Privacy Policy

This policy applies to everyone who interacts with Eko—fans who back campaigns, artists who run them, and visitors who browse the public catalogue. It covers the Eko website, the Eko mobile apps on iOS and Android, and our backend APIs. It does not cover third-party services that you reach through Eko (for example, an artist’s external storefront or a payment processor’s own checkout page); those services have their own privacy policies and you should read them separately.

2.1 Information you give us directly

• Account profile. Your email address, display name, password (stored only as a salted hash; we never see the plaintext), country, profile photo, banner image, bio, and links to your social profiles.
• Industry role. Whether you signed up as a fan, artist, manager, label, or other music industry role, plus optional metadata that role requires (e.g. artist genres).
• Content you create. Campaigns, songs and audio files you upload, cover art, descriptions, reward tiers, comments, badges you award to supporters, messages you send in community channels, and the metadata around them (timestamps, edits, reactions).
• Support and feedback. Information you give us when you contact privacy@ekomusic.app, fill out a help form, or send bug reports.

2.2 Information we collect automatically

• Device and connection. IP address, approximate location derived from that IP (country and region), browser type, operating system, app version, device model, and language preference.
• Usage. Pages you view, features you use, songs you stream, campaigns you back, and the time you spend on the platform. We use this to make Eko faster and to surface music we think you’ll like.
• Crash and performance data. When the app or website fails we log the error, the screen you were on, and a stack trace so we can fix it.

2.3 Information from third parties

• OAuth providers. If you sign in with Google, Apple, or Facebook we receive your name, email address (or, for Apple, the email or Apple-issued relay alias you choose to share), and profile photo. We don’t see your password.
• Payments. Our payment processor sends us the result of each payment (success / failure / chargeback) and a token that lets us reference the transaction. We never receive your full card number, CVC, or bank details — those go directly to the processor.
• Referrals. When you arrive via a referral link we record which user invited you so they can earn the referral reward.

2.4 Location information

Eko shows events near you and lets artists target campaigns by region. If you enable location, the mobile app sends your approximate coordinates and city to our servers. You can turn this off at any time in your device settings or in Settings → Privacy inside the app, and the feature simply stops working — we don’t collect location data passively in the background.

2.5 Information we don’t collect

We don’t collect your contacts, your photos outside of what you upload to Eko, your messages outside Eko channels, or any data from other apps on your device. We don’t use third-party advertising trackers and we don’t buy data about you from data brokers.

• Run the core platform — account creation, login, profile pages, campaigns, listening, search, and notifications.
• Process payments to artists, distribute referral rewards, and provide tax / accounting records.
• Personalise recommendations (campaigns you might like, artists nearby, badges to award).
• Send transactional emails (welcome, email verification, password reset, campaign updates from artists you back, receipts, payout statements).
• Detect and prevent fraud, abuse, and violations of our terms of service.
• Improve the product through aggregate analytics on feature usage and crash reports.
• Comply with our legal obligations (tax, anti-money laundering, court orders).

We do not use your personal data to train machine-learning models that benefit third parties, and we don’t sell your information for advertising.

If you’re in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) requires us to identify a legal basis for each kind of processing. We rely on:

• Contract. Processing needed to give you the Service you signed up for (running your account, hosting your campaigns, paying out earnings).
• Legitimate interests. Keeping the platform secure, preventing fraud, improving product quality, and basic analytics.
• Consent. Optional features such as location, marketing emails, and push notifications. You can withdraw consent at any time without affecting prior processing.
• Legal obligation. Tax records, responding to law-enforcement requests, KYC checks required by payment partners.

We share information only as described below:

• Service providers. Hosting, database, email delivery, push notifications, analytics, and error reporting partners process data on our behalf under written contracts that restrict use of your data to providing the service.
• Payment partners. Our payment processor and (where applicable) local payout banks receive the data they need to process payments and remit funds.
• OAuth providers. When you sign in with Google, Apple, or Facebook we exchange tokens with them so they can authenticate you. We don’t share your activity on Eko back with them.
• Other users. Your public profile, your campaigns, your comments, and the supporter badges artists award you are visible to other Eko users by design. Private content (drafts, messages, payment details) is not.
• Legal requests. We may disclose information if we’re required to by law, court order, or a binding regulator’s request, or to protect the rights, property, or safety of Eko, our users, or the public.
• Business transfers. If Eko is acquired, merged, or restructured, your information may transfer to the successor entity. Your rights under this policy will continue to apply.

We never sell your personal information, and we don’t share it with advertisers for cross-context behavioural advertising.

You can create an Eko account with your email and a password, or use a third-party sign-in provider.

• Google. We receive your email, name, profile photo URL, and a stable Google user identifier. We use the email to send transactional messages and the identifier to recognise you on subsequent sign-ins.
• Apple. We receive a stable Apple user identifier and, on your very first sign-in only, your name and either your real email or an Apple-issued private relay alias of the form xxx@privaterelay.appleid.com. Emails we send to a relay alias are forwarded by Apple to your real address; Apple can disable the alias at any time, at which point we can no longer reach you. We store only what Apple chooses to disclose — you can stop sharing it at any time in your device’s Settings → Apple ID → Sign-in & Security → Apps Using Apple ID.
• Facebook. We receive your name, email, profile photo URL, and a stable Facebook user identifier with your permission. Removing Eko from your Facebook apps will revoke that access, but your Eko account remains until you delete it.

Card payments, artist payouts, and identity checks are handled by our payment processor. When you pay by card, your card details are sent directly to the processor over an encrypted connection and we never see them. We receive a token plus the success or failure result, which we store with your account for receipts, refunds, and dispute handling.

Artists who receive payouts complete bank payout setup, which requires identifying information (name, address, date of birth, government-issued ID in some regions, bank details). That information is held by the payment processor under their privacy policy; Eko only sees whether setup completed and the payout status of each transaction.

The Eko iOS and Android apps request only the permissions they actually need. Each request shows you exactly why it’s asked, and you can revoke them at any time in your device settings.

• Photos & files. Used when you upload an avatar, cover art, or a song.
• Camera (optional). If you choose “take a new photo” from inside the photo picker, iOS will request camera permission. Eko never accesses the camera in the background and never records video.
• Location (optional). Used to show events and artists near you, and to let artists target geographic regions for campaigns. Eko only reads your location while the app is open (“when in use”) and never tracks you in the background.
• Notifications. Used to alert you when an artist you back posts an update, when a payment is processed, or when someone interacts with your campaign.
• Background audio. Used to keep music playing when the screen locks.

We do not request access to your contacts, microphone, calendar, reminders, Bluetooth devices, or any cross-app tracking identifiers.

The Eko website uses a small number of first-party cookies and equivalent browser storage to keep you signed in, remember your preferences (theme, sound volume), and measure feature usage in aggregate. The mobile apps use the equivalent on-device storage to cache your auth token and recently viewed campaigns offline.

We do not use third-party advertising cookies. Where local law (for example, the EU ePrivacy directive) requires consent for non-essential cookies, the website shows a consent banner the first time you visit.

Eko is operated from the United States with data centres in multiple regions. If you access the Services from outside the country where our servers are located, your information will be transferred across borders. Where required by GDPR or UK law, we rely on the European Commission’s Standard Contractual Clauses (and their UK addendum) and apply appropriate technical safeguards such as encryption in transit and at rest.

• Account data — for as long as your account is active, plus a short grace period in case you change your mind about deletion.
• Financial and tax records — for the period required by applicable tax law (typically up to seven years) even after you delete your account.
• Server logs — for up to ninety days for security and debugging.
• Backups — for up to thirty days after the live data has been deleted.

We protect your data with TLS in transit, encryption at rest for sensitive fields, hashed passwords (bcrypt or equivalent), least-privilege access controls for our staff, two-factor authentication on administrative accounts, and regular dependency and infrastructure audits. No system is ever perfectly secure, but if a breach affecting your personal information occurs we will notify you and the relevant regulators within the timelines required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and the personal information attached to it (see §14 below).
• Port your data to another service in a machine-readable format.
• Object to or restrict certain processing, including opting out of marketing emails.
• Withdraw consent for processing that relies on consent (such as location).
• Lodge a complaint with your local data-protection authority. In the UK that’s the Information Commissioner’s Office (ico.org.uk); in the EU it’s the authority in your member state.

To exercise any of these rights, write to privacy@ekomusic.app and we will respond within thirty days, or sooner if your jurisdiction requires a shorter window.

13.1 California residents (CCPA / CPRA)

If you’re a California resident, you have the right to know what categories of personal information we collect, the right to request deletion, the right to opt out of sale or sharing (we don’t sell or share for cross-context advertising), and the right not to be discriminated against for exercising these rights. You may also designate an authorised agent to make a request on your behalf.

You can permanently delete your Eko account at any time:

• Web: Settings → Account → “Delete account.”
• iOS & Android apps: Profile → Settings → Account → “Delete account.”
• Email: write to privacy@ekomusic.app from the address on file.

Deleting your account removes your profile, your content (campaigns, songs, comments, messages), and your personal information from our live systems. Some records have to be kept longer to meet legal obligations — for example, transaction records are retained for tax purposes — and these are stored separately with restricted access. Public content created before deletion (a comment you left on another artist’s campaign, for instance) may remain visible in anonymised form.

Eko is not directed to children under the age of 13 (or under 16 in jurisdictions where local law sets a higher threshold for children’s data processing). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@ekomusic.app and we will delete it.

We may update this policy from time to time. When we make material changes we’ll let you know by email, by an in-app notice, or by posting a banner on the website at least seven days before the change takes effect. The “Last updated” date at the top reflects the most recent revision. Older versions are available on request from privacy@ekomusic.app.

Questions, requests, or complaints? We’d rather hear from you than leave you guessing.