The short version: your phone listens, sends a fingerprint rather
than the sound, and keeps audio only where it will ask you to judge it.
Accounts are optional, and your audio stays on your device. If you have
friends on Catchy, a finished set goes to them unless you switch that
off — that and everything else that leaves are listed below.
What stays on your phone
Your sets, catches, timelines, and library — the names, the venues, the
artwork, the words. Stored locally. Three things derived from them leave
unless you switch them off: the capture diagnostics described below
(catalog identifiers and times, never names), usage data (what you do in
the app, as counts and times, never names), and a finished set going to
your friends, described under Friends.
Short clips (~20 seconds) for anything that still needs your ear —
the moments nothing matched, and the songs Catchy named but wasn't sure of.
They exist so you can listen back and decide during review. They live on
your device and are never uploaded anywhere.
Those clips delete themselves when you finish reviewing the set, and
after a retention window even if you never do. That window is 30 days by
default and you can set it to 7, 14, 30 or 60 in Notifications &
timing.
The one exception is a clip you tap Keep clip on. That one is
yours until you delete it.
What never exists
No recording of your set. The microphone feeds a rolling ~20-second
buffer that is continuously overwritten. The only audio written to disk is
the clips above, and the stretches still waiting to be identified when
you're offline — those go the moment they are, or with the rest when the
set's window runs out.
No password. An account is Sign in with Apple or Google — nothing to fill
in, and no email or phone number we ask you for. It is never needed to
catch, review, keep your library, or export, and never needed to open a link
someone shares with you. It backs your friend code, your friends list and
your share links so they survive a new phone — and adding a friend is the
one thing that asks for it.
No third-party analytics SDK, no advertising, no contacts.
No trail of where you go: the only time Catchy uses your location is
when you tap Pin the venue, once per set, to save where the set was.
Your exact coordinates never leave your phone. What travels is the
venue's name and an approximate location — a map cell about 150 m
across — and only where the set itself goes: with a set you share, or
to a friend you let join you. The cell is there so that friends' phones
at the same place can be joined into one shared set. Nothing else about
where you are ever leaves your phone.
What leaves your phone, and when
While capturing: your phone turns what it hears into an acoustic
fingerprint on the device and sends only that — never the audio itself —
to Apple's Shazam service, the same way the Shazam app works. It identifies
songs, not you.
Also while capturing: the lock-screen banner's updates (current
song, catch count) pass through Catchy's server on their way to Apple's
push system so the banner stays fresh. Passing through — our server logs
counts, never songs.
If you share a set as a link: a separate, deliberate act —
nothing ever creates a link on its own. Exactly what the page shows —
the tracklist, times and when you paused, and the name you gave the set —
is hosted until you revoke it. Revoking deletes it.
When someone opens a shared page: Catchy's server counts each
time the page is loaded — the day, the country, the kind of site the
link came from, and the kind of device — as totals per page, with the
link kept only as a one-way code. It never keeps the visitor's IP
address, and link previews and crawlers are counted apart. The counts
are deleted 13 months after the day they were made.
After a set ends: capture diagnostics are shared with the
developer to fix capture bugs. Sent the next time you open the app after
a set ends, again after you review it, and again if the set's numbers
change later. A small start record leaves when the microphone starts, and
once a day a device summary — Apple's crash and exit counts, your device
model and iOS version — leaves whether or not you captured anything.
Counters about the capture: when the set started and ended; windows sent,
matched and queued; each pause, why it happened and which audio route was
in use; and for each hour of the set the battery level, whether the phone
was charging, its thermal state and Low Power Mode, how long the capture
screen was open, and how much audio was waiting to be recognized. Plus
your device model, iOS and app version, and Apple's own crash and exit
counts. How the set came out, one row per song and per unknown stretch:
how confident the app was, when in the set it was heard, what you did
with it in review — kept, skipped, corrected or added by hand, and if the
app asked, why you skipped it — and the taps you made on the lock screen
or in review, to the half-minute. Never the song's name: a row carries a
catalog identifier and numbers. The set's recognition events: for every
window the app listened to, whether a song was recognized, which catalog
songs were the candidates — up to five, as catalog identifiers and
numbers, never names — the loudness and noise measures the app decided
on, and whether the phone was on Wi-Fi or cellular at the time. Never
audio, never a recording, never song titles or artist names, never the
set's name. They exist to fix problems and to improve how the app
recognizes and labels songs. The switch in Profile → Settings → Privacy & data
turns it off and deletes what was already sent, and deleting a set
deletes that set's rows too.
While you use the app: usage data. What you do in the app:
opening it, and the actions you take — starting and ending a set;
opening, finishing or leaving a review; playing a clip; searching for a
song by hand; exporting and sharing; opening a set a friend shared;
seeing the Pro offer and starting a trial or a purchase. How long those
take, whether they worked or failed and with which error, and how you
answered the microphone, notification and location prompts. Each event
carries its time, a number for the app session it happened in and, when
it is about a set, that set's identifier. Each batch carries the app
build, your device model and iOS version, the recognition-settings
label, and whether your
"Share finished sets with friends"
and
"Share capture diagnostics"
switches are on. The local hour a set started and a review opened is
sent too, with the local date and the weekday the set started. Never
audio, never song or artist names or catalog identifiers, never a set's
or a venue's name or anything else you typed, never where you are, never
your contacts or who your friends are (an invite is counted, never who
it went to). It goes to Catchy's own server and nowhere else, to find
and fix problems and to understand which parts of the app people use.
Its own switch,
Share usage data
in Profile → Settings → Privacy & data, is on to begin with; turning it off
stops it and deletes what was already sent, and deleting a set deletes
that set's rows too.
With no signal, or if recognition fails: that stretch of audio
waits on your phone until there is a connection to identify it, and is
deleted the moment it is.
If you export to Spotify: the set's name and its song names, sent
to your own connected Spotify account. The playlist is created in
your library and is public, so the listen link on your share page
works for everyone; you can make it private in Spotify, but exporting that
set again turns it public once more. Nothing else is sent. Without an
account connected, exporting asks you to connect one first — nothing is
created on any account of ours.
If you open a song in Spotify without your own account connected:
the phone asks Catchy's server for a short-lived Spotify key — a random
identifier for this installation goes with that ask, and nothing else —
then looks the song up with Spotify directly, so the link opens the track
instead of a search page. That identifier is tied to nothing about you, we
cannot connect it to a person, and it resets if you reinstall the app.
If you export to Apple Music: the playlist is created in your own
library, with your permission, on your device.
When a song's card opens, Catchy asks our server about that artist
so the answer is ready if you tap
✦ Insights. The
song's title and the artist's name go with that question, and nothing
about you, your account, or your set goes with it. The server looks the
artist up in public sources (MusicBrainz, Wikipedia, Discogs, Apple's
catalog) and the piece it writes is the same one everyone else who asks
about that artist reads.
Song titles are looked up against Apple's public catalog for artwork and
previews.
Friends and your profile — what your friends see
When a set ends it goes to your friends on its own: the
tracklist, the times and when you paused, and what you called the set, in
their Friends tab.
That is a switch in the app, on to begin with; the first time it happens
Catchy stops and asks, and you can stop sharing any single set from its
own menu. With no account, or with no friends, there is nobody for this to
reach and nothing is sent.
Adding a friend just links two random IDs on the server — no
names, no contact info, nothing readable. The nicknames you give friends
are typed on your phone and stay on it.
If you claim a @username, the server holds it — it's how friends
find you. Same for the display name if you add one. You
are findable by search unless you turn that off in the app; either way,
someone finding you only ever sends a request you approve. Your @username,
and your display name if you add one, are the names we hold — and your
Instagram handle if you choose to add that too.
Your profile carries counters (sets, songs, hours, favourites),
the disc you chose, and your Instagram handle if you added one — visible
to friends unless you switch your stats off, which also deletes what was
published. The Top sets you pin ride the profile too — they are
sets you already chose to share, so their pages are hosted the same way.
The audio and the full record of each set stay on your phone.
A set shared with friends — whether it went on its own or you
shared it yourself — puts exactly what the shared page shows (the
tracklist, times and when you paused, and the set's name) in their app
until you unshare it.
Your profile shows friends only the name, venue, and date of the sets that
are shared.
Adding friends to a set sends each one an invitation, as IDs only;
accepting places that set in their app. Declining leaves no trace.
Reactions and song IDs on a shared set live on the server while it
is shared: a tap, or the title and artist a friend typed. Anyone who can
open a shared set sees who reacted to it — names, never counts — and your
@username can appear there to people who follow the same set without
being your friend. Reactions disappear with the set when it is
unshared.
If you allow notifications, this phone's push address is stored so
a set you follow can reach you. Storing it does not send you anything:
only following a set makes you a recipient. A push names the friend who
acted and the set it is about — for example, “@nacho shared Sunset Set”. A
push about a comment also carries the start of that comment — up to about
180 characters, passed through Apple's push service — and goes only to the
people that comment notifies: the set's owner, the friends who commented
on it before, and the friends it tags. A push never carries a song title. The one push about a set you follow
changing names nothing at all. Turning off notifications for Catchy in iOS
Settings stops the pushes. The stored address is removed when you sign out
or delete your account.
Letting friends see you are out is off unless you turn it on for
that set. They see only that — no venue, no place — and it disappears when
the set ends. If a friend asks to join you and you accept, the set's venue
name — whether you typed it or pinned it — goes to that one friend alone
and dies with the set too.
How long the server keeps things
Capture diagnostics, the per-window recognition events and usage data are
deleted 13 months after they were last sent — a review months later sends
the set again and restarts its clock. Before that, they are added into
running totals — counts, rates and averages per day and per app version —
that carry nothing identifying you or a set, and no total is kept for a
group small enough to point at one person. A shared page is deleted 400 days after the last
time you touch it, and every change you make to it restarts that clock. Our
request logs are deleted after 30 days and our function logs after 14;
neither holds your music. Your sign-in token expires after 90 days.
Switching a thing off, unsharing a set, or deleting a set deletes what it
produced without waiting for any of these.
Deleting your account
Profile → Settings →
Delete account
→
Delete
my data from Catchy's server removes your account, your @username,
your profile, your friend connections, your shared pages, your
diagnostics and your usage data. It happens in this order: the app clears what it holds about
the server, the server locks the account so nothing can write under it
again, then it deletes every row, and your account record last. If a step
fails, a sweep finishes the deletion on its own within the hour. Two things
survive: the sets, catches and audio on your phone, which are yours and are
never touched, and a small record that this account was deleted, which stops
an old sign-in from reviving it and expires after 100 days.
Changes
If what the app does with your data changes, this page changes with it.
It is kept in the same repository as the app and reviewed against the
code.