Who is responsible
Inspoetry, registered in South Africa, operates the Inspoetry app and this website. The public contact details for privacy questions appear on our Contact page.
For correspondence: c/o ZimApps, 66 Paul Street, London, EC2A 4NA, United Kingdom. For privacy enquiries, contact privacy@inspoetry.com. This correspondence address does not change the service operator identified above.
This notice covers our current prototype and the account, submission and music features when enabled. Reading does not require an account.
What stays on your device
Your selected artists and moods, reading preferences, saved quotes, reading progress, reminder settings and votes on quote explanations are stored on your device or in your browser. They are not currently synced to your Inspoetry account.
Unsent submission drafts are stored locally. Drafts can remain after sign-out so you can resume them. Local notifications use your device's notification permission and schedule. The current app does not register a remote push token for these reminders.
Signing out does not clear local preferences or drafts. Clearing app/browser storage removes ordinary local records; operating-system backups and secure credential storage can have separate lifecycles.
Accounts and community activity
When you choose Google or Apple sign-in, our authentication provider, Supabase, receives the sign-in information needed to identify your account. This can include your email address, account identifier, name and profile picture. Apple can supply a private relay email address. We do not receive your Google or Apple password.
We store your account identifier, username, display name, bio and available profile picture. We also store the people you follow, submitted artist/song details, lyric passage, interpretation, source link, review status and moderation notes.
A new contributor profile is private until its first approved contribution. Approved profiles and contributions can be visible without signing in. Public information includes your username, display name, bio, profile photo, approved interpretation, the quote you contributed and genre contribution counts. Pending or rejected submissions and your following list are not published by the current app.
Google sign-in information
When you choose Google sign-in, we request basic identity information: your Google account identifier, email address and basic profile information such as your name and profile picture. Supabase processes the sign-in and provides the account identity used by Inspoetry. We use this information to authenticate you, link your submissions and profile to your account, and handle account requests.
Google sign-in does not give Inspoetry access to your Gmail messages, Google Drive files, calendar or contacts. We do not sell Google account information or use it for advertising. The lyric-analysis workflow uses submissions and their internal account identifiers; it does not need your Google email address, name or profile picture. Public profile details are handled as explained above; your email address is not displayed on your public contributor profile.
You can sign out, remove Inspoetry from your Google account connections, and request deletion of your Inspoetry account through the signed-in account portal. Revoking Google access does not itself delete records already held by Inspoetry.
Reviewing discoveries
Submitted discoveries enter a private review queue. Authorised reviewers can download batches to a locally controlled computer, verify the passage against saved song lyrics, and run a local Ollama/Qwen model to help assess context, meaning and suitability.
The current moderation workflow does not send submissions to a paid hosted AI model API. Its local review files can include your submission, submission identifier and account identifier. These files are personal data too and are covered by our retention process.
Model output is advice to a human reviewer. A model score does not automatically approve or publish your submission. Avoid including private information about yourself or other people in your interpretation or source links.
Connecting Spotify
Spotify is optional. If you connect it, the app requests permission to read basic account and playback information and to control playback. The current permissions include streaming, account country/subscription details, email access, playback state and playback control. Email access can be requested by the authorisation scope even though the current interface only uses display name and subscription information.
Connection tokens are stored in your device's secure storage on native platforms, or in the browser tab's session storage on the web. The current app does not store Spotify tokens in the community database. Connecting or playing music involves requests to Spotify, which processes information under its own privacy policy.
Disconnecting in Inspoetry removes our locally stored connection. You can also revoke Inspoetry's access in your Spotify account settings. Local disconnection alone does not delete Spotify's records or revoke the authorisation on Spotify's servers.
Why we process information
We use account and submission information to provide the community features you ask for, show approved discoveries and profiles, maintain the review queue, prevent abuse, and handle privacy and account requests. We use local preferences to personalise the reading experience on that device.
Under South Africa's POPIA, processing must have an applicable lawful ground. Depending on the activity, these include steps requested by you or performance of the service, consent for optional connections/permissions, our legitimate interests in safety and moderation, and legal obligations. Where UK or EU data protection law applies, the corresponding bases are contract, consent, legitimate interests and legal obligation. We do not treat agreement to this notice as blanket consent.
We do not sell personal information, run advertising tracking, or use submission content to train our own general-purpose model in the current implementation. No marketing email list or product analytics service is currently included in the app or this policy site.
Providers, hosting and transfers
Supabase hosts our account and community database in its London region. Google and Apple provide the sign-in options you select. Spotify provides connected music services. Netlify hosts this policy website and its account request portal. FastComet provides domain registration, DNS and the public privacy mailbox.
Web hosts and infrastructure providers necessarily receive technical request information such as IP address, browser details and timestamps for delivery, security and operations. A website without product analytics still creates infrastructure records. These records are distinct from our on-device reading history.
Although our main community database is in London, provider support, authentication, delivery networks and subprocessors can process data in other countries, including outside South Africa. We must maintain appropriate service agreements and applicable cross-border safeguards; London hosting alone does not mean all processing stays in the UK. Provider terms and privacy notices explain their own processing.
Storage on this website
The information pages load locally hosted fonts and artwork and contain no advertising or analytics scripts. The signed-in data request portal uses browser storage for its authentication session and temporary sign-in verification. The host may use essential security mechanisms. External links and Google, Apple or Spotify pages have their own storage practices.
Retention and deletion
Retention depends on the record and the reason we still need it. Our Data retention page explains current storage and removal criteria. Deleting an account is different from signing out, disconnecting Spotify or clearing a device.
You can request account deletion after signing in through the app's data request screen or this website's account portal. Requests enter a private queue for verification and human handling. We do not claim that submitting a request immediately deletes the data. Copies in provider backups can remain until their configured expiry, and limited records may need to be retained for legal obligations or a documented dispute.
Your choices and rights
Depending on applicable law, you can ask to access, correct, export or delete personal information, object to or restrict certain processing, or withdraw consent for optional processing. We may need to verify that a request comes from the account owner. We will explain any applicable limit or lawful reason for retaining information.
Use the signed-in portal for account requests. A public privacy enquiry does not require an Inspoetry account: contact privacy@inspoetry.com. You may also complain to South Africa's Information Regulator. If UK/EU law applies, you can contact the relevant supervisory authority. This does not limit your statutory rights.
Children and sensitive information
The current prototype is not offered to children; child-specific consent and safety features are not implemented. We do not ask for a date of birth or deliberately collect health records. An interest in a mood is not a medical assessment. Please do not submit sensitive personal information in public profile fields or interpretations.
Protecting your information
We use HTTPS for service connections, authenticated access to private account features and database access rules that restrict private submissions and requests to their owner and authorised service personnel. Downloaded moderation files require separate protection on the reviewer’s computer. No storage or communication system can be guaranteed completely secure.
If we identify a security incident affecting personal information, we will assess it and take the steps required by applicable law, including notifications where required. Contact privacy@inspoetry.com if you suspect a privacy or security problem; do not include passwords or connection tokens.
Changes to this notice
We will update this notice as the service changes and identify the effective date of a published version. Changes that require consent will use an appropriate consent step. This notice describes the current service; it does not mean planned features or retention automation are operating.