Mindnull
EN TR
Soundlith

Privacy Policy

EFFECTIVE DATE: 21 JULY 2026
LAST UPDATED: 11 OCTOBER 2026

1. Introduction

Soundlith is built on a single principle: your music never leaves your device.

This Privacy Policy explains what information is and is not processed when you use the Soundlith mobile application (the "App"), the limited role of the providers we rely on, and the rights available to you. It has been prepared to comply with the European Union General Data Protection Regulation (GDPR), the UK GDPR, Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the California Consumer Privacy Act (CCPA/CPRA), and the applicable Apple App Store and Google Play requirements. The App is developed and published by Berkay Atik (the "Developer", "we").

2. Our Privacy Model in Brief

Soundlith is an on-device audio player and effects processor. You can use it without registering, and there is never a password. A profile is optional; creating one needs Sign in with Apple or Google (see 4.6). Every track you import, every effect you apply and every file you export is processed locally on your device and is never uploaded to us. To operate the App we rely on a small number of external providers, each described below:

We operate no servers of our own. We never receive your music, your files or your telephone number. If you create a profile, the name and e-mail address Apple or Google provide are held in Firebase Authentication, and the display name you choose appears on your profile.

3. Information Stored Only on Your Device

The following is created locally on your device and is never uploaded to us or to any third party:

Uninstalling the App deletes this local data from your device; your original files in linked folders and in your device's music library remain as they are.

4. The Limited Data Collected by Our Providers

We operate no server or database of our own and use no analytics or tracking software development kit (SDK) of our own. The data that leaves your device consists of the limited information the following providers require in order to run the App, the requests your device sends directly to Audius when you use Discover (see 4.4) and, if you create a profile, the profile and friends data described in 4.6.

4.1 Anonymous identifier (Firebase Authentication)

On first launch the App signs in anonymously through Google Firebase Authentication. Firebase assigns your installation a random, app-specific identifier (a "UID") — a string that stays the same across restarts and updates so that the App recognises your installation consistently. Unless you create a profile, you are never asked to create an account or choose a username; there is never a password. If you create a profile, this identifier is linked to your Apple or Google account (see 4.6.1). The identifier itself is not your name, e-mail address, telephone number or any real-world identity. We use it solely to operate the App — for example to keep your purchases and settings tied to your installation and to help prevent abuse. It is stored by Google Firebase, is not linked to advertising, and is not used to track you across other apps or websites.

4.2 Purchases and entitlements (RevenueCat)

When you buy a subscription or the one-time "Remove Ads" purchase, Apple or Google process the payment and we never see or store your card or billing details. To validate the purchase and keep your entitlement (Premium / ads removed) in sync, our provider RevenueCat receives the store's transaction and receipt information, an app-specific user identifier, and basic device and country information. RevenueCat acts as a processor on our instructions and does not sell this data. Your entitlement is additionally cached locally on your device.

4.3 Support messages (Google Cloud Firestore)

When you send us a message from Settings → Support & feedback inside the App — and only when you do so — the following is written to our support database on Google Cloud Firestore:

Data Why
The text of the message you wrote So that we can read and answer it
The anonymous identifier described in 4.1 To enforce the daily sending limit and to match later messages from the same installation
App version To know which version you are describing
Interface language So that we can reply in your language
Platform (e.g. "ios") To reproduce the issue on the correct device type

You write the content of the message; what you put in it is entirely under your control. Your name, e-mail address, telephone number, contacts, location, or any information about your music is not attached. Sending a message is optional and is not a precondition for any feature of the App.

When you report a track in Discover, the support screen opens pre-filled with that track's title, artist and Audius link, and the track is hidden on your device. You can edit the text before sending it or not send it at all; if you send it, the message is processed as described in this section.

To prevent abuse, sending is limited to two messages per day per installation; this limit relies on the anonymous identifier described in 4.1.

4.4 Discover (Audius)

Discover is optional and works only when you open it. When you use Discover, your device connects directly — without passing through our systems — to the Audius API operated by Tiki Labs, Inc. ("Audius", United States) and to content servers in the Audius network that deliver tracks and cover images. According to Audius's privacy policy, the infrastructure providers that operate these servers are independent of Audius.

Data sent When
Your IP address and standard technical connection data With every Discover request: the featured list, searches, cover images and track streams
The App's name and version ("Soundlith/…") With requests to the Audius API
The text you type in the search box When you search
The identifier of the track you play and of the cover images displayed When you play a track and when a list is displayed

Your anonymous identifier (see 4.1), your advertising identifier, your name and any other information that identifies you are not sent to Audius. Your searches and what you play in Discover do not reach us and are not stored by us; the App keeps no search history.

Audius and the infrastructure providers process this data as independent controllers under their own privacy policies. The Audius Privacy Policy states that Audius may automatically record data such as IP addresses, searches conducted and usage information, and that this data is processed in the United States. The API Terms that Audius applies to app developers are also provided for your information. You can exercise your rights regarding data processed by Audius against Audius at legal@audius.co. The "Open in Audius" option in the ⋯ menu and the document links open in your browser; the pages opened there are subject to Audius's own policies.

If you do not want to use Discover, simply do not open it; the rest of the App is not affected.

4.5 Discover consent record (Google Cloud Firestore)

The first time you open Discover, the App shows an information and consent screen. Discover does not open until you tick the box to confirm that you accept the Terms of Use, the Audius Terms of Use and the Open Music License. So that we can show, when necessary, which text you accepted and when, your acceptance is written to our consent records on Google Cloud Firestore:

Data Why
The anonymous identifier described in 4.1 To identify which installation the record belongs to
The version of the consent text (e.g. "3") To identify which text you accepted
The time of acceptance (device clock) and the time the record reached the server To show when the acceptance was given
App version To know in which version the consent screen was shown
Interface language To know in which language you saw the consent text
Platform (e.g. "ios") To know which type of device the record came from

Your name, e-mail address, searches or listening are not added to this record. If you have no internet connection when you accept, your acceptance is first stored on your device and sent the next time you open Discover. When the consent text changes materially, your consent is requested again and a separate record is created for the new version; earlier records are not changed.

4.6 Profile and friends (optional)

Profiles and friends are optional and are available from version 3.0.0 on iOS and on Android. If you do not create a profile, nothing in this section applies to you and nothing changes. Profile and friends data is stored in Google Cloud Firestore in the European Union ("eur3"). No audio or music file is ever uploaded.

4.6.1 Signing in

You sign in with Apple, or with Google where that option is offered. What they provide — your name and e-mail address and, with Google, the link to your account picture — is held in Firebase Authentication; with Sign in with Apple, the e-mail address may be Apple's private relay address. The name is used only to suggest a display name and a username; the picture is not used. Your e-mail address is never shown to anyone and is not written to your profile. When you create a profile, the anonymous identifier described in 4.1 is linked to your Apple or Google account. If you sign out, what you are playing now is removed from the server; your profile and the monthly summary your friends saw stay there, and your profile comes back when you sign in again with the same account.

4.6.2 Your profile (public)

Your profile contains your username, your display name, your profile sphere, your device type (iOS or Android), your settings (who can send you requests and how much of your listening you share) and when it was created and last updated. Anyone who uses the App can see it by opening your profile link or QR code; people who have a profile can also find you by searching for your username. The sphere is worked out on your device from the sounds you have listened to over the last 30 days, leaving out anything played during Private listening, and contains no track titles; it reflects your listening even when you share nothing else.

4.6.3 Friends and reactions

Friendship is mutual. Your friend and request lists can be seen only by the people involved. There is no messaging: friends can react with one of five emojis. A reaction records the emoji and the track and sound it was sent for; only the person who receives it can see it and delete it.

4.6.4 What friends see of your listening

Depending on your setting, friends can see what you are playing now — the track title, the artist where known, the sound (including a name you gave your own Mix; a name that fails the name filter is shown as "Custom Mix"), whether it is playing or paused and when — and a short summary of your month: listening time, your most-used sounds and, with "Track + sound", your three most-played tracks. With "Sound only" track titles are hidden; with "Nothing" none of this is shown. While Private listening is on, nothing you play is shown to anyone — not in what you are playing now, your monthly summary or your sphere. Your status is updated while you play, including in the background. People you have blocked cannot see any of this.

4.6.5 Shared playlists

You can share a playlist with "Friends" or "Anyone with link". Only text is uploaded — the playlist name and, for each track, its title (for your own files, the file name), artist and sound — never an audio file. A playlist link contains your user ID. When you stop sharing a playlist or delete it, it is deleted from the server; if you are offline or signed out at that moment, this happens as soon as you are back online and signed in.

4.6.6 Listening card and QR code

The listening card and the QR code are created on your device. They go to the app or person you choose and do not reach us.

4.6.7 Blocking

Someone you block cannot send you requests, react to you or see what you listen to, and any friendship between you ends. While they are signed in, their app also hides you from search and does not open your profile or the playlists you share by link. To make this work, a small record holding only the time of the block is kept where their app can read it; it is deleted when you unblock them.

4.6.8 Reports

You can report a profile or a shared playlist by choosing a reason. Only we see reports, and the person you report is not told who reported them. Each report records the date by which it must be deleted; we review reports and delete them within 7 days at the latest. Display names, usernames and the names of shared playlists that contain inappropriate words are rejected automatically.

4.6.9 Deleting your account

Go to Profile › Settings › Account › Delete account; you confirm with Apple or Google first. This deletes your profile, username, friendships, requests, the reactions you received, your block list, your listening information and your shared playlists, together with your Firebase Authentication account, and Soundlith asks Apple or Google to revoke its access. What remains: reactions you sent, until the person who received them deletes them; reports, until they are deleted as described in 4.6.8; support messages, the Discover consent record and the record of your acceptance (see 4.6.10), for the periods in section 10; and the data on your device, until you uninstall the App. If you signed in but did not finish creating a profile, you can delete your sign-in in the same way.

4.6.10 Record of your acceptance

Before your profile is created, you tick a box to accept the Terms of Use and the community rules in them, confirm that you have read this Privacy Policy and declare that you are at least 13 (and, if you are under 18, that you have a parent's permission). This acceptance is recorded in the same way as the Discover consent (see 4.5): your anonymous identifier, the type of record ("profile") and the version of the text, the time you ticked the box and the time the record reached the server, the App version, the interface language and the platform. The App can only create this record; it cannot read, change or delete it.

5. Advertising and Campaign Measurement

5.1 Advertising shown inside the App (Google AdMob)

The free version of the App shows advertising served by Google AdMob. In order to serve, cap and measure these ads, Google — acting as an independent data controller — may collect and process certain information from your device, which may include a device or advertising identifier, IP address, coarse location, and limited data about your interaction with ads. This processing is governed by the Google Privacy Policy and by "How Google uses information from sites or apps that use our services".

5.2 Apple Ads attribution (AdServices)

If you installed Soundlith after tapping one of our own advertisements on the App Store, Apple provides a short-lived attribution token through the AdServices framework. We pass this token to RevenueCat, which exchanges it with Apple to obtain campaign-level information (such as the campaign, ad group and keyword that led to the installation) and stores it alongside your anonymous RevenueCat identifier.

We use this for one purpose only: to understand which of our own campaigns work and to avoid spending money on advertising that does not.

6. Payments (Apple and Google)

Subscriptions and the one-time "Remove Ads" purchase are charged and processed exclusively by Apple (App Store) or Google (Google Play). We never receive or store your payment card or billing details. Payments, renewals, refunds and billing disputes are handled by Apple or Google under their own terms. Validation and synchronisation of the resulting entitlement is performed by RevenueCat as described in section 4.2.

7. The Soundlith Website

The website on which you are reading this policy is served through Cloudflare Pages, a Cloudflare, Inc. service. Like any web server, it may automatically record standard technical request data such as IP address and browser information for security and operational purposes. This concerns the website only and is separate from the App.

Profile and playlist links open a page on this website. The page shows only the username contained in the link and loads no profile data.

8. Permissions

Soundlith requests only the access it needs in order to function:

9. Purposes of Processing and Legal Bases (GDPR)

Because the App processes your content locally, most processing happens on your device entirely under your control. In respect of the limited processing carried out through our providers:

10. Data Retention

Category Where it is held Retention
Imported audio, effects, exports Your device only Until you delete the files or uninstall the App
Library, signatures, mixes and preferences Your device only Until you uninstall the App
Linked folders, scan preferences and Discover preferences Your device only Until you uninstall the App
Listening statistics, playlists and app icon Your device only Until you uninstall the App
Discover session cache Your device only (temporary folder) For the session; the App deletes it the next time it starts
Anonymous identifier (UID) Google Firebase Until you request deletion or the anonymous user is removed
Firebase Authentication account (if you create a profile) Google Firebase Until you delete your account
Profile data and shared playlists Google Cloud Firestore (EU) Until you delete your account or remove them yourself
Listening information shared with friends Google Cloud Firestore (EU) Updated while you listen; deleted when you choose "Nothing" or delete your account
Reports Google Cloud Firestore (EU) No longer than 7 days
Support messages Google Cloud Firestore For as long as needed to answer you and to keep a record of the reported issue; in any case no longer than 24 months
Discover consent record and profile acceptance record Google Cloud Firestore From the date of acceptance, for the statutory limitation period for claims that may arise from the Terms of Use; in any case no longer than 10 years
Data sent to Audius in Discover Audius and infrastructure providers in the Audius network As stated in the Audius Privacy Policy; not stored by us
Purchase and entitlement records RevenueCat / Apple / Google As stated in their respective policies; deletable on request
Advertising data and identifiers Google (AdMob) As stated in the Google Privacy Policy
Website request logs Cloudflare Pages Standard server log retention

11. Data Security

Your audio and settings are held in the App's protected area on your device and are subject to your device's operating system security. The limited data described above is transmitted to Google Firebase, Cloud Firestore, RevenueCat, Apple or Google, and AdMob, and, when you use Discover, to Audius, over encrypted connections (HTTPS/TLS).

The security rules of the support database grant the App permission to create a message only: the App cannot read, modify or delete any message, including its own, and cannot access another user's message under any circumstances.

The same principle applies to consent records: the App can only create the consent record for its own installation; it cannot read, modify or delete any consent record. A consent record therefore cannot be changed once it has been created.

We operate no server of our own. If you do not create a profile, the records associated with your installation are limited to the anonymous identifier, the purchase records, any support messages you have sent us and, if you have used Discover, your consent record. If you create a profile, they also include your Firebase Authentication account and the profile and friends data described in 4.6, held in Google Cloud Firestore in the EU. Each is held by the providers named above on our behalf.

If a security breach affects your personal data, we will inform you and the competent authorities where the law requires it.

12. International Data Transfers

We operate from the Republic of Türkiye. Our providers — Google LLC, Cloudflare, Inc., Apple Inc. and RevenueCat, Inc. — are global companies and may process the limited data described above outside your country, including in the United States. These transfers are carried out under the European Commission's Standard Contractual Clauses (SCCs) and equivalent mechanisms offered by the relevant providers.

Support messages, Discover consent records and profile and friends data are stored in Google Cloud data centres in the European Union (the Cloud Firestore "eur3" multi-region). The sign-in providers (Apple and Google) and Firebase Authentication operate globally; these transfers are covered by the Standard Contractual Clauses. The connections your device makes directly when you use Discover reach Audius's systems in the United States and content servers in the Audius network, which may be located in various countries; this data does not pass through us and is processed by Audius under its own privacy policy (see 4.4).

13. Your Rights Under the GDPR (EU/EEA and UK)

You have the rights of access, rectification, erasure, restriction of processing, data portability, objection, not to be subject to a decision based solely on automated processing, and to lodge a complaint with a supervisory authority.

Because the data associated with you is limited to a random anonymous identifier, your purchase records, any support messages you have sent us, your consent record if you have used Discover and, if you have a profile, the data described in 4.6, most requests can be met quickly.

If you have a profile, you can correct your details and change your sharing settings in the App at any time. You can delete your account in the App (Delete account, see 4.6.9) or by writing to support@mindnullstudio.com. To access your data or receive a copy of it, write to us at the same address. Uninstalling the App deletes all local data; you can reset or limit your advertising identifier in your device settings.

To delete the anonymous identifier, the associated records and your support messages held by our providers, contact us at support@mindnullstudio.com; we will delete your Firebase anonymous user, remove your support messages, and request deletion from RevenueCat.

Because we may need to prove acceptance of the Terms of Use, we may retain your Discover consent record and profile acceptance record for as long as it is necessary for the establishment, exercise or defence of legal claims, and no longer than the period stated in section 10 (GDPR Art. 17(3)(e)); during that period we do not use the record for any other purpose. Data sent to Audius in Discover is not held by us, so requests concerning it must be sent directly to Audius (legal@audius.co).

So that we can locate your records, please send your request from the support screen inside the App where possible, or tell us the approximate date of your message; if you have a profile, tell us your username. Otherwise we hold no information identifying you other than the anonymous identifier and have no other way of establishing which record is yours. We respond to requests within 30 days at the latest.

You may exercise your rights in respect of advertising data through Google, and in respect of payment records through Apple or Google.

14. Your Rights Under the KVKK (Türkiye)

Under Law No. 6698 you have the right to learn whether your personal data is processed, to request information where it has been processed, to learn the purpose of processing and whether the data is used in accordance with that purpose, to request rectification, erasure or destruction where the data is incomplete or incorrectly processed, to object to a result arising against you solely from automated analysis, and to claim compensation for damage suffered as a result of unlawful processing. Because the only data associated with you consists of an anonymous identifier, purchase records, any support messages, your consent record if you have used Discover and, if you have a profile, the data described in 4.6, held by our providers, these requests are met in the manner described above. Under Article 7 of the KVKK, the Discover consent record and the profile acceptance record may be retained for as long as the ground for processing under Article 5(2)(e) continues, and no longer than the period stated in section 10. You may write to support@mindnullstudio.com with your requests.

15. California Privacy Rights (CCPA/CPRA)

We do not sell your personal information and we do not share it for cross-context behavioural advertising through any system of our own. Advertising is operated by Google as described in section 5; you may exercise your preferences through your device settings and Google's controls. The anonymous identifier, purchase records and support messages are used only to operate the App and to reply to you; they are not sold. When you search or play a track in Discover, your device connects directly to Audius to fulfil your request; this is not a sale or sharing of your personal information by us. The Discover consent record and the profile acceptance record are used only to prove acceptance of the Terms of Use and are not sold. Your username, display name, e-mail address and the listening information you share with friends are not sold or shared.

16. Children

Soundlith is a general audience application and is not directed to children under 13 (or the minimum age required in your country). Because the free version displays third-party advertising, we do not knowingly permit use by children under this age and do not knowingly collect their data. If you believe a child is using the App in a way that concerns you, or has sent us a support message, please contact us and we will act without delay. In line with the Audius Terms of Use, Discover is not intended for children under 13; users under 18 (or the age of majority in their country) may use Discover only with the permission of a parent or legal guardian (see Terms of Use, section 9.8). The same applies to profiles: you must be at least 13 to create one, and if you are under 18 (or the age of majority in your country) only with the permission of a parent or legal guardian.

17. Third-Party Services

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a significant change we will update the "Last Updated" date above, publish the revised policy at this address and list what changed below.

What changed in this version (11 October 2026)

What changed in the previous version (8 October 2026)

19. Contact

Developer: Berkay Atik
E-mail: support@mindnullstudio.com
Application: Soundlith