Privacy policy

• No account, no advertising, no data resale, no audience-measurement trackers.
• Your music services are only linked if you ask, and you can delete everything from the app.
• Payment is handled by Stripe: Mivyn does not see your card.

• Your device: a hardware identifier (used to recognise your Mac, count a license's devices and grant the trial only once), the device's name, its platform, and a secret (stored encrypted, hashed on the server) that proves it is the same device. An invisible technical account, with no real name or email, is created for it.
• Your license: the key, plan, billing period, payment status, activated devices, and the Stripe customer ID. When you buy, Stripe collects your email, name and payment method; Mivyn receives your email and name to send your key and manage your subscription.
• Your music services, if you link them: your account's ID and display name, country, access tokens (kept on the server, which passes them to the app only briefly when playback needs it), and your synced library: playlists, albums, liked tracks, recent plays and most-played tracks (title, artist, artwork), and your favourite platform.
• Referral: your code and, if you arrive through a friend's link, that friend's code (kept in a cookie for 30 days).
• Former website accounts: the email, name, photo and passkeys of people who had created an account before accounts were removed.
• Technical logs: IP address, device type and pages requested, kept by the host for security and proper operation.

The player's state (last track, position, shuffle, repeat, volume, theme, language) stays only on your Mac.

• Running Mivyn, checking and managing your license, sending your key, processing your subscription: performance of the contract.
• Showing your library and starting playback from your services: your consent, given by linking the service (withdrawable at any time).
• Preventing abuse (repeated trials, key sharing, fraud) and securing the service: legitimate interest.
• Keeping payment records and accounting: legal obligation.
• Referral: performance of the contract (the benefit you ask for).

• A service's library and tokens: until you unlink it or delete your data; they are then erased.
• Device and technical account: as long as the device is active; erased when you delete your data.
• Trial identifier: kept so the same device cannot restart its trial (legitimate interest), 3 years at most.
• License and payments: the duration of the contract, then 10 years for accounting records (legal obligation).
• Technical logs: per the host, generally 30 days.

Mivyn never sells your data. It is processed by providers (processors), for the purposes above only:

• Supabase: database and storage;
• Vercel: hosting of the site and the server;
• Stripe: payment and invoicing;
• Keygen: license key and device management;
• Resend: sending emails (key, confirmations);
• Spotify and Apple: they receive the requests Mivyn makes on your behalf (reading your library, starting a track); they are responsible for their own processing, under their own policies.

Some of these providers are located in the United States. Transfers rely on the mechanisms the GDPR provides for (adequacy decision / EU-US Data Privacy Framework, or standard contractual clauses).

You may ask for access to your data, its rectification, erasure, restriction or objection to processing, and portability; withdraw your consent at any time; and set instructions for your data after your death.

• Delete your data: in the app, Settings › “Delete my data”. This erases the device's technical account, the linked services, the synced library, and frees the place on your license.
• Unlink a service: “Linked accounts” › “Unlink” erases that service's tokens and library.
• Any other request: fmenoni@proton.me, reply within one month. Proof that the key or device is yours may be requested.

If you think your rights are not respected, you can complain to the CNIL (cnil.fr), the French data protection authority.

Mivyn uses no advertising or audience-measurement cookies. Only strictly necessary cookies and trackers, exempt from consent, are set:

• mivyn-locale: your language (1 year);
• mivyn-theme and site settings (browser local storage): theme, record, preferences;
• mivyn_ref: a friend's invitation code, only if you arrive through their link, to apply your free month (30 days);
• session and authentication cookies for former website accounts, and technical cookies for linking Spotify (a few minutes).

The Mac and iPhone apps use no cookies; they keep settings on the device.

Access to data is limited; service tokens are readable only by the server; exchanges are encrypted (HTTPS); device secrets are stored in the macOS Keychain and only hashed on the server. No security is absolute: in case of a breach affecting your data, you would be told as the law requires.

Mivyn is meant for adults, or for minors with their legal representative's consent for the subscription. It does not seek to collect data from children under 15 without that consent.

This policy may change; the update date is at the top of the page, and an important change is flagged in the app.