or third-party trackers.

How long

For as long as you have the account. If you delete it from Settings, your profile, scores, listens, reviews, favorites, genres, album reactions, likes and follows are removed. Technical hosting logs are kept for the limited time each provider sets.

Your rights

You can access, correct, delete and download your data (Settings → Download my data), object to or restrict its processing by writing to the contact email. If you think we haven't respected your rights, you can complain to the Spanish Data Protection Agency (aepd.es).

Minimum age

You must be 14 or older to create an account. You confirm it when you sign up.