Privacy policy
Version 1.0 · updated October 30, 2026
1. Who we are
Coda Music is responsible for handling the personal data described here, under Brazil’s General Data Protection Law (LGPD, Law 13,709/2018). To talk to us about your data, use the contact page.
2. Data we collect
Account: email, name and password (stored in protected form, never as plain text). If you sign in with Google or Microsoft, we receive your name, email and an account identifier, and we don’t keep any access tokens. Subscription: plan, dates, amount and payment status; we don’t store card numbers. We also keep your favorites and your preferred language.
3. Newsletter and contact
Newsletter: your email, language and a record of your consent. Subscribing requires confirmation by email, and every email includes an unsubscribe link. Contact form: name, email, subject and message, used only to reply to you.
4. Playback
We record anonymous playback events (which track or radio was played, and when), tied to a random identifier stored in your browser rather than to your account. We don’t record your IP address in these events.
5. How we use your data
We use your data to create and run your account, manage your subscription, send receipts and service notices, reply to your messages, send the newsletter (only with your consent), measure how often tracks are played and protect the service from abuse. We don’t sell personal data and we don’t use it for advertising. Our legal bases are performance of a contract (account and subscription), consent (newsletter and contact), compliance with legal obligations (tax records) and legitimate interest (anonymous statistics and security).
6. Cookies and local storage
We use a session cookie, valid for up to 14 days, when you sign in. If you sign in with Google or Microsoft, we also set a temporary security cookie that lasts up to 10 minutes. Your device also stores your language, the player volume and the anonymous playback identifier. We don’t use advertising cookies or third-party tracking.
7. Who we share it with
Only authorized staff can access personal data, with access limited by role and recorded in an audit log. We share data with Google or Microsoft only if you choose to sign in with them, and with providers that host and run the service under contract. We may also disclose data when the law or a court order requires it.
8. How long we keep it
Playback events: 13 months. Unconfirmed newsletter sign-ups: 30 days; unsubscribed: 2 years. Password reset requests: 7 days. Emails sent: 90 days. Contact messages handled: 12 months; unhandled: 24 months. When you delete your account, your favorites, sessions, subscription, sign-ups and contact messages are erased immediately. Invoices are kept only with the minimum tax record (receipt, amount, currency, status and dates), with no link to you, for the legal period. Consent records are anonymized and kept for up to 5 years as legal proof.
9. Your rights
Under the LGPD you can confirm that we handle your data, access it, correct it, ask for it to be anonymized or deleted, take it to another service (portability), find out who we share it with and withdraw your consent. With an account, you can download a copy of your data and delete your account under My account (if you have only ever signed in with Google or Microsoft, first set a password through password reset). Without an account, or for any other request, write to us through the contact page. You can also file a complaint with Brazil’s National Data Protection Authority (ANPD).
10. Security
Passwords are stored as hashes, the session cookie can’t be read by scripts on the page, staff accounts require two-step verification, and administrative access is logged. No system is completely immune; if an incident affects your data, we will notify you as the law requires.
11. Changes
We may update this policy. The version in force is always the one published here, with the date of the latest update at the top.