Privacy policy

Effective date: 12 October 2026

Who is responsible

Songflash is made by an individual developer based in Norway, who is the data controller: Jon Martin Stuberg, [email protected].

What Songflash stores

You can play without signing up. For friends, invites and the scoreboards, the app creates an account for you on first launch. On our server it stores:

• a random account id,
• the name and username you choose, and when the account was made and last changed,
• your friends and friend requests, and when they were sent and accepted,
• your scores (see below),
• players you have blocked, and reports you send about other players (who, the reason you picked, any note sent with it, and when),
• for each device you use: a session key, when the session was made and when it runs out, and, for the first 30 days, its IP address and device type (the app version and iOS version your phone sends). These are used for security and to stop people creating accounts in bulk,
• for 24 hours, a count of new accounts made from each IP address, for the same reason,
• a server log: one line per request with the time, the address asked for (which can include a username, as in an invite link), the result and how long it took, and a line for each report with the account ids, name and username involved. The log doesn't include IP addresses. It is used to find faults and to handle reports.

The key to your account is kept in iCloud Keychain on your phone, so it moves with your Apple ID. We don't ask for your email address, phone number, location or contacts. (The account system needs an email field, so it is filled with a made-up address that is never used.)

Your scores

To run the scoreboards, streaks and song stats, the app sends this about your games:

• Daily challenge: for each day you play, which clip length you guessed each of the five songs at (or that you missed it), your points and when you sent the result. Your daily streak is worked out from the days you played. This is stored with your account.
• Free play: your points and how many songs you played, added up per day. This is stored with your account, for the weekly friends board.
• How each song went: with free play and your first daily result each day, the app also sends which song you heard and the clip length you guessed it at (or that you missed). These are only added to a count per song and clip length, used to show how a song usually goes. The counts don't say who guessed, and the songs you played are not stored with your account.

Stays on your phone and is never sent: your settings, level and mode, which songs you have heard, your totals and best runs per level, your unlocked speeds, a daily you haven't finished, and the daily reminder if you turn it on (it is a notification your phone schedules itself, so we have no push token or device address).

Who sees what

• Everyone who plays: your daily points are counted, without your name, in how many players scored what that day. Other players see only those counts and their own rank among everyone, never who you are.
• Anyone with your username: can look you up in the app and see your name, and send you a friend request. Your invite page (songflash.app/u/your-username) shows your name and username to anyone who opens it, without the app.
• Your friends: also see your daily results, weekly points (free play and dailies) and daily streak.

Nobody else sees your friends list, blocks or reports. Nobody is told that you blocked or reported them. Reports are read only by us, to deal with offensive names and cheating.

Why we may use it

• Your account, name, username, friends and scores: to provide the game you asked for, including the boards (contract, GDPR article 6(1)(b)).
• Session IP address, device type and the account-creation count: our legitimate interest in keeping the service secure and stopping accounts being created in bulk (article 6(1)(f)).
• Blocks and reports: our legitimate interest in keeping the game free of abuse, and the App Store's rules for apps where players can see each other (article 6(1)(f)).
• Counts per song and clip length: they don't say who guessed. Counting them is our legitimate interest in showing how a song usually goes (article 6(1)(f)).
• Backups: our legitimate interest in not losing everyone's accounts and scores (article 6(1)(f)).
• The server log: our legitimate interest in keeping the service running and dealing with reports (article 6(1)(f)).

How long it is kept

• IP address and device type: 30 days after the session on that device was made.
• The count of new accounts per IP address: 24 hours.
• Sessions: until they run out, a year after you last opened the app on that device.
• An account that never got a username or a friend is deleted, with its scores, once all its sessions have run out and it hasn't been changed for 180 days. In practice that is about a year after the app was last opened.
• Reports: a year after they are sent.
• The server log: it is capped at 30 MB, so the oldest lines are deleted as new ones come in, and it is usually deleted sooner, when a new version of the server is put in place. It has no fixed number of days: with little traffic, lines can stay until the next update.
• Everything else: until you delete your account.
• Backups of the database: at most 30 days, so data you delete is gone from them too within that time.

What Songflash doesn't do

No ads, no tracking across apps or websites, and nothing is sold or shared for marketing. There are no analytics or crash-reporting services in the app: the only things counted are your scores and the per-song counts described above, and they are used for the game itself.

Other services

• Apple: song clips and cover art are Apple Music previews, downloaded by your phone straight from Apple, and each song links to Apple Music. Apple sees your IP address when your phone fetches a clip, under Apple's own privacy policy.
• Song list: which songs are in the game, and how popular they are, comes from Deezer's public charts. Our server fetches it; your phone doesn't contact them and nothing about you is sent.
• Hosting: our server and database run at Hetzner in the EU, and are reached through Cloudflare, which passes your requests on to us. Database backups are stored with Cloudflare R2 in the EU. Both act only on our behalf, so your data is processed in the EU/EEA.

Your choices

Others can find you only by your exact username. You can change your name and username, see and undo your blocks, and delete your account, under Profile in the app. Deleting removes your account, name, username, friends, blocks, reports you sent and scores from our server straight away, and from the backups within 30 days. The per-song counts above don't say who guessed, so they stay.

Children

Songflash is rated 13+ on the App Store and isn't made for children under 13. The app doesn't ask for anyone's age, and we don't knowingly keep data about children under 13. In Norway, 13 is also the age from which you can agree to online services like this one yourself. If you are a parent and your child under 13 has used Songflash, you can delete the account under Profile in the app, or contact us (below) with the username and we will delete it.

Your rights

You can ask for a copy of your data, have it corrected or deleted, get it in a portable format, and object to how we use it. Name and username you can correct yourself, and you can delete your account yourself, under Profile in the app. For anything else, contact us (below) and say your username; we answer within a month. You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

Changes

When this policy changes, the new version is posted here with a new effective date.

Contact

Questions about your data, or to use your rights: Jon Martin Stuberg, [email protected].

Help with the app: support.