Privacy Policy

Section 1 Who the controller is and how to contact us

The data controller is KEYCAP NYC LLC, a limited liability company organized under the laws of the State of New York (United States), with its office at 85 John Street, Suite 2J, New York, NY 10038, United States («Spoilery», «we» or «us»).

As we have no establishment in the European Union, we have designated Luigi Florio, Via Paolo Lomazzo 19, 20154 Milano (MI), Italy, email accounting@spoilery.net, as our representative in the EU under Art. 27 GDPR. You can contact the representative, in addition to us, on any matter relating to the processing of your data.

For questions about your data and to exercise your rights (section 9), write to accounting@spoilery.net, in Italian or in English. It is the same support address given in the Terms.

Section 2 What data we process

We process the data you give us, the data generated by how you use the app and the data passed to us by the service you sign in with. We do not collect passwords, payment card details, your phone's contacts or your device's precise location.

The spoilery.com website does not use profiling cookies or analytics tools. The provider hosting it records, like any web server, the IP address and technical data of requests.

Section 3 Why we process it and on what basis

We use your data to run Spoilery as described in the Terms, to protect it from abuse and to comply with the law. Usage statistics, personalized ads and push notifications instead depend on your consent, which you can refuse without losing the use of the app.

If you do not give us the data needed for the contract, we cannot create an account for you or publish your tracks. We do not use your tracks or your voice to train artificial intelligence systems, and we do not sell your data.

Section 4 Where the data is and who sees it

Spoilery's database, audio files, covers and server functions are located in Google Cloud data centers in the European Union. Some technical services of our providers also operate outside the EU: they are listed below and in section 5.

Inside Spoilery

• Your fan profile is not visible to other users. Artists see the data of their own spoilers only in aggregated form, without knowing who voted.
• From an artist profile, other users see the stage name, together with the published spoilers, their votes and their positions in Spoilery Stars.
• Verified professionals in the Pro Portal see the stage name, genre, statistics and indices of spoilers and can listen to them. They do not see fans' data.
• Our authorized staff access the data only for moderation, support and security.

Providers processing data on our behalf

They are processors (Art. 28 GDPR), bound by a contract and by our instructions.

Independent controllers

These parties process your data on their own account, under their own privacy policies:

• Instagram (Meta), TikTok, Google and Apple, when you sign in with their accounts;
• Apple and Google as stores, for purchases, subscriptions and refunds;
• Google for AdMob ads (how Google uses information from partner apps).

We may also disclose data to legal and tax advisers bound by confidentiality and to authorities that request it by law.

Section 5 Transfers outside the European Union

The app's content and data are stored in the EU, but some data leaves the EU when it is processed by the services in section 4 that operate in the United States or on global infrastructure:

• account data (identifier, name, email where available, sign-in IP address), managed by Firebase Authentication in the United States;
• the notification token and app integrity checks, managed by Google;
• usage statistics, if you have given consent;
• technical data of visits to the spoilery.com website, managed by Vercel.

Spoilery is based in the United States: the GDPR nevertheless applies directly to the processing of your data (Art. 3(2) GDPR). Our staff access data from the United States only for moderation, support and security, with the safeguards described in this policy.

Each transfer takes place with one of the safeguards provided by the GDPR: the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for certified providers such as Google and Vercel (Art. 45), or the standard contractual clauses approved by the Commission (Art. 46). You can ask us for a copy of the safeguards by writing to accounting@spoilery.net.

Section 6 How long we keep it

We keep data while your account is active and delete it when you delete the account, except in the cases in the table. If a dispute or a request from an authority is pending, we keep the data needed until it is concluded.

Section 7 Minors

You must be at least 14 years old to use Spoilery: this is the age from which, in Italy, you can consent on your own to the processing of your data for online services (Art. 2-quinquies of the Italian Privacy Code). If you live in another EU country that sets a higher age, until that age usage statistics and personalized ads require the consent of a parent.

You must be an adult to turn on Artist mode, make purchases and take part in contests. Users under 18 are shown only non-personalized ads.

If we find that an account belongs to a person under 14, we close it and delete their data. A parent who believes that their child gave us data without being old enough can write to us at accounting@spoilery.net.

Section 8 Statistics, ads and notifications: your choices

Usage statistics, personalized ads and push notifications are turned on only if you say yes, and you can change your mind at any time. Saying no does not take away any feature of the app.

• Usage statistics. When you first open the app we ask whether to turn them on, with «Accept» and «Decline» given equal weight. Until you accept, Google Analytics collects nothing. Your choice applies to the device on which you make it, and you can change it in the Profile settings. We do not link statistics to your name or account: Google uses an installation identifier, so the data is pseudonymous, not anonymous.
• Rewarded ads. The first time you choose to watch an ad, Google's consent form asks whether you accept personalized ads; on iPhone and iPad, Apple's tracking request also appears. If you decline, you can still watch ads, which will not be personalized. You can change your choice in the Profile settings.
• Push notifications. You turn them on with the device permission. In the Profile settings you choose which ones to receive: new spoilers in your genres, hits, reset of the daily limit, votes on your spoilers, charts, review outcome. For new spoilers we subscribe the device to a channel per genre and language, with no other data. You can also turn them off in the device settings.

Section 9 Your rights

You can ask us at any time, free of charge, for:

• access: to know what data of yours we process and receive a copy (Art. 15 GDPR);
• rectification: to correct inaccurate data or complete incomplete data (Art. 16);
• erasure: to delete your data, except data we must or may keep under section 6 (Art. 17);
• restriction: to suspend the use of your data while we check a challenge you have raised (Art. 18);
• portability: to receive the data you gave us in a structured, machine-readable format, or have it transmitted to another controller (Art. 20);
• objection: to object to processing based on our legitimate interest, on grounds relating to your situation (Art. 21);
• withdrawal of consent: to withdraw consent you have given, without affecting processing already carried out (Art. 7(3)).

You can do some things yourself in the app: edit your profile, change your choices on ads, statistics and notifications in the Profile settings, and delete your account from Profile → Delete account.

For everything else, write to accounting@spoilery.net. To protect your data we may ask you to confirm the request from the app or with the social account you sign in with. We reply within one month; in complex cases we may extend this by two further months, informing you within the first month (Art. 12(3)).

If you believe that we process your data in breach of the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work (Art. 77), or go to court (Art. 79).

Section 10 Automated indices, security and changes

Indices and automated decisions. Some features evaluate votes and plays automatically. None of them produces legal effects on you; for decisions about your tracks you can always ask for review by a person.

• Hit-score, hit probability and AI score are indices calculated with fixed formulas from votes, saves, listening completion and number of listeners (Art. 15.2 of the Terms). They determine the order of Spoilery Stars and what professionals see in the Pro Portal.
• Trendsetter score: measures how often and how early a fan gives a HIT to tracks that then become hits. The vote of a fan with a higher score carries more weight, from 0.5 to 1.5 times a normal vote.
• Discover ranks spoilers based on the genres you have chosen and voted on, novelty, recent popularity and promotions.
• Audio recognition: if the comparison with the archives recognizes a released track with certainty, the spoiler is rejected automatically. You can challenge the rejection and the decision is reviewed by a person (Art. 13.5 of the Terms).
• Accounts on the same device: votes and plays from accounts using an artist's device do not count in the statistics of that artist's spoilers.

Security. Data is encrypted in transit and at rest on the servers. Access is controlled per user, and tracks can be listened to only through links that expire after 15 minutes. Plays are recorded with a pseudonymous code, IP addresses only in hashed form, and service keys are kept in a protected vault. If a data breach exposes you to a high risk, we notify you without undue delay (Art. 34 GDPR).

Changes. We may update this policy when the service or the law changes. We publish the new version on spoilery.com and, if the changes are significant, we notify you in the app before they apply.

Version 1.0 of 14 October 2026.

United States Notice for Users in the United States

This notice supplements the policy above for users who live in the United States, including for the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act («CCPA»), the California Online Privacy Protection Act and the comprehensive privacy laws of other states. We honor the requests described below for all users in the United States.

Personal information we collect. In the last 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 2 and 3, and disclosed them for business purposes only to the providers listed in section 4.

We do not collect sensitive personal information as defined by California law, and we do not use voice recordings to identify you.

Sale and sharing. We do not sell personal information for money. If you accept personalized ads, Google AdMob may use device identifiers for cross-context behavioral advertising, which California law may treat as «sharing» and other state laws as targeted advertising. You can opt out at any time by declining personalized ads in the consent form or in the Profile settings (section 8). We do not sell or share the personal information of users under 18, who are shown only non-personalized ads. The spoilery.com website does not sell or share personal information. We do not disclose personal information to third parties for their own direct marketing purposes.

Your rights. Depending on your state, you have the right to:

• know what personal information we collect, use and disclose, and access a copy of it, including in a portable format;
• delete it, subject to the exceptions in section 6;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information and of targeted advertising;
• not be discriminated against for exercising these rights.

To exercise them, write to accounting@spoilery.net. We verify your request by asking you to confirm it from the app or with the account you sign in with. You may use an authorized agent, who must provide your written authorization; we may still ask you to verify your identity. We respond within 45 days, which we may extend by a further 45 days where necessary, telling you why.

Appeals. If we refuse your request, you can appeal by replying to our decision with the word «Appeal». We respond within the time required by your state's law and explain our decision. If the appeal is denied, you can contact your state Attorney General.

Retention. We keep each category of personal information for the periods in section 6.

Do Not Track. The app and the website do not respond to Do Not Track browser signals, because the website does not track visitors and the app asks for your consent before collecting statistics or showing personalized ads.

Children under 13. Spoilery is not directed at children under 13 and we do not knowingly collect their personal information. If we learn that we have, we delete it and close the account. Parents can contact us at accounting@spoilery.net.

Where your data goes. Your data is stored mainly in the European Union and processed by the providers in section 4, some of which operate in the United States.

This notice was last updated on 19 October 2026.