Postalgo Privacy Notice

Status: Published
Version: 1.1
Effective date: 2026-08-07
Last updated: 2026-08-07

Postalgo, Postalgo Music, and the services that link to this notice are operated by Floffah ("Postalgo", "we", "us", or "our"). Floffah is responsible for deciding how personal information covered by this notice is used.

This notice explains what we collect, why we use it, who receives it, and the choices and rights available to you. Contact postalgo@floffah.dev with privacy questions or requests.

1. Information we collect

Account information

Authentication is handled by Clerk. When you register or sign in, we may receive:

• your name, username, and email address
• your profile image, if provided
• a Clerk user identifier
• account and session information needed to keep you signed in

We do not collect your password directly.

Postalgo content and activity

We collect information you choose to post, save, or associate with your account, including:

• articles, comments, and other content you publish
• profile information
• follows, likes, bookmarks, and seen activity
• reports, support messages, and moderation correspondence

Public posts and profiles are visible to other people.

Postalgo Music contributions

If you contribute to the music catalog, we collect:

• the catalog information and evidence links you submit
• your proposals, reports, rationales, and edit history
• the time of each contribution and the account that made it
• your acceptance of the applicable contribution terms
• role applications, examination outcomes supplied to us, role assignments, and role audit history
• artist claim information and supporting evidence

Catalog records and selected edit history may be public. Artist claim evidence, security information, and private moderation notes are restricted to people who need them for review or administration.

API developer information

If you request or use an API key, we may collect:

• your application name and contact information
• the organisation you represent, if any
• whether the use is personal or commercial
• the revenue band or other information needed to determine plan eligibility
• API agreement and plan acceptances
• key identifiers, usage totals, request times, error records, and security events

We may collect IP addresses, user-agent information, and request metadata where needed to secure the API, enforce limits, or investigate abuse.

General usage information

We may collect basic information about how the Services are used, such as pages visited, actions taken, timestamps, device or browser information, and service errors. Authentication and other essential features may use cookies or similar technologies.

2. Why we use information

We use personal information to:

• create accounts and authenticate users
• provide articles, profiles, follows, comments, likes, bookmarks, and music discovery features
• publish and maintain the Postalgo Music catalog
• attribute contributions and preserve an accountable edit history
• review artist claims and manage curator or editor roles
• issue API keys, determine plan eligibility, and enforce usage limits
• respond to support, privacy, infringement, and catalog requests
• prevent fraud, spam, security incidents, and misuse
• maintain and improve the performance and reliability of the Services
• comply with legal obligations and enforce our agreements

We do not use your information to train recommendation algorithms or personalise feeds.

3. Lawful bases

Where UK data protection law applies, we rely on one or more of these lawful bases:

• Contract: to create and operate your account, provide requested features, and administer an API agreement
• Legitimate interests: to secure and moderate the Services, maintain a reliable and accountable catalog, prevent abuse, and understand basic service performance
• Legal obligation: where the law requires us to retain, use, or disclose information
• Consent: where we specifically ask for a freely given choice, such as for an optional use that is not needed to provide the Services

Our legitimate interests do not automatically override your rights. We consider whether the use is necessary and whether its effect on you is proportionate.

4. Clerk and other service providers

Clerk handles authentication and may process authentication information under its own privacy policy.

We may share information with hosting, database, security, communications, and other technical providers where they need it to operate the Services for us. We may also disclose information:

• when required by law or a valid legal process
• to protect users, third parties, or the integrity of the Services
• in connection with a reorganisation or transfer of the Services, subject to appropriate confidentiality and notice where required

Public content, profiles, catalog contributions, and public edit history are shared with other users and visitors by design.

We do not sell personal information.

5. International processing

Some service providers may process information outside the United Kingdom. When data protection law requires safeguards for a transfer, we use an applicable legal transfer mechanism or work with a provider that does so. You may contact us for more information about transfers relevant to your data.

6. Retention

We keep personal information only for as long as it is needed for the purposes described in this notice, including security, dispute resolution, and legal requirements. The period depends on the type of information and why we hold it.

In general:

• account information is kept while the account is active and for the period reasonably needed to complete deletion and protect the Services
• ordinary user content is kept until you remove it, delete the account, or we remove it under our terms, subject to backups and legal requirements
• catalog contributions and factual edit history may remain after account deletion because they form part of the continuing catalog record
• public contribution attribution will be removed or anonymised after account deletion where reasonably possible, while restricted audit links may be kept where needed for catalog integrity, security, disputes, or legal obligations
• artist claim evidence and role review records are kept only for as long as needed to decide, administer, audit, or defend the relevant decision
• API application and usage records are kept while the key or agreement is active and afterwards for the period needed for security, limits, disputes, and legal obligations

7. Your rights

Depending on where you live and the circumstances, you may have the right to:

• obtain a copy of your personal information
• correct inaccurate or incomplete information
• ask us to delete information
• restrict or object to certain uses
• receive certain information in a portable format
• withdraw consent where consent is the lawful basis

These rights are not absolute. For example, deleting an account does not revoke the separate licence granted for a catalog contribution, although we will still apply your data protection rights to personal attribution and account links.

Send requests to postalgo@floffah.dev. We may need to confirm your identity before acting on a request.

If UK data protection law applies, you may complain to the Information Commissioner's Office.

8. Security

We take reasonable technical and organisational steps to protect personal information. No online system is completely secure, so you should protect your account and tell us if you suspect unauthorised access.

9. Changes to this notice

We may update this notice when the Services or our use of information changes. We will publish the new version and update the date above. We will bring a material new use of personal information to your attention before it begins where required.

10. Contact

Privacy questions and requests may be sent to:

Floffah
postalgo@floffah.dev