Privacy Policy
What we know about you, why we need it and how long we keep it. No ads, no tracking, no selling data.
Effective from {{DOPLNIT: datum účinnosti}}
This is a translation. The Czech version of this document is the binding one; in case of any discrepancy, the Czech wording prevails.
The data controller is {{DOPLNIT: obchodní jméno}}, Company ID (IČO) {{DOPLNIT: IČO}}, registered office at {{DOPLNIT: sídlo}}. For anything about personal data write to {{DOPLNIT: e-mail pro osobní údaje}}.
The short version: Meditee has no ads, contains no tracking SDK and no third-party analytics, uses no advertising identifiers, and never sells or shares your data for marketing. We process only what the app needs to work.
1. What we process and why
| What | Specifically | Why | Legal basis | How long |
|---|---|---|---|---|
| Account | E-mail, name, language, password hash (bcrypt) | So you can sign in and find your library | Performance of the contract | While the account exists |
| Sign-in with Google or Apple | The provider's name and its permanent ID of your account, the e-mail address the provider gives us | So you can sign in without a password | Performance of the contract | While the account exists |
| Signed-in devices | A hash of the sign-in token (SHA-256), the browser or app label, time created and last used | To keep you signed in and let you sign other devices out | Performance of the contract | At most 90 days from the token's creation |
| Your library | Liked tracks and playlists, saved articles, followed artists, your own playlists | So there is somewhere to keep what you like | Performance of the contract | While the account exists |
| Listening | Listening history including where you stopped, and the daily total of seconds listened | So you can continue and see your weekly overview | Performance of the contract | While the account exists |
| Settings and the opening questionnaire | Goals, how much time a day you want, reminder time, language, appearance | So the app recommends music and behaves the way you want | Performance of the contract | While the account exists |
| Messages to support | E-mail, topic and the text of the message | So we can reply and trace the problem | Performance of the contract and our legitimate interest in an overview of bugs | 3 years; anonymised once the account is deleted |
| Creator application | See section 3 below | To assess the application and pay out royalties | Performance of the contract and legal obligations | See section 3 |
| Abuse protection | Counters of sign-in, sign-up and message attempts; the counter key contains an IP address or an e-mail address | So passwords cannot be guessed and support cannot be flooded | Our legitimate interest in the security of the service | Until the window expires, at most a few hours |
| Payment records | The details on the tax document | Legal obligation | Legal obligation | 10 years |
2. What we do not process
- No advertising and no advertising identifiers (IDFA, GAID).
- No tracking SDKs and no third-party analytics — there is no Google Analytics, Firebase Analytics, Meta SDK or anything of the sort in the app.
- No profiling for advertising and no automated decision-making with legal effects.
- No sale or rental of data. Not ever, to anyone.
- No tracking cookies. The app stores only your sign-in token and your settings on the device (see section 6).
3. The creator application
If you apply to add your own music to Meditee, you fill in a form that contains more sensitive details than the rest of the app. We list them separately so you know exactly what you are giving us.
| What | Why | How long |
|---|---|---|
| Artist name, bio, genres, links to profiles, a link to a sample | Assessing the application | While the account exists; 1 year for a rejected application |
| Billing name, street, city, postal code, country, company ID and VAT ID | Issuing tax documents and meeting tax obligations | 10 years from the last document |
| Payout method, IBAN and SWIFT or PayPal address, currency | Paying out royalties | 10 years from the last payout |
These details are entirely voluntary — we never ask for them unless you apply. Bank details are used only to pay royalties and are shared with no one except the bank and {{DOPLNIT: účetní nebo daňový poradce, pokud ho máte}}.
You can withdraw the application at any time. Deleting the account removes all of it, except tax documents already issued, which we must archive.
4. Who else sees the data
We do not pass data to anyone who could use it for their own purposes. Only suppliers who help us run the service see it, and they process it on our instructions:
| Who | What they do | Where they are |
|---|---|---|
| {{DOPLNIT: poskytovatel hostingu}} | Running the server and the database | {{DOPLNIT: sídlo a umístění serverů}} |
| {{DOPLNIT: poskytovatel e-mailových služeb}} | Sending e-mail | {{DOPLNIT: sídlo poskytovatele e-mailu}} |
| Apple Inc. / Google Ireland Ltd. | Sign-in with Apple or Google if you use it; payment processing in the App Store and Google Play | USA / Ireland |
| {{DOPLNIT: další zpracovatelé — účetní, platební brána, provozní dohled}} | {{DOPLNIT: co dělají}} | {{DOPLNIT: sídlo dalších zpracovatelů}} |
We may also give data to public authorities where the law requires it.
We do not transfer data outside the European Economic Area, with the exception of signing in with Apple, where the verification happens on their side. Such a transfer relies on the European Commission's standard contractual clauses.
5. Music, downloads and server logs
Music is streamed from our server. The server keeps ordinary web server logs for file requests, which may contain an IP address. They are used to find errors and abuse and we do not link them to your account. {{DOPLNIT: doba uchování provozních logů u poskytovatele hostingu}}.
If you download music for offline listening, the files stay in your device's storage. We never send them anywhere and we have no access to them. Delete them in Settings → Offline, or by uninstalling the app.
6. What the app stores on your device
Meditee uses no tracking cookies. In your browser's or app's local storage it keeps:
- the sign-in token, so you do not have to type your password every time,
- your settings — language, light or dark appearance, the track you last played,
- a cached copy of the catalogue, so the app opens quickly,
- downloaded tracks, if you download them yourself.
All of it disappears when you sign out or clear the app's data in your browser.
7. Notifications
Meditee can send one daily reminder at a time you choose. It is optional — off by default, and you can turn it off at any time in Settings.
The reminder is put together by the device itself. We do not send it through a server and we do not know whether you noticed it.
8. How we protect it
- Passwords are stored only as a bcrypt hash. We do not know your password and cannot recover it.
- The sign-in token is also stored only as a hash (SHA-256) and is valid for at most 90 days.
- All traffic between the app and the server runs over HTTPS.
- The website and the app have a strict Content Security Policy that allows no scripts from third-party domains.
- Only the application and the server administrator can reach the database.
If a breach happened despite all this and it meant a high risk for you, we would tell you and report it to the Czech Office for Personal Data Protection within 72 hours.
9. How long we keep the data
Account and library data is deleted together with the account. What stays and why is described on the Deleting your account page.
We may delete an inactive account that nobody has signed into for {{DOPLNIT: doba neaktivity, např. 24 měsíců}}. We will warn you by e-mail first.
10. Your rights
Under the GDPR you have the right to:
- know what data we process about you and get a copy of it,
- have inaccurate data corrected,
- have your data deleted — yourself in the app, or on request,
- restrict the processing or object to it,
- receive your data in a machine-readable format and take it elsewhere,
- lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz, Pplk. Sochora 27, Prague 7), or with the supervisory authority in your own country.
Send your request to {{DOPLNIT: e-mail pro osobní údaje}} from the address on your account. We handle it within 30 days, free of charge. If you write from a different address, we have to verify it is you first — otherwise anyone could write in someone else's name and have their data deleted.
11. Children
Meditee is not intended for children under {{DOPLNIT: minimální věk, doporučeno 15 let}} and we do not knowingly collect their data. If we find out an account belongs to a younger child without a guardian's consent, we delete it.
12. Changes to this policy
We may update this policy if the service or the law changes. We announce a material change by e-mail and in the app at least 30 days in advance. The effective date is always at the top of this page.
Ask us anything at {{DOPLNIT: e-mail pro osobní údaje}}.