Privacy Policy

Hectic Music is operated by Hectic Software Ltd, United Kingdom, which is the data controller for personal data processed through the Service. Our registered details are available on request via privacy@hecticmusic.co.uk. We have not appointed a Data Protection Officer; privacy queries go to that mailbox.

• Account data: username, email address, a hashed password (if you register with a password), optional name, avatar and bio, account type. If you sign in with Google or Sign in with Apple we receive the identifier and verified email address that provider shares with us; we never see your Google or Apple password.
• Content you create: videos and images you upload, titles, descriptions, playlists, comments, likes, subscriptions and live-chat messages.
• Activity data: watch history and resume positions, search activity, and interaction events (such as views and watch time) used to power recommendations and creator statistics.
• Payments: where memberships or payouts are offered they are handled by Stripe. We receive limited transaction metadata, not full card numbers.
• Device and technical data: IP address, browser/device type, request logs for security and abuse prevention, and, if you enable push notifications in our mobile app, a device token used to deliver them.
• Cookies and local storage: see our Cookie Policy. Analytics cookies are set only if you accept them.
• Reports and appeals: the content of reports, appeals and correspondence with us, and the moderation decisions that result.

• Contract: creating and running your account, hosting and delivering your content, processing memberships.
• Legitimate interests: keeping the Service secure, preventing fraud and abuse, moderating content, personalised recommendations and creator statistics, and improving reliability. We balance these against your rights and you can object (see section 9).
• Consent: analytics cookies (Google Analytics) and push notifications. You can withdraw consent at any time.
• Legal obligation: responding to lawful requests, meeting our duties under the Online Safety Act 2023, and keeping records required by law.

We do not sell personal data, and we do not make decisions with legal or similarly significant effects about you using solely automated means. Recommendations rank content using your activity but do not restrict your legal rights.

We share personal data only with service providers acting on our instructions, and where required by law. The providers we use are:

• Vercel (website hosting).
• Render (API hosting).
• Neon (PostgreSQL database, EU region).
• Cloudflare R2 (storage and delivery of uploaded media).
• Google (Google sign-in; Google Analytics only if you consent).
• Apple (Sign in with Apple, where you choose it; Apple Push Notification service for app notifications you turn on).
• Oracle Cloud (our live-streaming server, UK South: receives broadcasts and serves live video to viewers, so it handles broadcasters’ and viewers’ IP addresses).
• Ask Hectic AI providers (Groq, OpenRouter, Cloudflare Workers AI and Google Gemini): on the website, questions you type into Ask Hectic are sent to our server and may be passed to one of them; in the apps, only questions Apple Intelligence on your device can’t answer, and only if you allow online answers (Settings). Only the question is sent, never your account details.
• Stripe (payments, where used).

Your username, avatar, public content and comments are visible to other users and the public. Embedded third-party content (for example YouTube) is delivered by those providers under their own privacy policies. We may disclose data to the police, Ofcom, the ICO or other authorities where the law requires or permits, including to protect children.

Some providers above process data outside the UK, including in the United States. Where that happens we rely on a UK adequacy decision (for example the UK–US data bridge for certified providers) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with supplementary measures where appropriate. Our database is hosted in the EU, which the UK recognises as adequate. Contact privacy@hecticmusic.co.uk for details of the safeguards for a specific provider.

• Account data: while your account is active; removed or anonymised when you delete it, except where we must keep minimal data for legal reasons.
• Comments: while the content exists; on account deletion your comment text is replaced with “[deleted]”.
• Raw analytics events: about 13 months, then deleted or archived; aggregated daily statistics are kept for around 2–3 years.
• Moderation records, audit logs, reports and appeals: at least 1 year (reports and appeals from closure), to enforce our rules, handle appeals and cooperate with regulators.
• Legal requests and records subject to a legal hold: as the law requires, typically up to 7 years for litigation-related records.
• Server access and error logs: around 90 days.

These are our target schedules; some are enforced by scheduled jobs and some are applied manually. Backups age out on their normal cycle.

You can delete your account yourself at any time under Settings → Delete account. Deleting your account signs you out and removes or anonymises your personal data as described in section 6. Data we are legally required to keep (for example moderation and audit records) is retained in minimal form. You can also ask us to erase your data by emailing privacy@hecticmusic.co.uk.

We use encryption in transit, hashed passwords, access controls, rate limiting and session revocation. No system is perfectly secure. If a breach is likely to risk your rights we will tell you and the ICO as the law requires.

Under UK GDPR you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To use a right email privacy@hecticmusic.co.uk; we may need to verify your identity and will respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to resolve it first.

Hectic Music is not for children under 13. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has an account, email support@hecticmusic.co.uk and we will remove it. If you are 13–17, please read this policy with a parent or guardian.

We will post any changes here with a new date and, for material changes, tell you in the Service or by email. Questions: privacy@hecticmusic.co.uk. See also our Terms and Contact page.