Legal

Privacy Policy

Last updated October 3, 2026

This policy explains what personal data Alyona collects, why, who can see it, and the choices and rights you have. We collect what we need to run Alyona — no advertising, no tracking across other sites.

1. Who is responsible

The controller of your personal data is Alyona LTD., Ockershauser Allee 8, Marburg, Germany. Contact us about privacy at legal@alyona.io.

2. What we collect

Data	Where it comes from	Why we use it
Name, email address, profile photo	Your sign-in provider (Google), when you sign in	To create and secure your account and show your profile
Username and bio	You	Your public profile at /@username
Date of birth	You, at sign-up	To check you are 18 or over. Never shown to anyone.
Favorite genres	You, at sign-up	Shown on your profile; helps describe your taste
Prompts you write	You, when you Create	To pick a track and to show your creation with its prompt
Creations, likes, “not for me” marks, plays	Your use of Alyona	Your library, profile, recommendations and plan allowance
Comments	You	Shown on the track to other members
Plan and monthly usage	Your use of Alyona / our records	To apply your plan’s limits
Language choice, session and security data	Your browser (see the Cookie Policy)	To keep you signed in, protect sign-in and remember your language

We don’t collect your Google contacts or post anything on your behalf. Alyona has no analytics, advertising or social-media trackers.

3. Legal bases

Contract — to provide Alyona to you: your account, creations, library, profile and plan.
Legal obligation and legitimate interest — to enforce the minimum age, keep Alyona secure, prevent abuse and handle copyright notices.
Consent — where we ask for it; you can withdraw it at any time.

4. What other people can see

Other signed-in members can see your display name, username, bio, profile photo, favorite genres, the tracks you created (with your username as the artist) and liked, your listening statistics and your comments. Your email address and date of birth are never shown to other members.

Shared links. When a link to your profile or one of your tracks is opened by someone who isn’t signed in — or unfurled into a preview card by apps like Twitter/X, Discord or WhatsApp — it shows a public preview: your display name, username, profile photo, number of tracks and favorite genres, or the track’s title, cover, artist, genre, mood and tempo. Nothing else from your profile is public, and these previews are kept out of search engines.

6. How long we keep it

Account data, creations and activity: while your account is open. You can delete your account yourself in Settings → Delete account; it is deleted immediately. If you ask us by email instead, we delete it within 30 days. We keep something longer only where the law requires it.
If someone declares an age under 18, we keep their email address and date of birth so the account can’t be used to sign in again, and delete everything else.
Sign-in sessions expire after 30 days of inactivity.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, and to object to or restrict some processing. You can edit your name, username and bio yourself in your profile, and delete your account in Settings → Delete account. For anything else, write to legal@alyona.io. We answer within one month. You can also complain to your local data-protection authority.

8. Security

Sessions are stored server-side and can be revoked; sign-in uses state and PKCE checks; connections are encrypted in production. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of breaches as the law requires.

9. Children

Alyona is only for people aged 18 and over. We don’t knowingly keep data about anyone younger, beyond what’s described in section 6.

10. Changes

We’ll update this policy when our practices change and tell you about material changes before they take effect. See also our Cookie Policy.