Privacy Policy for Playlist4Active
1. Introduction & Philosophy
At Glaucus TC Sp. z o.o., we believe your fitness and music habits belong exclusively to you. Playlist4Active is engineered upon a strict Zero-Data Retention and Privacy-by-Design architecture:
- No data collection servers: We do not operate backend servers that harvest, track, or sell your personal information.
- No account required: You never need to register an account with us.
- No music login credentials: The app never requests or accesses your passwords or credentials for Spotify, Apple Music, Tidal, YouTube Music, or any other media service.
2. Data Processing and Handling
A. Workout Music Metadata Capture (Local Only)
- Data processed: Track title, artist name, and playback timestamp.
- Mechanism: With your permission, the Application uses Android's native
NotificationListenerServiceandMediaSessionManagersolely to capture currently playing song titles from any media player on your phone. - No audio recording: The Application NEVER listens to your microphone or analyzes audio streams. It exclusively reads textual metadata broadcast in system notifications.
- Zero-Data Policy: Song entries are held in volatile temporary memory during your workout session. Once synced to Strava or dismissed, all captured tracks are permanently deleted from your device.
B. Strava Integration (OAuth 2.0)
- Scope: Read access to activities and write access to activity descriptions (
activity:read_all,activity:write). - Mechanism: Communication occurs directly between your mobile device and Strava's official API servers using Strava OAuth 2.0.
- Token Storage: Tokens are stored locally on your device in
SharedPreferences. They are never transmitted to Glaucus TC. - Activity Updates: The Application only appends your workout playlist into the activity description. It never alters GPS routes, heart rate data, power output, or segments.
- Revocation: You may revoke access at any time within the app by tapping "Disconnect" or through your Strava account settings.
C. Album Artwork & Metadata Enrichment (Apple iTunes API)
To retrieve high-resolution album artwork and resolve missing artist tags for local audio files, the Application queries Apple's public iTunes Search API (https://itunes.apple.com/search) using the song title.
No personal data or device identifiers are shared during these lookups.
3. Legal Basis (GDPR)
Under the European Union General Data Protection Regulation (GDPR):
Art. 6(1)(b) & (a) GDPR: Processing is conducted solely to fulfill your requested functionality and based on your explicit consent for notification access and Strava authentication.
4. Your Rights
Under GDPR, you retain full rights to:
- Erasure: Instantly wipe local session history by tapping "Clear Songs" or completing a sync.
- Withdraw Consent: Disconnect your Strava account at any moment.
- Lodge a Complaint: Contact your relevant European data protection supervisory authority.
5. Contact Information
Glaucus TC Sp. z o.o.
Website: https://glaucus.pl
Email: privacy@glaucus.pl