Privacy Policy

TRACK RECORD™

Last updated: September 2026

This Privacy Policy explains how Track Record ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Track Record platform, including our website, applications, and related services (together, the "Service").

We are committed to protecting your privacy and handling your personal data transparently and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

In this policy we describe our personal data processing activities for data subjects whose data we are controllers of, namely, individuals users of our Service. From time to time, we may develop new or offer additional services or features. Unless stated otherwise when we introduce these new or additional services, they will be subject to this Policy.

If you have any questions about this Policy or how we handle your data, please contact us at track-record@outlook.com.

Who we are

Track Record is a space to create, share, and archive modern mixtapes. It allows users to sequence music and weave in personal artifacts, including voice notes, written notes, photographs and videos, transforming scattered tracks into deeply contextual audio collections.

For the purposes of data protection law, Track Record is the "data controller" responsible for your personal data.

Data controller contact details:

Entity: Track Record
Email: track-record@outlook.com

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure — You have the right to ask us to delete your personal information.
Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
Your right to object to processing — You have the right to object to the processing of your personal data.
Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us at track-record@outlook.com.

You can request to access, remove or update the personal data that you have provided to us in your application by contacting us.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). We may decline requests to exercise these rights where we are unable to authenticate you as the person to whom the data relates. We will not discriminate against you for exercising any of your rights.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

If your request is denied you may have the right to appeal the denial in accordance with the instructions provided to you when the denial was made.

The personal data we collect

We collect and process the following categories of personal data:

Account information. When you create an account, we collect your name or username, email address, and password (stored in encrypted form). You may optionally provide a profile image.
Voice recordings. A core feature of the Service is the ability to record voice notes introducing music tracks. When you record a voice note, we collect and store the audio recording, which is your personal data and may contain your voice, opinions, personal memories, and references to other people.
Written notes. A core feature of the Service is the ability to record written notes introducing music tracks. When you record a written note, we collect and store the text, which may contain your opinions, personal memories, and references to other people.
Photographs. A core feature of the Service is the ability to upload photographs relevant to the music tracks. When you upload a photograph, we collect and store the image, which may contain images of you or other people.
Videos. A core feature of the Service is the ability to upload videos introducing music tracks. When you upload a video, we collect and store it, which may contain images of you or other people.
Collaboration and subscription data. We collect information about your interactions with other users, including who you invite to or collaborate with on mixtapes, the profiles you subscribe to, and the subscribers to your own profile.
Usage data. We automatically collect information about how you use the Service, including pages visited, features used, playback activity, the date and time of your visits, and actions you take.
Technical data. We collect technical information including your IP address, browser type and version, device information, operating system, and similar identifiers.
Communications. If you contact us or submit feedback through the Service, we collect the content of those communications and any information you choose to provide.

Special category and sensitive data

Voice recordings, written notes, videos and photographs may, in some circumstances, reveal information that could be considered sensitive — for example, if you choose to record your health, beliefs, relationships, or other personal matters in a voice note. We do not seek to collect special category data, and we ask that you are mindful of what you choose to record. Where voice recordings contain such information, we process it only on the basis of your explicit consent, which you provide by choosing to create and save the recording, and you may withdraw that consent by deleting the recording or your account.

You should not record or upload special category data about other people without their consent.

How and why we use your personal data

Our lawful bases for collecting or using personal information to provide services and goods are:

Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. We use your email address to send you service-related notifications, such as reminders that it is your turn in a mixtape.
Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object. We process your account information, content, voice recordings, photographs, videos and written notes to operate the Service, create and store your tiles and mixtapes, enable playback, and deliver the features you use.
Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We use your email address to send you service-related notifications, such as reminders that it is your turn in a mixtape. Where you have opted in, we may send these by email. We use communications and feedback data to respond to your enquiries and act on feedback.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object. We process collaboration and subscription data to let you invite others, build mixtapes together, contribute to public mixtapes, and subscribe to profiles.
Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We use usage and technical data to understand how the Service is used, diagnose problems, ensure security, and improve features. Our legitimate interest is in operating and improving a reliable, secure Service, balanced against your rights.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Public and shared content

Track Record is designed around sharing music in its context. You control the visibility of your content. Each context element on the back — note, voice, photo, video — has its own visibility chip: anything set to "Public" may be heard, read, and accessed by anyone with the link to that page. Anything set to "Mixtape" may be heard, read, and accessed by other participants in that mixtape, its organiser and its recipient. Anything set to "Recipient" can only be heard, read, and accessed by you and the recipient of the mixtape (and not the organiser or participants in the mixtape). Anything set to "Only You" can only be heard, read, and accessed by you.

Please consider carefully what you include in content you make public, particularly in voice recordings, written notes, photographs and videos as this content may be widely accessible and may reference other people. Once content is shared publicly, we may be unable to fully retrieve or remove copies that others have accessed.

Information about other people

If your voice recordings, written notes, photographs and videos or other content mention or contain information about other people, you are responsible for ensuring you have the right to share that information. We ask that you respect the privacy of others and do not share personal or sensitive information about identifiable individuals without their consent.

Who we share your data with

We do not sell your personal data. We share it only in the following circumstances:

Service providers (data processors). We may share your information with our agents and service providers that perform certain functions or services on our behalf, such as to host our Platform, manage databases, and facilitate communications for us.
YouTube and other music services — Track Record uses YouTube API Services to find and play tracks. See the "YouTube API Services" section below for what that means for your data, and for a link to the Google Privacy Policy. When you play a track, your browser interacts with YouTube's player, which may collect data about your use of it under Google's policies.
To comply with legal requirements. We will share your personal data when we in good faith believe it is necessary for us to do so in order to comply with a legal obligation under applicable law, or respond to a valid legal process, such as a search warrant, a court order, or a subpoena. We also will also share your personal data where we in good faith believe that it is necessary for the purpose of our own, or a third party's legitimate interest relating to national security, law enforcement, litigation, criminal investigation, protecting the safety of any person, or to prevent death or imminent bodily harm, provided that we deem that such interest is not overridden by your interests or fundamental rights and freedoms requiring the protection of your personal data.
Other parties with your consent. We may share information about you with third parties when you consent to such sharing.
Other users. Content you make public or share is accessible to other users.
Business transfers. If we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

YouTube API Services

Track Record uses YouTube API Services to let you find tracks and to play them. When you search for a track or paste a YouTube link, we ask YouTube's API for public information about the video — its title, the channel name, a thumbnail image and its duration — and the track then plays through YouTube's official embedded player. By using Track Record, you are also agreeing to the YouTube Terms of Service.

What we do — and don't — access. We only request publicly available video information, using an ordinary API key — we never ask YouTube for any permission over your account. If you choose to sign in to Track Record with Google, that is used solely to confirm who you are; it gives us no access to your YouTube data. We never access your watch history, subscriptions, playlists or any other private YouTube data, and we do not collect viewing statistics (view counts, likes, comments or similar) about any video.

What we keep, and for how long. We keep the YouTube video ID with your tile or answer, so we know which track you chose; video IDs are kept for as long as that content exists. When you choose a track, the title and channel name YouTube suggests are copied into your tile or answer as its label — on your own tiles you can edit them, and they are kept as part of your content for as long as that content exists. Everything else we fetch from the API is held only in a lookup cache (title, channel name, thumbnail address, duration) that is refreshed or deleted within 30 days. We never store viewing statistics of any kind, for any length of time. Thumbnails are loaded from YouTube's own servers — for link-preview cards we pass the image through our own domain so the preview renders, but we keep no copy of it — and playback always uses YouTube's official embedded player. We never download or store video or audio.

Google's privacy policy. Because this information comes from YouTube, a Google service, Google's handling of data is governed by the Google Privacy Policy. We encourage you to read it. YouTube's embedded player and thumbnails are served by Google, which may collect data about your use of them under that policy (for example, via cookies) — see also the "Cookies" section below.

Your Google account settings. Track Record holds no YouTube permissions, so there is no YouTube access to revoke. If you signed in with Google, you can review or remove Track Record's sign-in connection at any time from the Google security settings page.

Cookies and similar technologies

We use cookies and similar technologies to operate the Service, remember your preferences, keep you logged in, and understand how the Service is used. Some cookies are strictly necessary for the Service to function; others are used for analytics or preferences and are used only where permitted.

You can control non-essential cookies through the cookie settings presented to you and through your browser settings. Disabling certain cookies may affect how the Service works.

Data security

We are committed to protecting the personal data in our systems. We implement appropriate technical and organizational measures to help protect the security of personal data; however, please note that no system is ever completely secure. We have implemented various policies including pseudonymisation, encryption, access, and retention policies to guard against unauthorised access and unnecessary retention of personal data in our systems.

If you have an account with us, you are responsible for maintaining the confidentiality of your account password and for any access to or use of your account using your password, whether or not authorised by you. Please notify us immediately of any unauthorised use of your password or account or any other breach of security.

How long we keep your data

We keep your personal data for as long as your account is active or as needed to provide the Service, including making data-driven business decisions about new features and offerings, complying with our legal obligations and resolving disputes.

Account and content data is retained while your account exists. If you delete specific content (such as a voice recording, written note, photograph or video), we delete it from active systems, though residual copies may persist in backups for a limited period before being overwritten. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Public content that you have shared and that others have incorporated into or relied upon (for example, a voice note accepted into another user's mixtape) may persist after you delete your account, in a manner that is dissociated from your account where reasonably possible.

When determining the retention period, we take into account various criteria, such as the type of information, the nature and length of our relationship with you, the impact on such a relationship if data is deleted, mandatory retention periods provided by law or statute of limitations.

How we protect your data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or alteration. These include encryption of passwords, access controls, and secure hosting. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International transfers

Because of the global nature of our business, we may shares personal data internationally with subcontractors and partners when carrying out the activities described in this Policy. They may process your data in countries whose data protection laws are not considered to be as strong as UK laws or the laws which apply where you live. For example, they may not give you the same rights over your data. Whenever we transfer personal data internationally, we use tools to make sure the data transfer complies with applicable law and help to give your data the same level of protection as it has in the UK and the laws which apply where you live.

Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk, or with your local data protection authority.

Children and young people

The Service is not directed at children under 16, and we do not knowingly collect personal data from children under that age without appropriate consent. Because the Service involves recording and sharing voice, videos, photographs and personal content, we take the protection of young people seriously.

If you are under the age of 16, please do not use the Service or provide any personal data unless permitted and with the consent of a parent or guardian as required by law.

If we become aware that we have collected personal data from a child in a manner inconsistent with applicable law, we will take steps to delete it. If you believe we may hold data about a child, please contact us at track-record@outlook.com.

Changes to this Policy

We may change this Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in case of material changes, we will provide you with additional notice (such as adding a statement to our homepage or sending you a notification). We encourage you to review the Policy whenever you access the Platform or otherwise interact with us to stay informed about our information practices and the choices available to you. The "Last updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Third-party links and services

The Service contains links to and integrations with third-party music services and other websites. We are not responsible for the privacy practices of those services. We encourage you to review their privacy policies before using them.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: track-record@outlook.com