Privacy policy

Groof is made by Rekordcloud B.V., a private limited company registered in the Netherlands (Chamber of Commerce 85684759) in Enschede (“Rekordcloud”, “we”, “us”). We are the controller of the personal data described here under the EU General Data Protection Regulation (GDPR). This policy covers the Groof app on every platform, our API, the website at groof.app and the messages we send you (together “Groof”). It is part of the terms of use.

1. What we collect

• Account: your email address, your name or display name, and the identifier of the sign-in you use (Google, Apple or email), plus when you created the account and accepted the terms. You can try Groof before creating an account; what you do in that trial is kept under a temporary account and attached to your real account when you create one.
• Music activity: the tracks you hear, like, skip and rewind, with their artist, title, BPM, key, genre and source; your sessions and the sources you pick; your Prep List and pinned sets; your settings and filters such as BPM range, key and genres; and the statistics we work out from all of this.
• Connected services: if you connect Spotify or another service, we receive what that service gives us with your permission, such as your profile identifier, playlists, followed artists and saved tracks, plus the access tokens needed to keep the connection working. We use it to show you music and to save tracks where you ask us to. You can disconnect at any time.
• Subscription: your plan, its status and renewal date, the store you bought through, and the customer and transaction identifiers our payment provider gives us. We never receive your card number; the store or payment provider handles that.
• Technical and usage data: device type, operating system, app version, language, approximate country, IP address, timestamps, which features you use, and crash and diagnostic information. Our servers keep request logs that include your IP address and account identifier.
• Website and advertising data: when you visit groof.app, the pages you view, the buttons you use (such as a download button), the address that sent you there, the campaign details in the link (such as which ad you clicked), the click identifier an advertising platform adds to that link, and identifiers stored in cookies. When you create an account or subscribe, we may link that event to the ad that brought you, as described in section 5.
• Your choices: whether you opted out of tracking on groof.app, and whether you closed the notice about it.
• Support: the emails you send us and what we need to answer them.
• From other Rekordcloud Products: if you use another Rekordcloud Product, we may link that account to your Groof account and receive data from it, as described in section 4.

2. Why we use it and on what basis

• To run Groof (performance of our agreement with you): sign you in, play and filter tracks, keep your likes, Prep List and settings, remember what you have heard, and manage your plan.
• To take payment and keep records (agreement and legal obligation): process subscriptions and keep the records tax law requires.
• To keep Groof safe (legitimate interest): prevent abuse and fraud, enforce limits and the terms, fix bugs, keep logs and investigate problems.
• To improve and develop Groof and other Rekordcloud Products (legitimate interest): understand which features are used, measure how Groof performs, build and refine recommendations, track data, statistics and models, and develop new features and products, some of them paid.
• To communicate with you (agreement, and legitimate interest for product news): send messages about your account, your plan and changes to Groof, and tell you about Groof features and other Rekordcloud Products. You can opt out of news at any time; service messages continue while you have an account.
• To advertise Groof and measure our advertising (legitimate interest; you can opt out at any time): find out which ads and campaigns bring people to Groof, count downloads, accounts and subscriptions that follow an ad, show our ads to people likely to be interested, and avoid showing them to people who already use Groof. See section 5.
• To comply with the law and handle claims (legal obligation and legitimate interest): respond to lawful requests, and establish, exercise or defend legal claims.
• With your consent, where we ask for it, for example for an optional permission on your device. You can withdraw consent at any time.

Recommendations are automated, but Groof makes no decision about you that has legal or similarly significant effects. Picking the next track is all it decides.

3. Who else handles your data

We use these providers to run Groof. They process data on our behalf under their data processing terms:

• Google Firebase for sign-in, and Google and Apple as sign-in providers.
• PostHog (EU cloud, servers in the European Union) for product analytics in the app and on groof.app: which features are used, how sessions go, and which visits lead to a download, an account and a subscription. It receives your account identifier, the events listed above with device and app details, and, on groof.app, the pages you view and how you arrived. We send it through our own address, e.groof.app, and don’t use its session recordings.
• RevenueCat for subscriptions, together with Stripe (when you buy from our website or the desktop app), the Apple App Store or Google Play.
• Cloudflare for delivering groof.app and our API, and for protecting them against abuse.
• Advertising and analytics platforms such as Reddit, Meta, Google and TikTok, for measuring and targeting our own ads, as described in section 5.
• Hosting and backups: our database runs on servers in the European Union, with encrypted backups in cloud storage in the EU (Frankfurt). The app checks a Rekordcloud update server for new versions, which sees your IP address and app version.
• Music services (Beatport, Bandcamp, SoundCloud, Spotify): the app and our API ask them for tracks, previews and artwork. They see those requests, including your IP address when the app makes them, as ordinary requests under their own privacy policies.

We may also disclose personal data:

• To other Rekordcloud Products, as described in section 4.
• To our professional advisers, such as lawyers and accountants, where needed.
• When the law, a court or an authority requires it, or to protect the rights, property or safety of Rekordcloud, our users or others, or to enforce the terms.
• In a merger, acquisition, financing or sale of all or part of our business, to the other party, who is then bound by this policy or an equivalent one.
• In aggregated or de-identified form that cannot be linked back to you, to anyone.

We don’t sell your personal data for money and Groof shows no ads. Advertising platforms receive data only as described in section 5.

4. Rekordcloud Products and sharing between them

“Rekordcloud Products” are the products and services made and operated by Rekordcloud B.V. or by a company it owns, now and in the future, such as Groof, Lexicon DJ, Sonovault and MixID. No outside company, advertiser or partner is ever a Rekordcloud Product. Rekordcloud B.V. is the controller for all of them, so data moved between them stays inside the same company and under this policy or the equivalent policy of the other product.

What we share

• Your account details, so that we can recognise the same person across products, link accounts that use the same email address, and let one account work in more than one product.
• Your plan and purchase history, so that a subscription or entitlement can be honoured or offered across products.
• Your music activity (section 1), including likes, skips, Prep List, settings and the statistics derived from them, and data from a connected service where that service’s terms allow it.
• Technical and usage data, so that we can understand how people use the products together.
• The same kinds of data from the other products, brought into Groof.

Why

• To provide features that span products, for example showing your Groof likes in Lexicon DJ or using your library in another product to pick music for you in Groof.
• To build and improve all Rekordcloud Products: music data, recommendations, statistics, models and new features, some of them paid.
• To run the products efficiently, with shared accounts, support, billing and infrastructure.
• To tell you about other Rekordcloud Products and features we think will interest you.

Music activity that no longer identifies you, such as which tracks tend to be liked together, BPM, key and genre patterns and aggregated statistics, may be kept and used in any Rekordcloud Product without limit.

Legal basis and your choices

Where you use your account in more than one product or connect them, sharing is needed to perform our agreement with you. Otherwise we share on the basis of our legitimate interest in running, developing and promoting Rekordcloud Products as one business, which the GDPR recognises for data moved inside a company for internal purposes. Where the law requires consent, we ask for it. By accepting the terms you also agree to this sharing. You can opt out of news about other Rekordcloud Products at any time, and you can object to other sharing by emailing us, although features that depend on it will then stop working.

5. Advertising and measuring our ads

Groof shows no ads, but we advertise Groof on other platforms. To know which ads work and to show them to the right people, we use tools those platforms provide. We currently use or may use Reddit, Meta (Facebook and Instagram), Google (Google Ads, YouTube and Google Analytics), TikTok, X, Snap and Microsoft Advertising. We name any other platform here before we start using it.

What we use

• Pixels and tags on groof.app: small pieces of code from the platform that set or read cookies and send the platform what happens on the site, such as a page view, a click on a download button or the start of a checkout, together with the ad click identifier, your IP address, browser and device details, and cookie identifiers.
• Server-to-server events (such as Meta’s and Reddit’s Conversions APIs and Google’s enhanced conversions): when you create an account or start or renew a subscription, our servers may tell the platform that this happened, with your email address and our account identifier in hashed form (SHA-256, a one-way code), your IP address, device details, the ad click identifier if there is one, and for a purchase the plan, price and currency. The platform uses the hashed values only to find out whether the event belongs to someone who saw or clicked one of our ads; it can recognise a hashed email only if it already knows that address.
• Audiences: we may give a platform a hashed list of the email addresses of our users so that it can leave existing users out of our ads, or find people similar to them. Platforms match these lists against their own users and delete the hashes they cannot match.
• In the app: Groof does not use your device’s advertising identifier (IDFA or AAID) unless you allow it through your device’s own prompt. When you download Groof from groof.app, we keep your IP address with that download for up to 48 hours. When the app is first opened from the same address, our server links the two, so that we can see which visit, and so which ad or link, led to the install. A download that no app claims is forgotten after the 48 hours.

Legal basis and how to opt out

• We use these tools on the basis of our legitimate interest in promoting Groof and knowing which of our ads work. The pixels on groof.app load when you open the site, and a notice tells you about them.
• Opting out on groof.app: choose Opt out in that notice, or Cookie settings at the bottom of every page. We then stop loading analytics and advertising pixels in that browser, tell the pixels already loaded to stop, and delete their cookies. Closing the notice does not opt you out. We remember an opt-out with a small cookie of our own for two years; clearing your cookies forgets it.
• Global Privacy Control: if your browser sends this signal, we treat it as an opt-out and load no pixels.
• Account and purchase events: to stop us sending them to advertising platforms, email us and we will stop for your account.
• US state privacy laws: if you live in a state with such a law, using advertising pixels can count as “selling” or “sharing” personal information for cross-context behavioural advertising. Opting out as described above works as “Do not sell or share my personal information”.
• You can also limit ads on each platform in its own ad settings, and use your browser to block or delete cookies.
• We don’t aim ads at children under 16, and we don’t use sensitive data (such as health, religion or political views) for advertising.

What the platforms do with it

For collecting this data and sending it to a platform, we and the platform can be jointly responsible, as is the case with Meta’s pixel and Conversions API under Meta’s controller addendum; the platform is responsible for what it does afterwards. Platforms may use the data for their own purposes as well, such as improving their ad systems and preventing fraud, under their own privacy policies: Reddit, Meta, Google, TikTok, X, Snap and Microsoft. Questions about your rights with them are best sent to them directly; we will also pass on any request you send us.

6. Where your data goes

We store and process your data in the European Union. Some of our providers and the advertising platforms in section 5, such as Google, Apple, RevenueCat, Stripe, Cloudflare, Reddit and Meta, are based in or process data in the United States and other countries outside the European Economic Area. When data goes there, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or on the European Commission’s standard contractual clauses, with extra measures where needed.

7. How long we keep it

• Account and music activity: while your account exists. When you delete your account, we delete or anonymise it within 30 days.
• Trial accounts: a trial that is not turned into an account is deleted after 30 days of inactivity.
• Payment records: as long as tax and accounting law requires, which in the Netherlands is 7 years.
• Logs and diagnostic data: for a limited period, and longer where needed for security, to investigate abuse or to establish, exercise or defend a claim.
• Cookies on groof.app: as set out in section 10. An opt-out is remembered for two years.
• Advertising data: we keep the campaign and click details linked to an account as long as the account exists. What a platform receives is kept under its own policy.
• Backups: deleted data can remain in encrypted backups for up to 30 days before it is overwritten.
• De-identified and aggregated data: kept without limit.

We may keep data longer where the law requires it or where we need it to handle a dispute or claim.

8. Security

We protect your data with encryption in transit, access controls on our systems, encrypted backups and sign-in handled by Firebase, so we never hold a password of yours. No system is completely secure, and we can’t guarantee that your data will never be accessed without authorisation. If we learn of a breach that is likely to affect you, we will tell you and the authority as the law requires.

9. Your rights

Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format, and you can withdraw consent at any time. You can always object to the use of your data for advertising, and we will then stop. You can delete your account in the app, or email groof@rekord.cloud. We may ask you to confirm your identity first. We answer within a month, or tell you if we need up to two more months for a complex request. If you think we have handled your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.

10. Cookies, local storage and this website

• Necessary: what groof.app needs to work and stay safe, such as Cloudflare’s processing of your IP address to deliver the site and block abuse, and our own groof_tracking cookie that remembers an opt-out.
• Analytics: counting visits and seeing how the site is used, with PostHog (the cookie ph_…_posthog and the same data in local storage, plus groof-first-touch in local storage: how you first arrived, sent with a download) and, if we add it, Google Analytics (cookies such as _ga).
• Advertising: the pixels and tags in section 5, for example Reddit (_rdt_uuid), Meta (_fbp, _fbc), Google Ads (_gcl_au) and TikTok (_ttp).

Analytics and advertising cookies load when you visit and last from the end of your visit up to two years, as each platform sets them. You can opt out at any time through Cookie settings at the bottom of every page (section 5). The app keeps your settings, sign-in session and some cached data on your device in local storage, which you can clear by signing out or uninstalling the app.

11. Children

Groof is not meant for children under 16, and we don’t knowingly collect their data. If you think a child under 16 has given us data, email us and we will delete it.

12. Changes

We may update this policy. If a change matters, we will tell you in the app, by email or on groof.app before it applies. The date at the top shows the latest version.

13. Contact

Rekordcloud B.V., Brandijzerhoek 55, Enschede, the Netherlands. Chamber of Commerce 85684759, VAT NL863706873B01. Email groof@rekord.cloud.