Privacy Policy
Last updated 7 September 2026 · Tom Seymour, trading as Replayd · Queensland, Australia
replaydit@gmail.comWho we are
Replayd is operated by Tom Seymour, trading as Replayd, based in Queensland, Australia. This policy explains how we handle personal information when you browse Replayd, create an account, use its music and community features, or contact us.
You can delete your account in Settings using Delete account, as explained below. Contact replaydit@gmail.com for privacy questions, access or correction requests, deletion help if you cannot use Settings, or complaints.
Information we collect
Account information includes your email address, username, display name, account settings, and profile details you choose to provide. If you set a password, we store a password hash rather than the password itself. We also hold session and account-verification records needed to secure your account.
We store content and activity you submit, including album and track ratings, reviews, comments, lists, saved albums, favourites, likes, and follows. We receive information you send when asking for support.
Our servers and service providers may process technical information such as IP addresses, browser and device information, request times, and error or security logs when you use the service.
Google and Spotify
Where Google sign-in is available and you choose it, we receive your Google account identifier, email address, and email-verification information. These let us identify you and create or sign you into Replayd. We do not receive your Google password or request access to Gmail messages, YouTube activity, contacts, or Drive files. We do not store Google's access, refresh, or ID tokens for this sign-in feature.
If you choose Spotify sign-in or connection, we receive account information such as your Spotify identifier, email address, and display name. With the permissions you grant, we may retrieve recently played music for listening features. We may store a Spotify refresh token to maintain that connection. You can disconnect through Replayd settings or revoke access in your Spotify account. Disconnecting does not automatically delete reviews or lists you created in Replayd.
Google and Spotify also process information under their own privacy policies. You can use Replayd's email-and-password registration instead of provider sign-in.
How we use information
We use information to operate your account, display your content according to available privacy settings, provide discovery and social features, send account and security emails, respond to requests, diagnose faults, prevent misuse, and meet applicable legal obligations. Providing the account information requested at registration is necessary to create an account; you can browse public pages without registering.
What other people can see
Replayd is a community service. Your username and basic profile identity can be visible to others. Public reviews, ratings, comments, lists, and social interactions can be viewed, shared, and indexed by search engines. Do not put private contact details or sensitive information in public content.
Private-profile and private-list settings restrict the content covered by those controls; they do not make you anonymous or remove copies already shared elsewhere. Listen Later is treated as a private saved list. Your account email, password hash, and authentication credentials are not public profile fields.
Service providers and overseas processing
We use AWS for hosting and database infrastructure, Resend for account-email delivery, and Google/Gmail to receive support correspondence at our contact address. Providers receive the information necessary for their role, such as an email address and account-email content for email delivery.
Music catalogue and release features use providers including Spotify, MusicBrainz, ListenBrainz, and Cover Art Archive. Calendar catalogue requests do not include Replayd user IDs, account emails, reviews, or account activity. When your browser loads artwork or follows an external link, the external service may receive your IP address and browser request information.
Our providers may process information outside Australia, including in the United States and other countries where they operate. Processing locations depend on the service and its configuration. Contact us for information about the locations relevant to your request. We may also disclose information where required by law or reasonably necessary to protect users, enforce our terms, or respond to a lawful request.
Security and retention
We use measures such as password hashing, access controls, and secure transport to protect information. No internet service can guarantee absolute security. Keep your account credentials and recovery links private and contact us if you suspect unauthorised access.
We retain account information and content while needed to provide the service, and may retain limited records for security, dispute resolution, or legal obligations. Confirmed account deletion removes your account and associated content from the live database. Copies in backups or third-party caches may remain temporarily; retention varies by record type and provider, and we do not promise an immediate purge of those copies.
Your choices and requests
You can update available profile and privacy settings and edit or remove your own content using the controls provided.
To delete your account yourself, sign in and open Settings. In Delete account, select Delete my account, then Send confirmation code. Enter the six-digit code sent to your account email address, type DELETE, and select Permanently delete account. The code expires after 10 minutes. Requesting a code alone does not delete anything, and you can cancel before the final confirmation.
Deletion is permanent: it removes your profile, reviews, ratings, lists, Listen Later and associated community activity from the live database, and invalidates your Replayd sessions. Shared album, artist and track catalogue records remain. Deleting Replayd does not delete your Google or Spotify account or immediately remove backup and external cache copies.
You do not need to email us to use self-service deletion. If you cannot sign in, cannot access your account email, or need help with deletion, contact replaydit@gmail.com. You can also email us for access, correction or questions about retained information. We may ask for proportionate information to verify account ownership; never email us your password, confirmation code or login token.
We assess requests under applicable law and explain any limitations, including records that must be retained. To complain, describe your concern and the outcome you seek. We aim to respond within 30 days and will let you know if more time is needed. If unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au, where it has jurisdiction, or your relevant privacy regulator.
Changes to this policy
We will update this page when our practices change and show the revision date above. For material changes, we will provide an appropriate notice, such as an in-service notice or email. Where required, we will seek consent before using information for a new purpose.